diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/events.jsonl b/evals/unsafe-rust/runs/2026-08-01-v4-focused/events.jsonl index 2fae8020d0..563b0bc9b6 100644 --- a/evals/unsafe-rust/runs/2026-08-01-v4-focused/events.jsonl +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/events.jsonl @@ -1 +1,436 @@ {"details": {"lock_sha256": "cd7a300f83b045f76530eded20ec2d22bd6abbd484d6459ff50245fb07ef943e"}, "event": "freeze_locked", "phase": "freeze", "previous_event_sha256": null, "schema_version": 1, "sequence": 1, "sha256": "059cde170e6e31d4ef4c4997b4a64413fdd9e47e9f9e5df74c1c9707bf6e3c58", "time_utc": "2026-08-01T17:59:50.663768Z"} +{"details": {"entries": 56, "wave": 1}, "event": "authority_verified", "phase": "collection", "previous_event_sha256": "9daef89f0e54540cc0cf88576903be2896e2918f1e3293b7786566ab32c01e77", "schema_version": 1, "sequence": 2, "sha256": "48444682cfc13966ce2769add9d4fbde82426a7a6e8777c421be8b26d15ff293", "time_utc": "2026-08-01T18:01:24.729193Z"} +{"details": {"cell_id": "f283e9f240bd883b1e568b9b0b7d00b5"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "59dc09fde7639308df3a3d73d62dee0f6ec4b6b2ac3e4601cbd2f0e41f6ed9bd", "run_id": "r001", "schema_version": 1, "sequence": 3, "sha256": "435de8504c82af7ff168f4a04a5e24d566257e40e076aeac4fff6ea12e806cb0", "time_utc": "2026-08-01T18:01:32.660755Z"} +{"agent_id": "/root/v4_report_r001", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "9a2180e75ccf0143aa280ad4073f2742018fba8e7d4794534bab80f6e4d57df8", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "04fd00cdfcfe440bb8d04af0856fc5b8e842b33d89bdca07913cca241cebaf63", "run_id": "r001", "schema_version": 1, "sequence": 4, "time_utc": "2026-08-01T18:02:10.165419Z"} +{"details": {"cell_id": "1dfddadf11a44c7a250b3f30dd567335"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "843cc69f7fc94c4fef52c8a7e0d8d084d8221b769418058d4f3d836133648e39", "run_id": "r002", "schema_version": 1, "sequence": 5, "sha256": "aafaac0c0736887eac2d6a34d6d30f093af189c0ed9f5a6dbd01e84bba0f675b", "time_utc": "2026-08-01T18:02:16.454116Z"} +{"agent_id": "/root/v4_report_r002", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "413390469e17e183abcec2c88bfa28cd73ffbcd2bcd50a379eb9e4f999dbe22a", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "8d0256cfb49d3038afad41b284b8cb65aeb77b2b04c548d565c6f3456b4f9ec5", "run_id": "r002", "schema_version": 1, "sequence": 6, "time_utc": "2026-08-01T18:02:37.869537Z"} +{"details": {"cell_id": "5a9f15b6422fe44db62c4d720bdae8a2"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "0edef5eb4bfd42fea9339e4d4c00d92aa2c8b5f8c41ef147d80c9db406ae03d5", "run_id": "r003", "schema_version": 1, "sequence": 7, "sha256": "5ab22090fa567971e94d5580c35e9de9a45cfd9860eed2d6b248fe74a860ba64", "time_utc": "2026-08-01T18:02:46.921103Z"} +{"agent_id": "/root/v4_report_r003", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "f4abfe17babfcf69c5be0db9278d1c2d71a784db9340f96f9a823d2a956dc6f8", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "5b20ea0854f6697026efeb3ddbf0e37d672dba324508882f2dcd6697e831f1cf", "run_id": "r003", "schema_version": 1, "sequence": 8, "time_utc": "2026-08-01T18:03:09.584859Z"} +{"agent_id": "/root/v4_report_r001", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "b77faccac539a99be08ef82bc57a4c758fc8a2f917c21da00e06bca72d246df1", "run_id": "r001", "schema_version": 1, "sequence": 9, "time_utc": "2026-08-01T18:06:19.656360Z"} +{"agent_id": "/root/v4_report_r002", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "16f19770d1246bfbe2c7f4ce3e383cb907ad72fb54f63a09b44d937e67d8ea7d", "run_id": "r002", "schema_version": 1, "sequence": 10, "time_utc": "2026-08-01T18:06:19.836598Z"} +{"agent_id": "/root/v4_report_r003", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "2e7f7205b40694c6639377ae404307c8a3ea2a082dc5dbee48c92d3972109dfc", "run_id": "r003", "schema_version": 1, "sequence": 11, "time_utc": "2026-08-01T18:06:20.016811Z"} +{"agent_id": "/root/v4_report_r001", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "59e1182df18b9cab22bd5f6829c4d15fd00083a5dfcf843a6b44d32410094985", "run_id": "r001", "schema_version": 1, "sequence": 12, "sha256": "67898999c2c30ffc53500bfd95b3dd66cace447fa8f01111d1e585f2529e4558", "time_utc": "2026-08-01T18:07:30.634732Z"} +{"agent_id": "/root/v4_report_r001", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "e8f4d1fd652d0253a1b4fe3a602a5ae42071f102936f191b96a83fc521d7d3fb", "run_id": "r001", "schema_version": 1, "sequence": 13, "time_utc": "2026-08-01T18:07:30.636342Z"} +{"agent_id": "/root/v4_report_r001", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 910}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "3f4e61db4e7dad58606950e84accadd308a1261b98205bb344fc08ab484b9d14", "run_id": "r001", "schema_version": 1, "sequence": 14, "sha256": "6a1aad4f07b372199c6b991e19332f67e30230c93e695d407ce30d97d0fc5df4", "time_utc": "2026-08-01T18:07:30.637975Z"} +{"details": {"cell_id": "5aca9ea4158f1a857bf1005fc73a2273"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "51fb39e1aaa03f020c622c47b9eaca601191392a89b51d588f786b68eb88b80c", "run_id": "r004", "schema_version": 1, "sequence": 15, "sha256": "edae7bc3d179accc0b7799840d35083bba27defaccfe092b2b27617cb98aa957", "time_utc": "2026-08-01T18:07:40.132756Z"} +{"agent_id": "/root/v4_report_r004", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "b84fcaa2bc784a2949b3590cefe0a60791b91cee4b8797a97e47eaa5ea7f419e", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "967d3656d18acee60a8596681343b79dd2f74ec6259feb8519fe6378f2432f0c", "run_id": "r004", "schema_version": 1, "sequence": 16, "time_utc": "2026-08-01T18:08:04.671421Z"} +{"agent_id": "/root/v4_report_r002", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "ebde2ad6efa21cf022ba0609accb699699bd639ebd3e3e96f45c00a7762f86af", "run_id": "r002", "schema_version": 1, "sequence": 17, "sha256": "713a849b9597f2be6eafb3c171e82f2e0454a3d5432258ac4215551d2ba707e2", "time_utc": "2026-08-01T18:11:26.126325Z"} +{"agent_id": "/root/v4_report_r002", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "a7071b3f9258c3427856a51fbdac9f6a6a831d06bfbbda508cb7654f9b1380c1", "run_id": "r002", "schema_version": 1, "sequence": 18, "time_utc": "2026-08-01T18:11:26.128067Z"} +{"agent_id": "/root/v4_report_r002", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 907}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "df6f0ef9b0bb578d65491c324c973967f696a095336ff0abdc249b75410b8b44", "run_id": "r002", "schema_version": 1, "sequence": 19, "sha256": "2f12ab5921c09f2eaf84d142758c151a33e35e8868fb9d7e0ddb3e1b15667c50", "time_utc": "2026-08-01T18:11:26.129676Z"} +{"agent_id": "/root/v4_report_r003", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "7fc64675a5a690106090833513b2cd59fef0583fa3083c9546d540dfb7f1dd5c", "run_id": "r003", "schema_version": 1, "sequence": 20, "sha256": "5c0ee134472fb87754f50c4392cc8844311a61901c2e77526ee04da786208751", "time_utc": "2026-08-01T18:11:46.893494Z"} +{"agent_id": "/root/v4_report_r003", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "f6b81d49f1d5afa3c44e05e6af46ddb69cf98c05b36ece9f3ed90afcb95b2d75", "run_id": "r003", "schema_version": 1, "sequence": 21, "time_utc": "2026-08-01T18:11:46.895132Z"} +{"agent_id": "/root/v4_report_r003", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 896}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "b64b7f6bc6cebae13b03393e7b4530f7c1033c568cd32f96792970c2f387a8b0", "run_id": "r003", "schema_version": 1, "sequence": 22, "sha256": "c8399a0504c893f30a809f39b7426472335f151709ffe5a6960a9cb87f83e9e2", "time_utc": "2026-08-01T18:11:46.896805Z"} +{"details": {"cell_id": "f4506c9f20cbfef429ed5ce317a25141"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "bc69eba4c98eee04272cf3f0e498fb8d73ab3eb694577bbe2eeb506976600fd8", "run_id": "r005", "schema_version": 1, "sequence": 23, "sha256": "59273bb0d6b84d70e252e0041dfc5c14a66f48b5900c648a2e94cf995fc44477", "time_utc": "2026-08-01T18:11:53.762325Z"} +{"agent_id": "/root/v4_report_r005", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "c81f11e0b3589e01624b4553e7b724acfce5646372f6837d2f66f96de3ed624d", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "fb33a9239414d14039c64eeaf75ead52a562fc482fd3d529aedc0a4aff983748", "run_id": "r005", "schema_version": 1, "sequence": 24, "time_utc": "2026-08-01T18:12:21.251716Z"} +{"details": {"cell_id": "1146888d03484c5ea5ca80d8923baca1"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "0ef4170dbb127e9d0057a83a209b261963aed00a77bfb2694c4defa611f7ff2a", "run_id": "r006", "schema_version": 1, "sequence": 25, "sha256": "852cb1edebadfe19ec3b735e349cc1eef0e395b3a20bd8a40f90bc48bb89a5f2", "time_utc": "2026-08-01T18:12:34.496697Z"} +{"agent_id": "/root/v4_report_r006", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "d1519988e10a47e3368747ff6bab68df01057461bff1ddb88077667f67bb1107", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "4bb1ba0d88b2b24e6a628796a9239b26716fe0980c8b9a7f8641ab9f3cb8aaa3", "run_id": "r006", "schema_version": 1, "sequence": 26, "time_utc": "2026-08-01T18:13:01.346721Z"} +{"agent_id": "/root/v4_report_r004", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "f7914b6d4fc2d84ba50ad584bdbaa5eac3da97c151c966f2fb744acde9df8f7f", "run_id": "r004", "schema_version": 1, "sequence": 27, "time_utc": "2026-08-01T18:13:19.195684Z"} +{"agent_id": "/root/v4_report_r005", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "97af526cef1e64769e54b94810fe42bebd2493a41a0a7674155eab8e63280c40", "run_id": "r005", "schema_version": 1, "sequence": 28, "time_utc": "2026-08-01T18:15:50.384697Z"} +{"agent_id": "/root/v4_report_r006", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "851095660e7b570390fdd9db79254f166b14e4f277cb0901a80dc4da8ff4571f", "run_id": "r006", "schema_version": 1, "sequence": 29, "time_utc": "2026-08-01T18:16:32.126419Z"} +{"agent_id": "/root/v4_report_r004", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "afa65e20a031e3eb0dee91433fad0943464f7b5ee7aee292d1dafd208b3f9c18", "run_id": "r004", "schema_version": 1, "sequence": 30, "sha256": "792f28e0821dc799072acf530e9b0d20d85781de1323dc5090a972b31205c553", "time_utc": "2026-08-01T18:16:51.865455Z"} +{"agent_id": "/root/v4_report_r004", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "07f8bab4380c35d48064d513a5f775be90f31f2c899825b6f09335f344cb11fb", "run_id": "r004", "schema_version": 1, "sequence": 31, "time_utc": "2026-08-01T18:16:51.866968Z"} +{"agent_id": "/root/v4_report_r004", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 878}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "bb5e3143194961806e091565d3284c43af22fbb4823b2289c6b5ced719e16832", "run_id": "r004", "schema_version": 1, "sequence": 32, "sha256": "36f4b173f16b9fbeaeed4b9cf467e501d0c986eb4c8ebd3654467e6a5c27a434", "time_utc": "2026-08-01T18:16:51.868474Z"} +{"details": {"cell_id": "b694bd930f677652f7e181a978916b00"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "9d373293a3939cef418bc4f7500cc3248971b4325a9444ffcf092fa8fb2b2627", "run_id": "r007", "schema_version": 1, "sequence": 33, "sha256": "40b5c781a836472b6e8e73f2128292c42b0dc6885161ce0b54e1cf41467b9e5d", "time_utc": "2026-08-01T18:16:58.642214Z"} +{"agent_id": "/root/v4_report_r007", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "0ced704ffa34fe015b2968b51b0e241c731fc13c49d6dbadcb2ba28dd3318e42", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "6cdc8ff71cf194bd202831a57e44f9e287a13403b0c77cc7a93669ae2e2a182f", "run_id": "r007", "schema_version": 1, "sequence": 34, "time_utc": "2026-08-01T18:17:16.924317Z"} +{"agent_id": "/root/v4_report_r007", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "ba876270cbdb3868cfd4d3c5da15b0d37c2f76f3438f2eb474e20e96d792dbbb", "run_id": "r007", "schema_version": 1, "sequence": 35, "time_utc": "2026-08-01T18:20:19.870924Z"} +{"agent_id": "/root/v4_report_r005", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "4de2db156578fd9b4d9c01e10f61023fe0833c9a86fee5921270bcc66a7a7c9f", "run_id": "r005", "schema_version": 1, "sequence": 36, "sha256": "bfa22b1aff6dd98e777f84adad17d1bd828e9e59f772b4e6d38ab706e9cba2c1", "time_utc": "2026-08-01T18:21:34.016611Z"} +{"agent_id": "/root/v4_report_r005", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "1389dd8a127aa562c9e449f67f2c49242c9ca2adf9645725d8f4c1036f69fe06", "run_id": "r005", "schema_version": 1, "sequence": 37, "time_utc": "2026-08-01T18:21:34.018379Z"} +{"agent_id": "/root/v4_report_r005", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1227}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "da83bd9af7802968dbc389304654b94a8f237becdd2ecb02430176d4bccc6c4e", "run_id": "r005", "schema_version": 1, "sequence": 38, "sha256": "cde0cbd855bf963d66c656676cb1f817bfacdae74bdab5a5551953fb54166fdf", "time_utc": "2026-08-01T18:21:34.020203Z"} +{"details": {"cell_id": "654926f712c7339fd514e3a050230605"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "13056a2f837cb143e3c4dc837ec7b0be39a8efb0eb87371497c138a73ab28e84", "run_id": "r008", "schema_version": 1, "sequence": 39, "sha256": "12d2698221e083833ff8444510096aa7759819fa016d9c2dd2cc07f682eb59b6", "time_utc": "2026-08-01T18:21:44.333241Z"} +{"agent_id": "/root/v4_report_r008", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "639894500631b43fe8049256704b0b0adca97f436032309872af03eb7df30031", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "5d104b158c68ce1ec1ffa96a6439d59ab42f3a682296706a0bb439b4e44b3727", "run_id": "r008", "schema_version": 1, "sequence": 40, "time_utc": "2026-08-01T18:22:01.460508Z"} +{"agent_id": "/root/v4_report_r006", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "785874363149c063c19114c2e23b2245fcd67d4eaa1230f14bba10aa54e3b7d0", "run_id": "r006", "schema_version": 1, "sequence": 41, "sha256": "c0d0682f0345037dda425bef71de1ab60de460b5a805cb09a7437d62c50f3bdd", "time_utc": "2026-08-01T18:22:30.621298Z"} +{"agent_id": "/root/v4_report_r006", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "190e12e06941a5740dcd36211c37fdbc896543e208e54cc6f2eda2f051b8b1cc", "run_id": "r006", "schema_version": 1, "sequence": 42, "time_utc": "2026-08-01T18:22:30.623527Z"} +{"agent_id": "/root/v4_report_r006", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1329}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "781a2f82ad03319ceb2f378023539bd0d76cd1a577d6c048d4e16bcacdb895b6", "run_id": "r006", "schema_version": 1, "sequence": 43, "sha256": "54dd4275f961823031967d7aa3052b68653e4170c5eeb55fea4d8c45c05bc679", "time_utc": "2026-08-01T18:22:30.625231Z"} +{"details": {"cell_id": "00309182fcf24228c055589a25574da9"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "01d2d29365aeca4946f41a69133a08c58a7ae0dc44a6a39a4ecb24c0d6c72e48", "run_id": "r009", "schema_version": 1, "sequence": 44, "sha256": "cf1976e92e46778d684283fa7d179a9cb00f0c36837910b0c6263a717d29443a", "time_utc": "2026-08-01T18:22:36.538824Z"} +{"agent_id": "/root/v4_report_r009", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "7648d97398071787042b51fa7b6957831088a65c34d940f87da81b29914bd7ae", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "f287c587a3fba4274582315e3421a7d30f34ddc51bbdddd4522b057ef827262a", "run_id": "r009", "schema_version": 1, "sequence": 45, "time_utc": "2026-08-01T18:22:56.092246Z"} +{"agent_id": "/root/v4_report_r007", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "32a46f56b0909420a1406ce2e9f915c6c31e2ad7493a941966e5fd39642ff59b", "run_id": "r007", "schema_version": 1, "sequence": 46, "sha256": "c4e97953ace1983764e44fae5b78207454f83eb4b31f3b40d7d664ed388e1241", "time_utc": "2026-08-01T18:23:52.650606Z"} +{"agent_id": "/root/v4_report_r007", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "ee3886888a9fc1a8c3819542eea4cde3545eb4bf2edfdcfd00673a120b93492a", "run_id": "r007", "schema_version": 1, "sequence": 47, "time_utc": "2026-08-01T18:23:52.652186Z"} +{"agent_id": "/root/v4_report_r007", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 926}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "f578370c320fac84c4cf6b8a4dc9943c21d97619b4d534f64ee2ba1b4c62012a", "run_id": "r007", "schema_version": 1, "sequence": 48, "sha256": "593b40969c0e46fab20eaa7be52d261dbc21dc0091a4e0c981acf53e6b8f21a9", "time_utc": "2026-08-01T18:23:52.653655Z"} +{"details": {"cell_id": "3cc6e34fbb3b922e62ec776b34149895"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "3c5303b3caa13b0df5b65200d4449e071c1b888413b374c4c27f28bc3a5f40fa", "run_id": "r010", "schema_version": 1, "sequence": 49, "sha256": "5d6581653b6bec24db36b1886b1fc89d79a33ef91b93586cf0413423d71c241e", "time_utc": "2026-08-01T18:24:02.709241Z"} +{"agent_id": "/root/v4_report_r010", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "ea197c2f30f1115784b18faa552bcd63875fbd1cd1ee892af275dcf5a2f0dda8", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "2ed1f8bfdd47a3d1012b1a998e6768f61ab92b9c2b7092f55ac21b95b0f067df", "run_id": "r010", "schema_version": 1, "sequence": 50, "time_utc": "2026-08-01T18:24:22.681528Z"} +{"agent_id": "/root/v4_report_r008", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "595dcd790a528d8b1b9238b444eb55f014da7e6392a7250ced3c1e67bf8f6188", "run_id": "r008", "schema_version": 1, "sequence": 51, "time_utc": "2026-08-01T18:26:14.895775Z"} +{"agent_id": "/root/v4_report_r009", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "e967e19ab9b9371c444b5efbc4f928f466d76cc5e7f6f4e0d6752e5b1b157a2a", "run_id": "r009", "schema_version": 1, "sequence": 52, "time_utc": "2026-08-01T18:26:15.085060Z"} +{"agent_id": "/root/v4_report_r010", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "be15b160fd49449b8a1bb248a00da547a18fc9472a1c9364e3195c32b0198a9a", "run_id": "r010", "schema_version": 1, "sequence": 53, "time_utc": "2026-08-01T18:27:41.284124Z"} +{"agent_id": "/root/v4_report_r009", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "e7b605c1cafab40e936cba322901decc562fa55c9c88064bdbe6e297c51ecf07", "run_id": "r009", "schema_version": 1, "sequence": 54, "sha256": "c4fef93cdf4a5916e3c835a47ade165a42eafcab0c46a184be25b38e2835154f", "time_utc": "2026-08-01T18:30:08.491664Z"} +{"agent_id": "/root/v4_report_r009", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "68700f0f03978080f3a1750d26e2e0b584988001ea640af83881433cf29f3a1f", "run_id": "r009", "schema_version": 1, "sequence": 55, "time_utc": "2026-08-01T18:30:08.493250Z"} +{"agent_id": "/root/v4_report_r009", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1026}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "897cfdc6c6e8cb774a39f86dae44cc605469f002b35ccd102427b56111263abf", "run_id": "r009", "schema_version": 1, "sequence": 56, "sha256": "954a95a4d7d7b061201270d9c023a17c93fdff3f3368267f7599f873c3df4d2c", "time_utc": "2026-08-01T18:30:08.494779Z"} +{"agent_id": "/root/v4_report_r008", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "1c6cf1c656f5fda0cf9e3307aa539a67bab7d76a951cc8b2cbd5617939325ea5", "run_id": "r008", "schema_version": 1, "sequence": 57, "sha256": "021aa951ffdb4f763ca1885a58c5ad1c9f775d525b57bdeb62317a9e8fa90fdd", "time_utc": "2026-08-01T18:32:49.982616Z"} +{"agent_id": "/root/v4_report_r008", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "ba52d3f09997b24577aa7e1f0f94e42d52d4ecd92edcd525cd87d9fc458f47e6", "run_id": "r008", "schema_version": 1, "sequence": 58, "time_utc": "2026-08-01T18:32:49.984400Z"} +{"agent_id": "/root/v4_report_r008", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1664}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "b678857c816f6d98140ab2cea0b29b4ae631ee145aeaade503b5920720120a59", "run_id": "r008", "schema_version": 1, "sequence": 59, "sha256": "bea0082d313d7bc237a2b754a983410e62d437aecef9bec717b7014d0b618e41", "time_utc": "2026-08-01T18:32:49.985913Z"} +{"agent_id": "/root/v4_report_r010", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "ccd8607e3e779b1ab0e5448e4e1d9f9900f1232acd86b78ba5b0989aba1a037a", "run_id": "r010", "schema_version": 1, "sequence": 60, "sha256": "0e6200b3320934d5b0888b42c7127eecead58cf57a52c2d1d6a04673cd3f7735", "time_utc": "2026-08-01T18:36:36.159220Z"} +{"agent_id": "/root/v4_report_r010", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "75a259373ee0b2a32982bdac0517ca7043181556c6af275f89686e5793529f2a", "run_id": "r010", "schema_version": 1, "sequence": 61, "time_utc": "2026-08-01T18:36:36.160857Z"} +{"agent_id": "/root/v4_report_r010", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1559}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "4dfcef4bec79d7847ef27e2e9059acf376f7edb34b810c509d7a028f2b3a9a47", "run_id": "r010", "schema_version": 1, "sequence": 62, "sha256": "a556b26d30da7f48af3bdb4f1962a532142a7555215e6df0fb731896ecdcf164", "time_utc": "2026-08-01T18:36:36.162554Z"} +{"details": {"entries": 56, "wave": 2}, "event": "authority_verified", "phase": "collection", "previous_event_sha256": "d94530c2aa4d31e4c18a63ebe45a1e131e0a0ea1f39c6dbf47da069707b992b0", "schema_version": 1, "sequence": 63, "sha256": "48444682cfc13966ce2769add9d4fbde82426a7a6e8777c421be8b26d15ff293", "time_utc": "2026-08-01T18:36:48.617709Z"} +{"details": {"cell_id": "27d33f081e70a44ee95086c2a6dc15dd"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "be7bb072c3a608cdae7a9a1fef2452cb5f929a54b68deab9f2299dcc115b4b41", "run_id": "r011", "schema_version": 1, "sequence": 64, "sha256": "6f97e9e64d2a6f7059338c0c02f3f6090f56c09fb490d18e669ebc9b13ad33b9", "time_utc": "2026-08-01T18:37:01.223786Z"} +{"agent_id": "/root/v4_report_r011", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "8be107070c95a63b8e4adda37b01277c57cba3d381c7887dc9fe05fcb40296ad", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "75e5890de6c796457b55dde97a52211f3b033c25385c04b52bc1752390cc5d8c", "run_id": "r011", "schema_version": 1, "sequence": 65, "time_utc": "2026-08-01T18:38:17.406039Z"} +{"details": {"cell_id": "881873f9704c96644f9a5e98c9be08c9"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "2d58897607c599d129ef7b6976cab3a1029a73008514c92f241bbb5bba54f552", "run_id": "r012", "schema_version": 1, "sequence": 66, "sha256": "4c98fb436fcb14c799d7c7eb70cbb59e7e1ccc1137a48de6ef72bd8450896703", "time_utc": "2026-08-01T18:38:56.568853Z"} +{"agent_id": "/root/v4_report_r012", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "187efd97935fe86dab4d29e9ed573a277c0bacefbb03ea3107e2d87e0938b8e0", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "8d8d51f2176f8d96fc3136b2d8b48838847404ac963a7b9c28880d02b2c35ee4", "run_id": "r012", "schema_version": 1, "sequence": 67, "time_utc": "2026-08-01T18:39:20.445036Z"} +{"details": {"cell_id": "dbb51c756615b6ce927b248f3cda7eba"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "fb5c9b7a444a2a96b41cd0e3bbea0d066c296d5a8913650b8f82281d7a0b9020", "run_id": "r013", "schema_version": 1, "sequence": 68, "sha256": "040d31383a3df9612ba425e9d705afc5c696c062e73588c24dffb4571f9a1170", "time_utc": "2026-08-01T18:39:27.285653Z"} +{"agent_id": "/root/v4_report_r013", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "13fbf6d923b6f6eaa425c295ba2b92a153daddc6821854843ca35ccf85f4832a", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "b28b766386b710f8613f31a4c39dbe6d05080d4a7afe6ae81b5e1716e9436013", "run_id": "r013", "schema_version": 1, "sequence": 69, "time_utc": "2026-08-01T18:39:51.992921Z"} +{"agent_id": "/root/v4_report_r011", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "a7e5af78272ead3b2215aeb6013e9f76fdb8a9a316a62624ad9e28f55ce6d3ce", "run_id": "r011", "schema_version": 1, "sequence": 70, "time_utc": "2026-08-01T18:41:30.184855Z"} +{"agent_id": "/root/v4_report_r012", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "04ad187df3ff61a158199bafce6e0715b6bc594c6a9e477000426e967f2b7d5d", "run_id": "r012", "schema_version": 1, "sequence": 71, "time_utc": "2026-08-01T18:42:39.060680Z"} +{"agent_id": "/root/v4_report_r013", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "46f11b0401bc0d930c85af5214ad29bf2b19c4d1f93a7a45838772f712445bf8", "run_id": "r013", "schema_version": 1, "sequence": 72, "time_utc": "2026-08-01T18:43:05.849832Z"} +{"agent_id": "/root/v4_report_r011", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "ec7bbcd2b5210f3d0507b0eed1e01e67bf2e69f6440a571fc5da1026e149d9a5", "run_id": "r011", "schema_version": 1, "sequence": 73, "sha256": "c50ee47076e679934a07e126165a598f265b619fe8538d373310c43c8a9d32c5", "time_utc": "2026-08-01T18:45:17.154934Z"} +{"agent_id": "/root/v4_report_r011", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "0a182c3d6ba346ab8592898239aa7df4feb6651115fb77004f155c6ae9aaf12f", "run_id": "r011", "schema_version": 1, "sequence": 74, "time_utc": "2026-08-01T18:45:17.156852Z"} +{"agent_id": "/root/v4_report_r011", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 994}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "c6cfbcd4b1d1866477bf57e929263e4c824027dc88443ec547f96f416d9a6299", "run_id": "r011", "schema_version": 1, "sequence": 75, "sha256": "67ff2058c11c9555d9ad9f940d58a5bcf773dcdcff0120d3cab8e22f71f9ab7e", "time_utc": "2026-08-01T18:45:17.158840Z"} +{"details": {"cell_id": "667b67c97b1286fbe985ac6b78ca082b"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "c10d8152bd21ef62bc4b9b3da398f83bfbd218634bc4cfe55bdd97be783e3ef6", "run_id": "r014", "schema_version": 1, "sequence": 76, "sha256": "957730796622949e20146738ab01c684b09e603d92d62457e1cd90eab6df5f0f", "time_utc": "2026-08-01T18:45:22.710334Z"} +{"agent_id": "/root/v4_report_r014", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "6e132413cdfa5206f3ac72b7f48c1a67f179750d418ba6f6a95ac8a0cd940265", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "66a868758d4d6b321c28de474958c907b3d995a32e742c95a20f0af0dc55d5ba", "run_id": "r014", "schema_version": 1, "sequence": 77, "time_utc": "2026-08-01T18:45:42.224870Z"} +{"agent_id": "/root/v4_report_r012", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "463b9de810308ed1c118827f0f07b2ce39edb80e99dc0b84d15388606aec0ed3", "run_id": "r012", "schema_version": 1, "sequence": 78, "sha256": "a85f1a2af6005854756504c2b473f72b90f69c71a04f88b1370c994fb3167682", "time_utc": "2026-08-01T18:47:23.922885Z"} +{"agent_id": "/root/v4_report_r012", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "61db53deef823c9509c7e2dd2bb283fb9f24e469849118af6ab467d40b5d2c85", "run_id": "r012", "schema_version": 1, "sequence": 79, "time_utc": "2026-08-01T18:47:23.924559Z"} +{"agent_id": "/root/v4_report_r012", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1181}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "68aa4e5d71ce50dabe0908eb9065df03400ac76cc9956ff8f1b7e9942cac39cb", "run_id": "r012", "schema_version": 1, "sequence": 80, "sha256": "ee9aa27852c22aafafd26a8a54bd0e997998f61f25186209cb1518e5bcfcea3d", "time_utc": "2026-08-01T18:47:23.926114Z"} +{"details": {"cell_id": "79030a8563b6b7142a77dac96b7f89dd"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "66d28a63c352e91e69676e0c43cfe885c6fb51971ddd9a812ae45941f2bf9e37", "run_id": "r015", "schema_version": 1, "sequence": 81, "sha256": "0d4a1c714dc9f79db7bf40134665000ba65cf9c14614a3e3e96881882f74b157", "time_utc": "2026-08-01T18:47:28.429306Z"} +{"agent_id": "/root/v4_report_r015", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "ce650aec5eedcc875fee8c93f1ccefa131a11ceb8b3b02f9fe832c9d0fecb033", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "970bc890f5df30c0cba94ca486ece44d0d23958514885822a56bed26b209ef4e", "run_id": "r015", "schema_version": 1, "sequence": 82, "time_utc": "2026-08-01T18:47:48.895249Z"} +{"agent_id": "/root/v4_report_r014", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "3ab8cf4dfe69c394db328e6145299fee3f245570d9016af0881414b94be3b755", "run_id": "r014", "schema_version": 1, "sequence": 83, "time_utc": "2026-08-01T18:49:02.240093Z"} +{"agent_id": "/root/v4_report_r013", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "e905aac1ac829398e1dd320c612a9364d0d1b2dc6f0b52718051ce038bb03804", "run_id": "r013", "schema_version": 1, "sequence": 84, "sha256": "efc196395c5144d72a2ad9ad166207bb20a2357ae2113fedcc527009aecf668e", "time_utc": "2026-08-01T18:50:05.312425Z"} +{"agent_id": "/root/v4_report_r013", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "7fc5ccaced4757ca349ab7278240a0f038e4115227a7a2ef433f444bc92a81a2", "run_id": "r013", "schema_version": 1, "sequence": 85, "time_utc": "2026-08-01T18:50:05.314232Z"} +{"agent_id": "/root/v4_report_r013", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 907}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "d742c95f340f9f05b17df52fd962f1b4e73f9aab339097cea7ad140a8fa43153", "run_id": "r013", "schema_version": 1, "sequence": 86, "sha256": "56557faf2342dc507d6f1e13ad3c9976b04c74f555ba8071dfb4797b453cd4e8", "time_utc": "2026-08-01T18:50:05.315760Z"} +{"details": {"cell_id": "322027b63f67b0a661d078e000b358bc"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "dc3557282a28621b53f94e469a8017ce6ddd82ae39e04767a41c43fd3d194229", "run_id": "r016", "schema_version": 1, "sequence": 87, "sha256": "f4108280641cd9cb1babe9d525be5c4a64a23ec2b7b4e850f5b6cd9ccda80cb9", "time_utc": "2026-08-01T18:50:10.393534Z"} +{"agent_id": "/root/v4_report_r016", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "b815485d5e5bd2248bb208db25794c6af8a3cfd0a4130b9f0377de68ae9191e5", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "62f7f8533d7dbfac7e751baf6d3407ce017f94276cb5b0b3c099143a046defee", "run_id": "r016", "schema_version": 1, "sequence": 88, "time_utc": "2026-08-01T18:50:30.410433Z"} +{"agent_id": "/root/v4_report_r015", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "4e8d2dcc6cbfde1acf0b95ecd6052aab7fe47b324b95e66843ff6a8b0bde68ae", "run_id": "r015", "schema_version": 1, "sequence": 89, "time_utc": "2026-08-01T18:51:10.783202Z"} +{"agent_id": "/root/v4_report_r016", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "768e81dfe0f0b58eb8673aae2c729d5f286c21a3278ab8bd35bbfaab969459fd", "run_id": "r016", "schema_version": 1, "sequence": 90, "time_utc": "2026-08-01T18:53:40.250806Z"} +{"agent_id": "/root/v4_report_r014", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "c1849bbb9c591b07ffd3c4d0cae44a55b204d69cbedcb5484bae8bc810b98c33", "run_id": "r014", "schema_version": 1, "sequence": 91, "sha256": "d0b285ee63c2f2f2f010b0868d39ff79bef2f73d2ca262c7b5c4d209dbc658e2", "time_utc": "2026-08-01T18:57:13.288629Z"} +{"agent_id": "/root/v4_report_r014", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "bdb9dfa863b5f894c0e7067dbe6fbec20ce98c6f3b2257abdc6703ee834fe8f5", "run_id": "r014", "schema_version": 1, "sequence": 92, "time_utc": "2026-08-01T18:57:13.290372Z"} +{"agent_id": "/root/v4_report_r014", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1582}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "6c3edce826c1beacec997cd0d6ac6d354567ef6fde693c1b371e377d0e376886", "run_id": "r014", "schema_version": 1, "sequence": 93, "sha256": "dfcd89377ba31227e0ed7bb9ae4926eca117678182f14ef3f26fe5e929b2b57d", "time_utc": "2026-08-01T18:57:13.291963Z"} +{"details": {"cell_id": "07797bcb7916819e328af1166c366498"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "382761d2907dadfebe1ef4fa879cab2c34d731408d91546fe66a2106261848ef", "run_id": "r017", "schema_version": 1, "sequence": 94, "sha256": "df0d59d9076606078267522696a466230489f8ab98b5a236700033accab9c1f6", "time_utc": "2026-08-01T18:57:20.365185Z"} +{"agent_id": "/root/v4_report_r017", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "374e4fb1e46e6d789fddeb1556d2431dd8206ff902d34f96f0b49c7109e100d0", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "ea44c1ab52a434a90fad372cec65a8f21a52fac05b5416ed379969e7e9e6a6ac", "run_id": "r017", "schema_version": 1, "sequence": 95, "time_utc": "2026-08-01T18:57:41.858015Z"} +{"agent_id": "/root/v4_report_r016", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "2871685add762d7b8ee036df6c0049d0107e22cf64c834b5d065789aca3ad048", "run_id": "r016", "schema_version": 1, "sequence": 96, "sha256": "24332160d61d961db03ab12da2209c68054dcc4d132b2c0d6842701cd158209b", "time_utc": "2026-08-01T18:58:46.527450Z"} +{"agent_id": "/root/v4_report_r016", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "85e9b2f558ada73631872b083733ecc5afd7ffbc66d8848e2ac1fddfb9758d0e", "run_id": "r016", "schema_version": 1, "sequence": 97, "time_utc": "2026-08-01T18:58:46.529229Z"} +{"agent_id": "/root/v4_report_r016", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1019}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "bd2256ec857fefdf65c684179cf6e69ce29e278f3b5d3c078efea481a70df15f", "run_id": "r016", "schema_version": 1, "sequence": 98, "sha256": "74fe59f2a0341cf8fe291f8812d131a22949f51b001324e41aacdefb7cbe67f1", "time_utc": "2026-08-01T18:58:46.531119Z"} +{"details": {"cell_id": "d50eb2488ebbe5c8afa54055bc3a4b96"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "192dc2d5d1cbbe81f0b97e43f5dbfda1f5965a2bdd9033c4f3eb31099ac11447", "run_id": "r018", "schema_version": 1, "sequence": 99, "sha256": "ce088a29e2ca94a229d9bb24eadd4c3dbe24c429ac9d460d3b725ca03fde50a1", "time_utc": "2026-08-01T18:58:51.910515Z"} +{"agent_id": "/root/v4_report_r018", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "26521895d25c33ec900bb0e4903a88a9c91aeec2063cf0b91eacfeb3d2201e6e", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "3b83a6e645e156b1551199166773f6630bd3a0d6360085ff3c358882e3c5e957", "run_id": "r018", "schema_version": 1, "sequence": 100, "time_utc": "2026-08-01T18:59:15.225288Z"} +{"agent_id": "/root/v4_report_r017", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "44a83596a31b0f54762f91eb1c0ad0dfe4f66bc230ffdf49c0dfe96b25481273", "run_id": "r017", "schema_version": 1, "sequence": 101, "time_utc": "2026-08-01T19:00:51.719885Z"} +{"agent_id": "/root/v4_report_r018", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "2f388f57f0dd385d098ca7741233cb5c67897152f7a8fe89cfdba7382dda4520", "run_id": "r018", "schema_version": 1, "sequence": 102, "time_utc": "2026-08-01T19:02:25.146293Z"} +{"agent_id": "/root/v4_report_r015", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "b292b4a939852e106b660f5ba5aee1ff94381c846bf190f2ae83342c01ef57b4", "run_id": "r015", "schema_version": 1, "sequence": 103, "sha256": "431d7ea73ec62e2ff5d01c151e31943f8a156146fa1ca708a127655609efae74", "time_utc": "2026-08-01T19:03:12.384572Z"} +{"agent_id": "/root/v4_report_r015", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "971615c70de95c5ee23dd3a3247f7fde5e5f3440ff22cb2fcb94b6dfae308da3", "run_id": "r015", "schema_version": 1, "sequence": 104, "time_utc": "2026-08-01T19:03:12.386235Z"} +{"agent_id": "/root/v4_report_r015", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1163}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "39d5a8bff9cdaaf84bacc1892426b231b6c7ce2e8cc8239e625b2dea976ce17e", "run_id": "r015", "schema_version": 1, "sequence": 105, "sha256": "873d7f2d86630153a25fb9714624659e543f4198ad55b7db8ca0ebdcb8ebe503", "time_utc": "2026-08-01T19:03:12.387864Z"} +{"details": {"cell_id": "761e0a4c3119de7b644c12a48b4542eb"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "7efc1ed6a0251e08b645a9876874360c89417fb3ad2c3805e77762467a16e0d0", "run_id": "r019", "schema_version": 1, "sequence": 106, "sha256": "f573a07d3d19c40fed4c4acf5db8dd40a11b9d189f7897f6754f164ab6976a92", "time_utc": "2026-08-01T19:03:17.306136Z"} +{"agent_id": "/root/v4_report_r019", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "41527b65fac4db8fe734c88ecf109d4ad64f8a34f71902f156c18b23c6ec2376", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "7dffe2544753dbc957f3f06902fee9831129dfd5049d859468f93b0fd693b230", "run_id": "r019", "schema_version": 1, "sequence": 107, "time_utc": "2026-08-01T19:03:45.198153Z"} +{"agent_id": "/root/v4_report_r017", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "925bbf49d7f31ad130d42204a93f88a3978403f9f23ddd954696f9dff38c7816", "run_id": "r017", "schema_version": 1, "sequence": 108, "sha256": "4edd539ee784954f58e733c5981981149a41e8098bace0ff3957e7bb7317c318", "time_utc": "2026-08-01T19:05:46.208480Z"} +{"agent_id": "/root/v4_report_r017", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "14ee1842f19c47ec4314ce138ca050d84dce43645cbef1990ff910fec9b79b21", "run_id": "r017", "schema_version": 1, "sequence": 109, "time_utc": "2026-08-01T19:05:46.210039Z"} +{"agent_id": "/root/v4_report_r017", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1010}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "6ca5f97207345bafb6dd611a2f17495976ced1ac242f5f601cbc89faeebef036", "run_id": "r017", "schema_version": 1, "sequence": 110, "sha256": "1eb7ccc5e3184fe8e43a576150a25f498bf6f1e514486fde15ece31fd660e3e6", "time_utc": "2026-08-01T19:05:46.211651Z"} +{"details": {"cell_id": "3213ed90744c066130b7a79a814b47e7"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "8a36808820eb64e5bb678710247d8ec2035ec9b3b2bbb05519a3b2c3b6bc0606", "run_id": "r020", "schema_version": 1, "sequence": 111, "sha256": "3336c33608da0b5a120828eafd4ed1eab063a752aaea342eaa2c9e17fbddf029", "time_utc": "2026-08-01T19:05:54.901450Z"} +{"agent_id": "/root/v4_report_r020", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "e06ec51729df221b13eb4ff2902fb1e59e39a186f9b758691f40bba2a979937a", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "a3a1f10429b78c2292bb5fe7999005309524b1cc3c02907be6eb36bde1bc85c2", "run_id": "r020", "schema_version": 1, "sequence": 112, "time_utc": "2026-08-01T19:06:22.876698Z"} +{"agent_id": "/root/v4_report_r019", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "b3721c9bf6490bcb919cc132a30f5a31aeda91e4d17b4137c867af2d2600b15e", "run_id": "r019", "schema_version": 1, "sequence": 113, "time_utc": "2026-08-01T19:07:35.968601Z"} +{"agent_id": "/root/v4_report_r018", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "7ffc4e182b9d18bfb3b59245dd242be5a8193ccf31e77f78af7b4722b09abaa1", "run_id": "r018", "schema_version": 1, "sequence": 114, "sha256": "2f3d01d72490ed171918cd1a51761b543df4765447a39aec112fb138ea9b97c6", "time_utc": "2026-08-01T19:08:51.424416Z"} +{"agent_id": "/root/v4_report_r018", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "59dae35d28e694734d36f84dd80e7840050f4fb7bf470531c6e0e8b6cd8af2fb", "run_id": "r018", "schema_version": 1, "sequence": 115, "time_utc": "2026-08-01T19:08:51.426104Z"} +{"agent_id": "/root/v4_report_r018", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1443}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "4d6912c7a28f4a65b73de335b5e19abf2bed7504370072f06d5a56e0abd5038a", "run_id": "r018", "schema_version": 1, "sequence": 116, "sha256": "5b414f1c8097099ebfe625ec880d4aa0da01a46617e5712419912ed230ccffbe", "time_utc": "2026-08-01T19:08:51.427833Z"} +{"agent_id": "/root/v4_report_r020", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "e39baf51f71334f378d06902527ff05c3131a0db836ca045c270e64c7c5cb60d", "run_id": "r020", "schema_version": 1, "sequence": 117, "time_utc": "2026-08-01T19:09:35.975348Z"} +{"agent_id": "/root/v4_report_r019", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "81f0caf9f9a8e1c1d68ab7bb8a8648434d8c8eccbe13c133d67112f4dc93cfc5", "run_id": "r019", "schema_version": 1, "sequence": 118, "sha256": "1671ba95c8804542d99ac9be7cea5eb7eed7d20b576596ea76ead1894faf6d08", "time_utc": "2026-08-01T19:11:50.851275Z"} +{"agent_id": "/root/v4_report_r019", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "de874262dd1538f1b556c036e79c455910f2edcae762ee8307bd9d7518c6cd64", "run_id": "r019", "schema_version": 1, "sequence": 119, "time_utc": "2026-08-01T19:11:50.852799Z"} +{"agent_id": "/root/v4_report_r019", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 886}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "5c95b9c6275620cf67a4b0eafdcff68b481ec50fc47322159ecd180cfb7f3c5e", "run_id": "r019", "schema_version": 1, "sequence": 120, "sha256": "ce572d45451eaf768a3731e7a09f92a21d813c1b3fe1940260b4eb70a58b933d", "time_utc": "2026-08-01T19:11:50.854239Z"} +{"agent_id": "/root/v4_report_r020", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "73c94302ed91d7cd8aa4876f89793b06333199054018fe4608ccfd229bbfed75", "run_id": "r020", "schema_version": 1, "sequence": 121, "sha256": "1594243254648e593ff0579fce9d1e71ac14719b7e757c6184389ea2d8b60dcd", "time_utc": "2026-08-01T19:14:04.084215Z"} +{"agent_id": "/root/v4_report_r020", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "d4c65e0a9badbb256bdf6f616b72c379dd4c99d5948da727d3ed99f5dbaab390", "run_id": "r020", "schema_version": 1, "sequence": 122, "time_utc": "2026-08-01T19:14:04.085753Z"} +{"agent_id": "/root/v4_report_r020", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1154}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "d140a6d0671b488a97e50345b89b3894e5618b8e405584945234a7d65c0f15c7", "run_id": "r020", "schema_version": 1, "sequence": 123, "sha256": "c0e89f396556b32ab2d6611a875e30ae9243ba61206f445205b4a9c889b21a24", "time_utc": "2026-08-01T19:14:04.087351Z"} +{"details": {"entries": 56, "wave": 3}, "event": "authority_verified", "phase": "collection", "previous_event_sha256": "29345290eceae7bba7d66932f80f497e3a52002d17c6c07d805897d531560aea", "schema_version": 1, "sequence": 124, "sha256": "48444682cfc13966ce2769add9d4fbde82426a7a6e8777c421be8b26d15ff293", "time_utc": "2026-08-01T19:14:16.687454Z"} +{"details": {"cell_id": "e5951ec14062ede715c2883e71599aa0"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "67c60bdd6b117e66bd9958200766e03e9ddc124c31d28312d36373cabf15b80a", "run_id": "r021", "schema_version": 1, "sequence": 125, "sha256": "b2fd44e6ed0e9a6ace1aef9a64d11bb1690fcd97eee5aa1cdb9763ddb9d566c7", "time_utc": "2026-08-01T19:14:34.049250Z"} +{"agent_id": "/root/v4_report_r021", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "8f1cc0b954dd68786476e17f05b640db8b68a03ab3aaa28c44d462b4617c61ca", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "04e4ac0d667df0e4cc3deae40ac937a7823c799fdf0c6231881c0d4c06a7b687", "run_id": "r021", "schema_version": 1, "sequence": 126, "time_utc": "2026-08-01T19:14:55.306302Z"} +{"details": {"cell_id": "ddd3c84a6fc9910cdb651d97ede8177d"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "94474fb49d3852b9dc65b0343331e41ecadac89d2ae9470f603e3e7d2fc5841c", "run_id": "r022", "schema_version": 1, "sequence": 127, "sha256": "8e72c87465803a695cc8b057570fc46edc78569d5e2e404188b40bf821a0d800", "time_utc": "2026-08-01T19:15:03.651360Z"} +{"agent_id": "/root/v4_report_r022", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "c8c42e0b3d7ede96ea794defb6c931ea43152df6bcaef9e7800dc7561dfae5be", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "3e3271a62360e31e47eae2185680a0faaeff943116b9be1afc3b8ef7e80c2be6", "run_id": "r022", "schema_version": 1, "sequence": 128, "time_utc": "2026-08-01T19:15:23.575751Z"} +{"details": {"cell_id": "a044ec75f8f9b15e6434c5600ca3a5f1"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "4389e8725941d44db7c11cb9fe0b8716db90d519d59ca1be5f85403d6e172b7b", "run_id": "r023", "schema_version": 1, "sequence": 129, "sha256": "f65eb19c01c8f178f1297db6dae14afdb9aa41e6836f4585647602df9e0bd3ef", "time_utc": "2026-08-01T19:15:27.938091Z"} +{"agent_id": "/root/v4_report_r023", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "240c13e4e7eca8d77a891dd43e113dfa46ed211c8a493b93b28c0c4116eac4ad", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "1f10693c8d32a0f47e8343b1056284b8863e78355d073aaa28d6e1df474d12a0", "run_id": "r023", "schema_version": 1, "sequence": 130, "time_utc": "2026-08-01T19:15:48.680090Z"} +{"agent_id": "/root/v4_report_r021", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "62d1187f7d07e2d438377992e37ebb0addad1701cd696175af3dd41c6252d988", "run_id": "r021", "schema_version": 1, "sequence": 131, "time_utc": "2026-08-01T19:18:19.575220Z"} +{"agent_id": "/root/v4_report_r022", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "67ba63755480e12799e5fe5491b4265b99b5d77b03549021a216fee2118f4bbb", "run_id": "r022", "schema_version": 1, "sequence": 132, "time_utc": "2026-08-01T19:18:53.668480Z"} +{"agent_id": "/root/v4_report_r023", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "71186d39a9d445e5966a52f37a8d36f229fd7c201ffcd99f8e3b8566b7b52918", "run_id": "r023", "schema_version": 1, "sequence": 133, "time_utc": "2026-08-01T19:19:17.029285Z"} +{"agent_id": "/root/v4_report_r021", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "2c39c621ef9ab6b6624ea89729c3f8539234caf69692bf493353b98a6fc2b701", "run_id": "r021", "schema_version": 1, "sequence": 134, "sha256": "e1b21ecf8399ee2c81d439a9cd05f8afd1d87a5b84fdb26ab690b421a8307c54", "time_utc": "2026-08-01T19:27:27.817934Z"} +{"agent_id": "/root/v4_report_r021", "attempt": 1, "details": {"api_state": "INFRASTRUCTURE_FAILURE"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "46c0437f50fb7cda2b73c046aa9d524b304fd318ed47bb7691c961ead78b8b89", "run_id": "r021", "schema_version": 1, "sequence": 135, "time_utc": "2026-08-01T19:27:27.819587Z"} +{"agent_id": "/root/v4_report_r021", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE", "evidence": "Coordinator reported not_found after the started agent vanished; no report artifact existed."}, "event": "infrastructure_failure", "phase": "collection", "previous_event_sha256": "d3a92ca31292d1ef94bdab48206edcd2711db6ed9bb959da82144a6305e7589e", "run_id": "r021", "schema_version": 1, "sequence": 136, "time_utc": "2026-08-01T19:27:27.821229Z"} +{"agent_id": "/root/v4_report_r022", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "7485971266532bdda664ecefa14be18bdbf2c619ef38f023864f26a584351f27", "run_id": "r022", "schema_version": 1, "sequence": 137, "sha256": "d053552f1c4a146be5b24a382112f86d6bdb1c2a08fd36603a1a995a8b98ddeb", "time_utc": "2026-08-01T19:27:35.157467Z"} +{"agent_id": "/root/v4_report_r022", "attempt": 1, "details": {"api_state": "INFRASTRUCTURE_FAILURE"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "76e6083344ea784e0a14ec47bc9043b2f83cafe58142114fd5a17ccd9008c453", "run_id": "r022", "schema_version": 1, "sequence": 138, "time_utc": "2026-08-01T19:27:35.159130Z"} +{"agent_id": "/root/v4_report_r022", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE", "evidence": "Coordinator remained pending_init after an artifact write and never returned; interrupt confirmed previous_status pending_init."}, "event": "infrastructure_failure", "phase": "collection", "previous_event_sha256": "f2953989fb9d11e2d77541d1750b78bcc602b5afe264017608a4d8b65026095b", "run_id": "r022", "schema_version": 1, "sequence": 139, "time_utc": "2026-08-01T19:27:35.160717Z"} +{"agent_id": "/root/v4_report_r023", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "3fefa1e15192d2b5c28d7b7da137b5d5d694e244c31875f3e85b088b62643284", "run_id": "r023", "schema_version": 1, "sequence": 140, "sha256": "df99b0d9fbfa15cb3baceac7d2fb6dac61a63562af7f352ec5f864cbb73fcea6", "time_utc": "2026-08-01T19:27:40.079457Z"} +{"agent_id": "/root/v4_report_r023", "attempt": 1, "details": {"api_state": "INFRASTRUCTURE_FAILURE"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "b2accedabdf0c658f393215ac9ddf939e3851e1cbf3623bde5c61c3ba7c78d56", "run_id": "r023", "schema_version": 1, "sequence": 141, "time_utc": "2026-08-01T19:27:40.081198Z"} +{"agent_id": "/root/v4_report_r023", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE", "evidence": "Coordinator remained pending_init and never produced an artifact or return; interrupt confirmed previous_status pending_init."}, "event": "infrastructure_failure", "phase": "collection", "previous_event_sha256": "8282cb1ff44243e88bf27d3927dbec8465a94daca8d9fedc8b10be0d82ee1e6e", "run_id": "r023", "schema_version": 1, "sequence": 142, "time_utc": "2026-08-01T19:27:40.082759Z"} +{"agent_id": "/root/v4_report_r021_a2", "attempt": 2, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "8f1cc0b954dd68786476e17f05b640db8b68a03ab3aaa28c44d462b4617c61ca", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "5158b5acf3692cba36dd78d584bde3b385a3dfa509a2421ff8a280ad89682c1c", "run_id": "r021", "schema_version": 1, "sequence": 143, "time_utc": "2026-08-01T19:28:40.053263Z"} +{"details": {"disposition": "API_NO_AGENT_START", "evidence": "Attempt 2 spawn failed with agent thread limit reached and returned no agent identity.", "next_attempt": 2}, "event": "prelaunch_failure", "phase": "collection", "previous_event_sha256": "1fba6325c497813fd5127848198b590c572fb531d5893bf36fab3549f2b83168", "run_id": "r022", "schema_version": 1, "sequence": 144, "time_utc": "2026-08-01T19:29:10.156386Z"} +{"agent_id": "/root/v4_report_r021_a2", "attempt": 2, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "c56b025c60be82e45936508f72d1138eadd0d1b6944f37d02c5e684793a42ddd", "run_id": "r021", "schema_version": 1, "sequence": 145, "time_utc": "2026-08-01T19:32:10.875074Z"} +{"agent_id": "/root/v4_report_r021_a2", "attempt": 2, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "6dabd4adbee5900d66783ecb6587f1d01be5e1083ab4c0c5e86656e4a7178ba8", "run_id": "r021", "schema_version": 1, "sequence": 146, "sha256": "6b360a6ac7bef1c09f800c75390af78066935c3c56a929443749d608e1914a9f", "time_utc": "2026-08-01T19:36:14.885793Z"} +{"agent_id": "/root/v4_report_r021_a2", "attempt": 2, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "15a8b12733a552278292359f86f616d6b98c5f2fb275db2df8d1e62e82c28602", "run_id": "r021", "schema_version": 1, "sequence": 147, "time_utc": "2026-08-01T19:36:14.887550Z"} +{"agent_id": "/root/v4_report_r021_a2", "attempt": 2, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1011}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "050290c4df84a97bcbc67f459db1de4788588099f77d51525a47785008fc66e1", "run_id": "r021", "schema_version": 1, "sequence": 148, "sha256": "d74c89e74f1a4cc352183cea151c4ac387fea502d6c9a88e8ee7c1b63612fce8", "time_utc": "2026-08-01T19:36:14.889051Z"} +{"agent_id": "/root/v4_report_r022_a2", "attempt": 2, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "c8c42e0b3d7ede96ea794defb6c931ea43152df6bcaef9e7800dc7561dfae5be", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "eb36ab501781979883d8ff380605a46da91a0aafa5d30d9b8a97365e42b36e16", "run_id": "r022", "schema_version": 1, "sequence": 149, "time_utc": "2026-08-01T19:36:40.463804Z"} +{"agent_id": "/root/v4_report_r022_a2", "attempt": 2, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "bdd1168ee9fa0c891ff2d3aa248e44f25bb300fd28fd10fa05023693d65db8d7", "run_id": "r022", "schema_version": 1, "sequence": 150, "time_utc": "2026-08-01T19:39:56.715364Z"} +{"agent_id": "/root/v4_report_r022_a2", "attempt": 2, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "7196c0d2952cda477974e832db35afb20502447eedff7ebba1fbe506a7a002ae", "run_id": "r022", "schema_version": 1, "sequence": 151, "sha256": "67680a13d771875ec2c1e460f34916a8ee0b3726a5ed631a0f9c5120b56ba889", "time_utc": "2026-08-01T19:44:55.344742Z"} +{"agent_id": "/root/v4_report_r022_a2", "attempt": 2, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "c441c37263d19bade2080408b653f0745d7eb053ece9f2344b7bc9db7498c49a", "run_id": "r022", "schema_version": 1, "sequence": 152, "time_utc": "2026-08-01T19:44:55.346570Z"} +{"agent_id": "/root/v4_report_r022_a2", "attempt": 2, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1179}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "d1e41830da8c80d2e047a3d20665c7f2066630adb64b43e821d2402f55007b20", "run_id": "r022", "schema_version": 1, "sequence": 153, "sha256": "48b4903ce42d924f6c1f532d6685a79209756520980218163e5ca6aaebd1040e", "time_utc": "2026-08-01T19:44:55.348117Z"} +{"agent_id": "/root/v4_report_r023_a2", "attempt": 2, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "240c13e4e7eca8d77a891dd43e113dfa46ed211c8a493b93b28c0c4116eac4ad", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "99fccf2c5cb5e735607d9c08e49d87d24675559a34b72d5cbcfdc303aabc0052", "run_id": "r023", "schema_version": 1, "sequence": 154, "time_utc": "2026-08-01T19:45:13.525861Z"} +{"agent_id": "/root/v4_report_r023_a2", "attempt": 2, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "0f278d5be6956df7a5b2eceea8ff268ed38bf274e7f3f939fe6a3f1d9e0df3f5", "run_id": "r023", "schema_version": 1, "sequence": 155, "time_utc": "2026-08-01T19:48:31.191839Z"} +{"agent_id": "/root/v4_report_r023_a2", "attempt": 2, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "01a53f9638a1175ffa853d82502756d967ce3d1c43dfae0fbbf3c89c1b56c17d", "run_id": "r023", "schema_version": 1, "sequence": 156, "sha256": "857d4e93a6da28b5bd4d1ea5cae48bff270799325a65278b0856c045eaa7a1c5", "time_utc": "2026-08-01T19:53:02.484501Z"} +{"agent_id": "/root/v4_report_r023_a2", "attempt": 2, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "33cc1a8699a615f1d55d8a5a5207ef038f5e33b0f107d383e96cfc12b07c7082", "run_id": "r023", "schema_version": 1, "sequence": 157, "time_utc": "2026-08-01T19:53:02.486325Z"} +{"agent_id": "/root/v4_report_r023_a2", "attempt": 2, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1454}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "4470915bf55695188f080d29276dfa2e8b1ce8cd10e547dc0a5f088fa53a0134", "run_id": "r023", "schema_version": 1, "sequence": 158, "sha256": "a3a118b4fcf7d37b80907aa322d3fc9423419df81bed9dcff6d299415826068e", "time_utc": "2026-08-01T19:53:02.487924Z"} +{"details": {"cell_id": "2070b378e27be36df65e1351f1fdf31f"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "2f23fa13fab175da7e8cef5a9c420cd47fc1a2e1380fc3d332a5526f6424de5c", "run_id": "r024", "schema_version": 1, "sequence": 159, "sha256": "22f47d20ddefb953d9541e7d1bba80fb429fa05c2864c37ae738901c639590bc", "time_utc": "2026-08-01T19:53:08.736939Z"} +{"agent_id": "/root/v4_report_r024", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "1e30704ca166dbfc584ed7b92ab6337d6aca84f2ba7429357645d8ce3fd3e223", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "486fda43f4fbb7f0255463f2df41b5eca759feea831233136f05b3f5947918ec", "run_id": "r024", "schema_version": 1, "sequence": 160, "time_utc": "2026-08-01T19:53:28.574509Z"} +{"agent_id": "/root/v4_report_r024", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "94c90b8e97633b92a42cd62c18be4cdf9fb0b72b118dd4d3cf52c4a7a84e267d", "run_id": "r024", "schema_version": 1, "sequence": 161, "time_utc": "2026-08-01T19:56:39.766644Z"} +{"agent_id": "/root/v4_report_r024", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "18c04f25cc44426f672f8f1844e0cf4085bb26a363dbc4f7c9d0e75a721f7700", "run_id": "r024", "schema_version": 1, "sequence": 162, "sha256": "a7b7f6e764cf22c50bb2ca997bc06c7c7630b162699a3079a3dd2ecbeff9fe94", "time_utc": "2026-08-01T20:00:55.523740Z"} +{"agent_id": "/root/v4_report_r024", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "566c4292583681add9500ea5f6eb34969fa8b75cbeffcfd95019c0f072d609da", "run_id": "r024", "schema_version": 1, "sequence": 163, "time_utc": "2026-08-01T20:00:55.525379Z"} +{"agent_id": "/root/v4_report_r024", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1258}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "6971b638c2c78a2e0fef9acda8dcf38008ffef1cb65c5c0ff1132e2e27068caa", "run_id": "r024", "schema_version": 1, "sequence": 164, "sha256": "61ae6ed7e4ce464b07d0ae2a4b8c6941d5089e33de766fa78600e570ab998621", "time_utc": "2026-08-01T20:00:55.527069Z"} +{"details": {"cell_id": "97958bb3a7f0c6d82aef856c1576f091"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "e9432bec3638ca9ceca80b7fbc81c63c3bf9505c61d6fc2bebb37b212afe377c", "run_id": "r025", "schema_version": 1, "sequence": 165, "sha256": "84b7f37d9446e2c113f8633274247dff842d261022b270c047404d56acb515a7", "time_utc": "2026-08-01T20:01:01.241232Z"} +{"agent_id": "/root/v4_report_r025", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "21a72f0f53b1cdfca6b34b2093810b102b9aab78367cad8288f3af29e39b56ea", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "f0cfdecb1be694679ddf847c0af94e6b97ac19043660530b97dfa2a0146c53f5", "run_id": "r025", "schema_version": 1, "sequence": 166, "time_utc": "2026-08-01T20:01:23.713968Z"} +{"agent_id": "/root/v4_report_r025", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "ed3498433f623244f5515a58668083da305f5c23a94991ed79d7dcf9d922d447", "run_id": "r025", "schema_version": 1, "sequence": 167, "time_utc": "2026-08-01T20:04:31.955366Z"} +{"agent_id": "/root/v4_report_r025", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "3612007ecdd95c301c999668ed2753cba09a4b81b94df338fea2e0d0f405abdd", "run_id": "r025", "schema_version": 1, "sequence": 168, "sha256": "2f07409622ddaa7ee61d4d4f9b81b7a02ee63cd5c98472fd6b2950d7d0f175dd", "time_utc": "2026-08-01T20:10:26.764106Z"} +{"agent_id": "/root/v4_report_r025", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "676353dab6b25ea11cf6842d6ffbeaf509a9bacd088c8a07210f3b44b0bec18e", "run_id": "r025", "schema_version": 1, "sequence": 169, "time_utc": "2026-08-01T20:10:26.765942Z"} +{"agent_id": "/root/v4_report_r025", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1002}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "5306b0d1b1dc5ba978dfc682103a59cd759d2d03997d706157b682960a708299", "run_id": "r025", "schema_version": 1, "sequence": 170, "sha256": "92773944d416bd3170da772c79531168275c351ce858b54ffed8558f55a83d68", "time_utc": "2026-08-01T20:10:26.767613Z"} +{"details": {"cell_id": "5dba5b54fccd1c75cc909610fb3e9d70"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "d25caf77d767265dd2f77c304cddb3da6eace67fa26fbe608a20659b7a811cd5", "run_id": "r026", "schema_version": 1, "sequence": 171, "sha256": "2a97db7cfbc3ecac5dc167f146601e25ecdbf113c5e779bb2e37169eed222f38", "time_utc": "2026-08-01T20:10:31.947979Z"} +{"agent_id": "/root/v4_report_r026", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "0db3a221b9158a73b0524d8cbed1c190e2761fd1611f9477838300d584b1d5dc", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "e785828893f8b645e7297305c0288fd2e8d142a292b17f5f2d03bfc9d4621b20", "run_id": "r026", "schema_version": 1, "sequence": 172, "time_utc": "2026-08-01T20:10:56.486458Z"} +{"agent_id": "/root/v4_report_r026", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "cac27e13ca44a00c27dd6d2592253f2d30eed18991c2076492be2be94cdd7fe0", "run_id": "r026", "schema_version": 1, "sequence": 173, "time_utc": "2026-08-01T20:14:06.139759Z"} +{"agent_id": "/root/v4_report_r026", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "eb3fd267142bf46657b9cc8c795f5417849674bf752451b7a2cfb4b59e88889c", "run_id": "r026", "schema_version": 1, "sequence": 174, "sha256": "c9bfd5678daf0fd0033154e268b8e29a11cedfd4341dc1b328eb62ed505f4476", "time_utc": "2026-08-01T20:18:24.525351Z"} +{"agent_id": "/root/v4_report_r026", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "610b7ab37c95ff6ae4384381dd6505138184a7c430191d48a9e9ef9086e5e97e", "run_id": "r026", "schema_version": 1, "sequence": 175, "time_utc": "2026-08-01T20:18:24.526988Z"} +{"agent_id": "/root/v4_report_r026", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1085}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "d9c03908efa86c7fd24ca0393de66ce9b45145b6fef59d2b2af3bb4034a41958", "run_id": "r026", "schema_version": 1, "sequence": 176, "sha256": "e292fe32c8a29791f68ce58f1baffa9194c462d69358d73f2ff381e150caa947", "time_utc": "2026-08-01T20:18:24.528665Z"} +{"details": {"cell_id": "63586bb3ea790c41f7dfeee3988bcc18"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "c0799bf5f5420328b09001c6453d7467e4f8f72d9535a58c7252c8bc6d996a19", "run_id": "r027", "schema_version": 1, "sequence": 177, "sha256": "1674dca1ccab570a803f47fb5ab12bbe81d5ddd6cc786dcde5a1f7d43568abcf", "time_utc": "2026-08-01T20:18:29.303060Z"} +{"agent_id": "/root/v4_report_r027", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "44932f20400f123c725e33b2c806ae250053427bafb0d90d856b481599f74319", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "9cd0d5e6b08d9f4f20950d35c30dbaae2972dc68f05b30c1e3429573ab6ad1a1", "run_id": "r027", "schema_version": 1, "sequence": 178, "time_utc": "2026-08-01T20:18:50.730176Z"} +{"agent_id": "/root/v4_report_r027", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "43b1cc72e2cdd85463662115a9dcbfd4d30680b6e4d7ec6525b1753f3f27cdf7", "run_id": "r027", "schema_version": 1, "sequence": 179, "time_utc": "2026-08-01T20:21:58.361000Z"} +{"agent_id": "/root/v4_report_r027", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "20ecffe0eba7480c4ac1b6901abd22f26ebc504ae948557437e92861b4b06447", "run_id": "r027", "schema_version": 1, "sequence": 180, "sha256": "1ffc006c14854bceb6142fc7458b851d7434c04f62115cf056761eacdefacec8", "time_utc": "2026-08-01T20:35:15.000669Z"} +{"agent_id": "/root/v4_report_r027", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "5b5e4d32b73f97d0e2495887cc196f1ae09433f830bbbe37ee0765799bc67f39", "run_id": "r027", "schema_version": 1, "sequence": 181, "time_utc": "2026-08-01T20:35:15.003273Z"} +{"agent_id": "/root/v4_report_r027", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1975}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "d6cee1aeff6b41a11362c4646e4044d7efcc4ae319e14deaa2567dad827bd241", "run_id": "r027", "schema_version": 1, "sequence": 182, "sha256": "e3283ae8b81a126762ee59cdd8108681311618dc8b848256daa4c49cfd1ae78c", "time_utc": "2026-08-01T20:35:15.005697Z"} +{"details": {"cell_id": "0d388afb946fbe9677b2dd710e1bcd89"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "95355ed551c7aa8698ae52f103cf162d128303bcf19342a420acbf61bb7bbe51", "run_id": "r028", "schema_version": 1, "sequence": 183, "sha256": "5f2b98243169402dfc0092376ef02decac13e739636c04074f6a4030a1918fd4", "time_utc": "2026-08-01T20:35:19.709865Z"} +{"agent_id": "/root/v4_report_r028", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "b7394c021735843faad59688af7f1b17c1e70b0516222d89ae654183437e71b0", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "6519cce047ac8ca7f466ec75d96c8b7c0ace59579edd8b5ae8fabee39e2bb93d", "run_id": "r028", "schema_version": 1, "sequence": 184, "time_utc": "2026-08-01T20:35:40.891626Z"} +{"agent_id": "/root/v4_report_r028", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "faf5b72d6c4c66d7dfedcb2669589266980dc9afe75cf9b7fef9b9049fb796de", "run_id": "r028", "schema_version": 1, "sequence": 185, "time_utc": "2026-08-01T20:38:51.591743Z"} +{"agent_id": "/root/v4_report_r028", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "be191f66afd6dea6323bbd6dbcbfc6bc2dbde415a8a8fb50ec4d0c8c3b953935", "run_id": "r028", "schema_version": 1, "sequence": 186, "sha256": "f18712e2d201c032592a7c5d794803e715b559845a8f98cf3147c3fee6ef2564", "time_utc": "2026-08-01T20:43:36.680993Z"} +{"agent_id": "/root/v4_report_r028", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "7d4d3873850d185162818b6c461deee5c54561ae4cc76f802b3bc0f816ab9442", "run_id": "r028", "schema_version": 1, "sequence": 187, "time_utc": "2026-08-01T20:43:36.682755Z"} +{"agent_id": "/root/v4_report_r028", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1081}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "26d89f66a0a872c361222992c27e21be9bbf763ce43fa014d31da9f593ad3203", "run_id": "r028", "schema_version": 1, "sequence": 188, "sha256": "cd6f9c0f3aeec081ba035b4f2f88168c5b3fb6143535dc1ebee925f270f4d9b5", "time_utc": "2026-08-01T20:43:36.684298Z"} +{"details": {"cell_id": "a1bc95e6172e61ef77f607c3622c4f1a"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "b06e646cdd1971ceec6609c7ff574bb9321d7f2667df5504117ca04bb3d48c09", "run_id": "r029", "schema_version": 1, "sequence": 189, "sha256": "406c8e5db64e94fa6ddeaf2c80ad55c50ab28c8204f5202810a94c9bacafdad7", "time_utc": "2026-08-01T20:43:41.803207Z"} +{"agent_id": "/root/v4_report_r029", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "528fe440fd446d1ce7ebc2a7d774374f8ef9c137123c3fcb92567ed01fbb11e1", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "723ef87e5013c96272528f2ded38200fda269de9618f87cd0d09d8bf314882dc", "run_id": "r029", "schema_version": 1, "sequence": 190, "time_utc": "2026-08-01T20:44:06.233888Z"} +{"agent_id": "/root/v4_report_r029", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "25eeeac81e83c535fa966d4d43a01d2d885ecb3b2450b996cbf28b82e768fdf4", "run_id": "r029", "schema_version": 1, "sequence": 191, "time_utc": "2026-08-01T20:47:14.566851Z"} +{"agent_id": "/root/v4_report_r029", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "0515679c8a385b0b6f0859c8f50ebb377b5f37d29696119d2ff9d12598025e7e", "run_id": "r029", "schema_version": 1, "sequence": 192, "sha256": "36c58a5d3bb1ed8c0696aecbd4880c5ec35f7fdba408d48ad411a943fd72ff60", "time_utc": "2026-08-01T20:53:28.610731Z"} +{"agent_id": "/root/v4_report_r029", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "1e5420f4a3fdc701c508c687d6c161bff10be9a69344b0ae6ca5acc58478cac9", "run_id": "r029", "schema_version": 1, "sequence": 193, "time_utc": "2026-08-01T20:53:28.612609Z"} +{"agent_id": "/root/v4_report_r029", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1503}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "67d6bd82ffb0b9a3f2187db767de7c3446db1600625d34af0200c321dd97e76c", "run_id": "r029", "schema_version": 1, "sequence": 194, "sha256": "ca2e2fe0e2096c3fb6629d6d97067dba5125aedf7d74c14710bdfe4f20953351", "time_utc": "2026-08-01T20:53:28.614424Z"} +{"details": {"cell_id": "5a6a7446cbedd305f50f4da2d0d7cd6b"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "91c2dbd713e25d7fe4f7db3fd243559460ba2f8dc38062ca45634fa4c9aa6868", "run_id": "r030", "schema_version": 1, "sequence": 195, "sha256": "b339bf014a6347ea01865eafcd14a7a270df465ded4bdf011a47447ce9a5c217", "time_utc": "2026-08-01T20:53:35.268809Z"} +{"agent_id": "/root/v4_report_r030", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "7822a6e1f751f68f50aaa9a330ae818519d40eb7c96c205e806915eeb7fb8047", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "5c77bf241785f1eb4a3c0fa57855df595e46acb1cfdcc9e3e1ab84fb4524beaf", "run_id": "r030", "schema_version": 1, "sequence": 196, "time_utc": "2026-08-01T20:53:57.535845Z"} +{"agent_id": "/root/v4_report_r030", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "381a2defced944cd6a4f48637f351a7ff8adc39cb543c21d4323042742e2567e", "run_id": "r030", "schema_version": 1, "sequence": 197, "time_utc": "2026-08-01T20:57:14.428826Z"} +{"agent_id": "/root/v4_report_r030", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "a9f4c7da9330d546da8d2e76f168a5001d1f850b26a7d2377e6c394022a5d754", "run_id": "r030", "schema_version": 1, "sequence": 198, "sha256": "cc5bedee611a716336dc6a0549b1e2dfd77e6eb694fcd01cbdd4d01100ab91ea", "time_utc": "2026-08-01T21:00:15.330453Z"} +{"agent_id": "/root/v4_report_r030", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "7c152047838c62d2b7ff25b485998fcb95e0072f82f7cd56e36ac7c455897182", "run_id": "r030", "schema_version": 1, "sequence": 199, "time_utc": "2026-08-01T21:00:15.332134Z"} +{"agent_id": "/root/v4_report_r030", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 839}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "7738370b5440c4e81b051afc70d5fcd43c46b32ecaefdb635960d55c33fb5a53", "run_id": "r030", "schema_version": 1, "sequence": 200, "sha256": "7632affdeeafcfccad88b8fdf653218f196aac4cc1362ddf0525f98656a9c7b3", "time_utc": "2026-08-01T21:00:15.333731Z"} +{"details": {"entries": 56, "wave": 4}, "event": "authority_verified", "phase": "collection", "previous_event_sha256": "2a6b4fd5faf70078e50d68536abc7cfd7bedcf2ae52356639118fc1a19bc6559", "schema_version": 1, "sequence": 201, "sha256": "48444682cfc13966ce2769add9d4fbde82426a7a6e8777c421be8b26d15ff293", "time_utc": "2026-08-01T21:00:32.173573Z"} +{"details": {"cell_id": "2e0f8622dd6e05cf9c513014269574dd"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "93eb6ba153a1ce68604bb6b49ed13517bb675e957fc3959b0973bebf7259f191", "run_id": "r031", "schema_version": 1, "sequence": 202, "sha256": "40cb864378ff6a4a9252df98e88fb970a79d6be27b147d650abe81eac961afdf", "time_utc": "2026-08-01T21:00:48.889896Z"} +{"agent_id": "/root/v4_report_r031", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "161864456f3440ef1f5c2238ba0f04cda11233d039c433aa10ee1e5bfdcca2d0", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "76867220002c5f1091a41bf99bf0e0bc8f0e918f4745ea33586c37a505767320", "run_id": "r031", "schema_version": 1, "sequence": 203, "time_utc": "2026-08-01T21:01:16.474632Z"} +{"agent_id": "/root/v4_report_r031", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "1e18e735826a3286f3e0963eeec6dd94dee80c95f1c07eadc8a66f22fb9a519e", "run_id": "r031", "schema_version": 1, "sequence": 204, "time_utc": "2026-08-01T21:04:28.697315Z"} +{"agent_id": "/root/v4_report_r031", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "138aca1a28df88dedeeb9f633553fd494f76cf5441cdf494377982ed1911da66", "run_id": "r031", "schema_version": 1, "sequence": 205, "sha256": "b86a83bcb1bdfbf80c33fe8ceb6e6ef4a9a34287fa7de1a7d664d20d0ca99a5e", "time_utc": "2026-08-01T21:07:28.175717Z"} +{"agent_id": "/root/v4_report_r031", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "372dcd8a024179c89bf5d8607fd88f9123c730d4ae8a348d94ef32ae67dda663", "run_id": "r031", "schema_version": 1, "sequence": 206, "time_utc": "2026-08-01T21:07:28.177323Z"} +{"agent_id": "/root/v4_report_r031", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 972}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "975fa0cb1aed3acaf9e21728dabec02e33bd03bc41faaa9a292bd790124bae70", "run_id": "r031", "schema_version": 1, "sequence": 207, "sha256": "70aa95c476fb1d5b79ce3af822cf0dea84ad8134ecedee859aa09c98b5c51a36", "time_utc": "2026-08-01T21:07:28.178917Z"} +{"details": {"cell_id": "b482b26bbca7b2874886f3e0b8f24997"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "27fb1d134870a2228b5cce8c60dfec085ccc59c46fb490c2cfcdc1f14295394c", "run_id": "r032", "schema_version": 1, "sequence": 208, "sha256": "e46d9a7d6caf2362372f4580e93dfda378556cd10d767b86c333f959c1393e63", "time_utc": "2026-08-01T21:07:33.646406Z"} +{"agent_id": "/root/v4_report_r032", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "a5fb91ecf0e3b702333020cbaed63deff71ad820dc296a825ba140501bee6571", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "4e771fdaaaf0c260138cf236d05dfb9bdddb03401b89d19fb79802b09adac3f9", "run_id": "r032", "schema_version": 1, "sequence": 209, "time_utc": "2026-08-01T21:08:00.278562Z"} +{"agent_id": "/root/v4_report_r032", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "34cc0cd4b60c02634a2cda789a7e146d390d8fcc8df7a1abe7a309c80dab23cb", "run_id": "r032", "schema_version": 1, "sequence": 210, "time_utc": "2026-08-01T21:11:08.734965Z"} +{"agent_id": "/root/v4_report_r032", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "56a9f067fcecbc87c3a319fffdf8991f45ba5bc17376b006b2db0fe7e1a0feb1", "run_id": "r032", "schema_version": 1, "sequence": 211, "sha256": "24f0467b5e472232367356be27840e57e51a6895da816bd2676791e497c706a2", "time_utc": "2026-08-01T21:15:52.503402Z"} +{"agent_id": "/root/v4_report_r032", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "1a347766da8ebab8804162bf7e4f3e958cc48dfc157a7d47c3567fb88eb204b9", "run_id": "r032", "schema_version": 1, "sequence": 212, "time_utc": "2026-08-01T21:15:52.505217Z"} +{"agent_id": "/root/v4_report_r032", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 932}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "eb9bd7c95fdd3b4e7cce5fdf3d7fe3ce55704997ab0a3b8aa0cdb8fd8a2ad5a5", "run_id": "r032", "schema_version": 1, "sequence": 213, "sha256": "504ff4872d456561c79c0295a3314112c456ed899917d9990ea9765f4e98c8cd", "time_utc": "2026-08-01T21:15:52.506996Z"} +{"details": {"cell_id": "22badac4da8e11220b04e1757934af83"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "95b5e8614cc43d1db247e0f342868973c63071416d2fc9d35229d673b039c9c0", "run_id": "r033", "schema_version": 1, "sequence": 214, "sha256": "352601674a89f22b0cc7be01cb331dbf91b3c2740bac6d5f24bb8e724a92f4a5", "time_utc": "2026-08-01T21:15:58.182695Z"} +{"agent_id": "/root/v4_report_r033", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "490fffd98de271d94301abee996c9cfb8585abf253079a3b2ae94c045f80c373", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "0c1b2d756774b542a122b863678ea079571f6c68266ce1a2cf93059694f7b232", "run_id": "r033", "schema_version": 1, "sequence": 215, "time_utc": "2026-08-01T21:16:19.044060Z"} +{"agent_id": "/root/v4_report_r033", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "eb598ae2fc96bdb1b3654903f01ea54da4765f43fe05c85e99f0549d2107a196", "run_id": "r033", "schema_version": 1, "sequence": 216, "time_utc": "2026-08-01T21:19:26.882211Z"} +{"agent_id": "/root/v4_report_r033", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "8d53e37efb46b8f3da8000a622adb3af212f995f95d8bd819f2a9db89e184787", "run_id": "r033", "schema_version": 1, "sequence": 217, "sha256": "f9e4fb0e1ac73e834656894077104b6bd05317443a732ae8327537de252e2a99", "time_utc": "2026-08-01T21:24:23.708912Z"} +{"agent_id": "/root/v4_report_r033", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "b5bc581cbb4e0ceb78ac7c1a346563ee1d1709e53b8a4bf8de56e5e1b0dd2cf2", "run_id": "r033", "schema_version": 1, "sequence": 218, "time_utc": "2026-08-01T21:24:23.710568Z"} +{"agent_id": "/root/v4_report_r033", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 997}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "7ae0ab04e1b3eaf8a41f123a2d2f4deb95d4f8d7a6a75e395f47bfab9b68dafa", "run_id": "r033", "schema_version": 1, "sequence": 219, "sha256": "d14718131a1eb74ccf317bd2f288d4a85da663414929c3e59ad4b8a5be37babf", "time_utc": "2026-08-01T21:24:23.711994Z"} +{"details": {"cell_id": "003eb505a9319d72618e179a97be7e48"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "dd37103dc772bd9174c09fae9e58b044f3cfe64ae10a6504b3c07b1badf09b3d", "run_id": "r034", "schema_version": 1, "sequence": 220, "sha256": "f3d028fd9343e4de0d152eef78935a26754193c37e79f1a1abc655c8cf9775b8", "time_utc": "2026-08-01T21:24:28.689124Z"} +{"agent_id": "/root/v4_report_r034", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "23af29b7ac6f0fa1d2e2eb08cad5cd6b5a55ab2915f7a4c74920359786ddb2ef", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "c9cd414011e059397124b99b556d32599af066f29fa1a25f4935f99a81a21562", "run_id": "r034", "schema_version": 1, "sequence": 221, "time_utc": "2026-08-01T21:24:51.233910Z"} +{"agent_id": "/root/v4_report_r034", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "2d410786df013e316c2a64e4df49235cff0569cae9ac6df6ac04435c397812ba", "run_id": "r034", "schema_version": 1, "sequence": 222, "time_utc": "2026-08-01T21:27:59.426541Z"} +{"agent_id": "/root/v4_report_r034", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "237f0b02a319d90a53eb3000560862b812b381b9dd5655e6667c9c8e288e5708", "run_id": "r034", "schema_version": 1, "sequence": 223, "sha256": "a58a41bf9886f4bd20e39e4bf204dd6019e7012c2b6c2914647c061688034bef", "time_utc": "2026-08-01T21:34:01.388119Z"} +{"agent_id": "/root/v4_report_r034", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "3481762599288ef46d4a94ecff5f92470ae62b36fb3475e59ab496136a15abdd", "run_id": "r034", "schema_version": 1, "sequence": 224, "time_utc": "2026-08-01T21:34:01.389765Z"} +{"agent_id": "/root/v4_report_r034", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1422}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "679a13fa51a1c5e0cda1a3585923e2c3fd07c4c485ecc8d4b4fe21e5481e5b6a", "run_id": "r034", "schema_version": 1, "sequence": 225, "sha256": "481bdce1f650e4b9ffc1242fccb53adb23bd33ed200d6971ed40fb3e944e067f", "time_utc": "2026-08-01T21:34:01.391338Z"} +{"details": {"cell_id": "ef849e68071dd35eab47d3cea2edea7c"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "1b3daff837290809c8977135e14cdf3d74f8e902d3583c23b2314a0bf44d457d", "run_id": "r035", "schema_version": 1, "sequence": 226, "sha256": "0bf5bfbae187d3ac8d49a9d52ff608ee5d75c6e41b5eb2fc3b0386ce53c10f8a", "time_utc": "2026-08-01T21:34:06.232972Z"} +{"agent_id": "/root/v4_report_r035", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "51e25df313c675c2b764c3584e4984b1cb92f58cb864f5be8697f995ade32301", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "662294b516a8f17ef073608114743eeddb488737520a9ca9404167834e26dc3b", "run_id": "r035", "schema_version": 1, "sequence": 227, "time_utc": "2026-08-01T21:34:30.910458Z"} +{"agent_id": "/root/v4_report_r035", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "f5be6256d2df26ce6d742b35aee326e2b9b5948d9924d3293ded7e557daf15a1", "run_id": "r035", "schema_version": 1, "sequence": 228, "time_utc": "2026-08-01T21:37:40.051704Z"} +{"agent_id": "/root/v4_report_r035", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "411286cb5e97047b5286257a7a8e51e1cf8728b71b8dcdbcfbc37ad95c5ce870", "run_id": "r035", "schema_version": 1, "sequence": 229, "sha256": "06add7edbf574808c6ff73a0344b2ec96b1651614d51e7ee7bd85c06a8cad2ad", "time_utc": "2026-08-01T21:42:28.988338Z"} +{"agent_id": "/root/v4_report_r035", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "0e8e7d3aa4d8ec8e1472fc03af7f99868f31da0d0ce2cf3f9a78085d85b3d089", "run_id": "r035", "schema_version": 1, "sequence": 230, "time_utc": "2026-08-01T21:42:28.990036Z"} +{"agent_id": "/root/v4_report_r035", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1273}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "220fd8a96a2371fa19d0a4512d190701cf89b3409bae619d0835ea26d813d57c", "run_id": "r035", "schema_version": 1, "sequence": 231, "sha256": "c81b3b6430a1854a652a3f6d3866c08a4969453f770cd387c843f253ae8b01ac", "time_utc": "2026-08-01T21:42:28.991881Z"} +{"details": {"cell_id": "d8e6c7b48648fa9c52011e592e0a88ec"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "98cf1501cc5e0573b68fe69048ae7431dee917a61331a06333702a2831e4d86c", "run_id": "r036", "schema_version": 1, "sequence": 232, "sha256": "34312d7dd8b3c7e0d8705be57dcf7c09cd4f2b1495b56ca976a31eab2f257345", "time_utc": "2026-08-01T21:42:35.915933Z"} +{"agent_id": "/root/v4_report_r036", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "7cfcbea9d352337bd1c32505080429d0083ae5906d6e9227df9c79961187d885", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "d0eba605ae004b04f68bd6fdc4a0fed00f4210a23c768840581f3d4721b61cf2", "run_id": "r036", "schema_version": 1, "sequence": 233, "time_utc": "2026-08-01T21:42:58.245372Z"} +{"agent_id": "/root/v4_report_r036", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "f6bbb5a441fc7d91cdc7f45fcf2f3014e3179144c5636aa8b8b65bc2e7409c88", "run_id": "r036", "schema_version": 1, "sequence": 234, "time_utc": "2026-08-01T21:46:08.305652Z"} +{"agent_id": "/root/v4_report_r036", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "37abcd65c240e407b821da96b6567d5b7e6854442b8ac9a2dba666e7365e944e", "run_id": "r036", "schema_version": 1, "sequence": 235, "sha256": "34fb584fcef5c6ecfa170234237f06f1f997337a4020f843b39c0baa51c1f393", "time_utc": "2026-08-01T21:51:52.373542Z"} +{"agent_id": "/root/v4_report_r036", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "598a3d4228785953803ebc8f44f9d80ed91adf9b61b2097291cc02f97b53f929", "run_id": "r036", "schema_version": 1, "sequence": 236, "time_utc": "2026-08-01T21:51:52.375251Z"} +{"agent_id": "/root/v4_report_r036", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1348}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "c4b5448c6c8c4c19a35857b49b3413242744b981701ca99e1e648582d51f252e", "run_id": "r036", "schema_version": 1, "sequence": 237, "sha256": "3e11d4e6e869575bd8c807ef85277f7f29e39ef85e6ae177fb4ea073d0e27093", "time_utc": "2026-08-01T21:51:52.376889Z"} +{"details": {"cell_id": "ade6941768c396439f8667962c86db72"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "e5541e632cef49058ac97638c8ea7322072f2be4e780f2aca474e3dccdc86e5e", "run_id": "r037", "schema_version": 1, "sequence": 238, "sha256": "2aec4009d2113c07dbd17a5885f8f79b15f0f0aa898b9e90db899f51dac768d3", "time_utc": "2026-08-01T21:51:57.541248Z"} +{"agent_id": "/root/v4_report_r037", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "b031c79560e4eacbd703e150aa4f1158b549a5254a9783a674fd567208bfa7cf", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "e6699135a34a47305d8d6d53a582e85dc81387198cb6bb09a1251aeb3b618588", "run_id": "r037", "schema_version": 1, "sequence": 239, "time_utc": "2026-08-01T21:52:18.897185Z"} +{"agent_id": "/root/v4_report_r037", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "b3fb08313a7fb27bc874ebe4c3dd6e44e176d014a6761cbb60bf30bebdb3e65c", "run_id": "r037", "schema_version": 1, "sequence": 240, "time_utc": "2026-08-01T21:55:28.044918Z"} +{"agent_id": "/root/v4_report_r037", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "234a2d21deb7f8fa85c74c0b20772eedebd5b4732d94927d54787b279dd080e3", "run_id": "r037", "schema_version": 1, "sequence": 241, "sha256": "2e158617b4abdac219f7ac48b12c9c035677ee35a1775a48f8592f32302bf4a9", "time_utc": "2026-08-01T22:00:43.718294Z"} +{"agent_id": "/root/v4_report_r037", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "5af326cc568228a2e06d760b06fe31cd7efc79d23f7d6605bbc170f830035f45", "run_id": "r037", "schema_version": 1, "sequence": 242, "time_utc": "2026-08-01T22:00:43.720346Z"} +{"agent_id": "/root/v4_report_r037", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 957}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "5bbfa950a133389c891e41f0e85e960713724b69005985a9256fb9c8ebfdabbe", "run_id": "r037", "schema_version": 1, "sequence": 243, "sha256": "141d0ee3549279a6d90aab62c89bc12d0f85a994bbfcdc4c5d29102001a1cc67", "time_utc": "2026-08-01T22:00:43.722159Z"} +{"details": {"cell_id": "e3fd91b83327cb14ce581423c69ec9cf"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "3cd080b44da7b055f7abfc9a95f7410fb2a8df8b841335a0a94cc9be57e76a01", "run_id": "r038", "schema_version": 1, "sequence": 244, "sha256": "dba67333710635842ab454801c065e0031ee70eb798076c471bda05c2679aaac", "time_utc": "2026-08-01T22:00:52.387335Z"} +{"agent_id": "/root/v4_report_r038", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "2a966f57dc4140919ff25ab76de348817c25250f9375e1c9862e84c5d02d179f", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "ab28a1148d61c4a9b1b07d7114515e6e96b5ddb0186a7263578198f86229ebd7", "run_id": "r038", "schema_version": 1, "sequence": 245, "time_utc": "2026-08-01T22:01:15.207344Z"} +{"agent_id": "/root/v4_report_r038", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "458c36cfc516025ca756aa4ac42ddea7822b73e9cd74754ddea1bd6a1265f9e8", "run_id": "r038", "schema_version": 1, "sequence": 246, "time_utc": "2026-08-01T22:04:23.174558Z"} +{"agent_id": "/root/v4_report_r038", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "e82d28a052ec9d3188721b43e4e26a911c8872960b3db2941af32af2c55ff198", "run_id": "r038", "schema_version": 1, "sequence": 247, "sha256": "0089924edab7cb144a33ae77805385bd233c19ba597f16009fd7ce7c71365b01", "time_utc": "2026-08-01T22:10:01.330614Z"} +{"agent_id": "/root/v4_report_r038", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "a02952b48c589f2cfde76070dafa9f49693a38bbea4332913a4297198dcff466", "run_id": "r038", "schema_version": 1, "sequence": 248, "time_utc": "2026-08-01T22:10:01.332339Z"} +{"agent_id": "/root/v4_report_r038", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1056}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "6aa31d5745a7a1fa41c7604eb740f1aa9a358f12e95617d3899f0d0f67d2e51a", "run_id": "r038", "schema_version": 1, "sequence": 249, "sha256": "da0d4553898b5177722b6739562ef75fa4d6baf228dd1818f8f7e39e42167356", "time_utc": "2026-08-01T22:10:01.334001Z"} +{"details": {"cell_id": "dd2bec812c16181d87ba7704dde26eba"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "867301486a8911eda1f2ba5b75276fd9864b76975ad709174e183dabc9f7dd40", "run_id": "r039", "schema_version": 1, "sequence": 250, "sha256": "6571bb04b228152aacc8e131e38e9e745f1761c19ebca49fb5d7dde64def45b7", "time_utc": "2026-08-01T22:10:06.648663Z"} +{"agent_id": "/root/v4_report_r039", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "fd161f62097b93453a2240152f7fb704883e254bbcaf845f3f8382a87a5ecf94", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "ace7f031ee625ce3531b898f868523cf8d210e6d05d99034c25a34d2480bf67b", "run_id": "r039", "schema_version": 1, "sequence": 251, "time_utc": "2026-08-01T22:10:30.623733Z"} +{"agent_id": "/root/v4_report_r039", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "889cf331e73aaeb54a9cf93aa89a161c81aaf42ef5a958f8da1aee5974ab4c75", "run_id": "r039", "schema_version": 1, "sequence": 252, "time_utc": "2026-08-01T22:13:43.253304Z"} +{"agent_id": "/root/v4_report_r039", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "e3cc75e6f8fcf2e819d0a0092b7c566ace0cb9516c0e8c4c97a84a10e23e2da8", "run_id": "r039", "schema_version": 1, "sequence": 253, "sha256": "efa1069734db0c220856f670092b78f49858e53ec9b7e8d0a4ede05e75180929", "time_utc": "2026-08-01T22:18:35.780129Z"} +{"agent_id": "/root/v4_report_r039", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "0058b324915063268b8d4fbabd9385f0b08754dc90c648234244b0916ed0aafb", "run_id": "r039", "schema_version": 1, "sequence": 254, "time_utc": "2026-08-01T22:18:35.781501Z"} +{"agent_id": "/root/v4_report_r039", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1044}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "430175f80c94079fbb85d3528ba6c74b788c7206eba96e32af47369d5f359860", "run_id": "r039", "schema_version": 1, "sequence": 255, "sha256": "645f68d41c35811515b578645d72dce0dfe469bc7d123d4676c6f2779043409c", "time_utc": "2026-08-01T22:18:35.782863Z"} +{"details": {"cell_id": "87c0b4c22af01464c1409ebdadcf935b"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "b306a718fd6d5b8b6ccb88922abb9935cf74f009b202be2e27636ca14e76bbf3", "run_id": "r040", "schema_version": 1, "sequence": 256, "sha256": "f55e2dff034140abbe18aaed34bb533ea4aada68e879a44ab4c94b05eb402c5c", "time_utc": "2026-08-01T22:18:41.678773Z"} +{"agent_id": "/root/v4_report_r040", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "6e81dea720eeddd2b31ed5a9381aa8c4f7d6b3a671e409a86d0f0a9313eee5fd", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "8b8428b2318f61f4870547e3d6c9d7c9911420949ad29fe3fe7e1682197ca56e", "run_id": "r040", "schema_version": 1, "sequence": 257, "time_utc": "2026-08-01T22:19:06.549364Z"} +{"agent_id": "/root/v4_report_r040", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "a7d2d829c72cfce1b2e9ac9fc983cf610a0f55a4911b68a38915f7c56529bccd", "run_id": "r040", "schema_version": 1, "sequence": 258, "time_utc": "2026-08-01T22:22:23.941775Z"} +{"agent_id": "/root/v4_report_r040", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "882aa2566422809ee0d99358128ffdc0469f5b94d02f85f3980c940d1a7c768c", "run_id": "r040", "schema_version": 1, "sequence": 259, "sha256": "a2f94af1a203e7aec4dddd8a4783ed7a671416ec05513b1142d6c7638c11c2d3", "time_utc": "2026-08-01T22:29:01.865236Z"} +{"agent_id": "/root/v4_report_r040", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "c21113bdaf8359f095bcc1264d4412a09d8ebfbde608e037de316604b480384b", "run_id": "r040", "schema_version": 1, "sequence": 260, "time_utc": "2026-08-01T22:29:01.867219Z"} +{"agent_id": "/root/v4_report_r040", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1466}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "5e0e2a2d927867c816091c523d1ca7a446dd23763f909bf078c1adfe038409b1", "run_id": "r040", "schema_version": 1, "sequence": 261, "sha256": "d3ed478991945f13610c6cf0b2dbde59dbe68b37afcf9c456e17a78197a8d6bf", "time_utc": "2026-08-01T22:29:01.869037Z"} +{"details": {"entries": 56, "wave": 5}, "event": "authority_verified", "phase": "collection", "previous_event_sha256": "aeba81326a071340c5b12a418a9f5eaea8deda0df1453a8973a390016e80777c", "schema_version": 1, "sequence": 262, "sha256": "48444682cfc13966ce2769add9d4fbde82426a7a6e8777c421be8b26d15ff293", "time_utc": "2026-08-01T22:29:17.512679Z"} +{"details": {"cell_id": "ca9a51c748d12675cf8ad67d1ba1557d"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "6072578cbc05e07eee3d7bdf2e6e2358bdc89e89dc47db77c4c0263bd87e348b", "run_id": "r041", "schema_version": 1, "sequence": 263, "sha256": "cf37ebe241169ab20b442f209825314cb111c7c02b1993e44539e80a7a99424b", "time_utc": "2026-08-01T22:29:28.317363Z"} +{"agent_id": "/root/v4_report_r041", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "ffb2f57c4b482fd6949d9ee3983ced8534c5b4b3620c10a509450f2bb35f7697", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "0f56cf30ccc60f9e180bd17a0bf127a7d0b83eae83208c140d6854e4638707fe", "run_id": "r041", "schema_version": 1, "sequence": 264, "time_utc": "2026-08-01T22:29:52.791781Z"} +{"agent_id": "/root/v4_report_r041", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "b72a1f1b27ecbe94735d25961dc21da1d74de0edd161c9291124c18310e45558", "run_id": "r041", "schema_version": 1, "sequence": 265, "time_utc": "2026-08-01T22:33:10.981408Z"} +{"agent_id": "/root/v4_report_r041", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "89cebb12be8a3ce6c61dd3a97f6c84d5482bce23d62d8c4db6ba7c2ab21bcbae", "run_id": "r041", "schema_version": 1, "sequence": 266, "sha256": "9261b6d59eca512b25ad857b1d2e9d013244cd5baab114aa342e6c1a11c09ef8", "time_utc": "2026-08-01T22:37:52.838194Z"} +{"agent_id": "/root/v4_report_r041", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "17e6c62d7ef16ca1d10cb396726f619aaa9fa4cf62d0a469e17388dd57ab4b02", "run_id": "r041", "schema_version": 1, "sequence": 267, "time_utc": "2026-08-01T22:37:52.839796Z"} +{"agent_id": "/root/v4_report_r041", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1133}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "ac537f488f016b3bfe35c2d992812fc96e56c142bc3efe48851542c1fb051625", "run_id": "r041", "schema_version": 1, "sequence": 268, "sha256": "9ee2c47518f8d65a91c84a208bdec4050c516fe6ea1c6dcf6da45299451f9bed", "time_utc": "2026-08-01T22:37:52.841273Z"} +{"details": {"cell_id": "731af655906ddde75f94adda71951585"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "f09792b210118cca4dbbbb376158fd08056807c2a4b9a843543c4f78c8853429", "run_id": "r042", "schema_version": 1, "sequence": 269, "sha256": "9fb037a4df963077de072a8d1a41e14e85854a463dd0ee11eb81b4bb0c11f9f4", "time_utc": "2026-08-01T22:37:58.528882Z"} +{"agent_id": "/root/v4_report_r042", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "245e921b6173060da63a51b4c2def155a92c1c1384dfeb354190969d4bff0f8f", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "4c3152e725abc581cd4484a387431436b5140a321ebd48bddc828c8e15a68980", "run_id": "r042", "schema_version": 1, "sequence": 270, "time_utc": "2026-08-01T22:38:24.796997Z"} +{"agent_id": "/root/v4_report_r042", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "808f086ff5d0cf3e6cc1efe81f741d38d37922f369d4231c8b0913d99e721312", "run_id": "r042", "schema_version": 1, "sequence": 271, "time_utc": "2026-08-01T22:41:36.060159Z"} +{"agent_id": "/root/v4_report_r042", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "cd5ec563bedfe0ed763fdffafc02b4299634f3138e4d7504b4a4ef7d50e13255", "run_id": "r042", "schema_version": 1, "sequence": 272, "sha256": "43e31c2b7064ceaa546d7e2f35d2b54765daf3082473704f8877a859e5455d7f", "time_utc": "2026-08-01T22:46:07.411643Z"} +{"agent_id": "/root/v4_report_r042", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "5f75b9c1b3d76e3a517d3bacf44c06143a8c8a993ee22da87a89828e5ed4edbe", "run_id": "r042", "schema_version": 1, "sequence": 273, "time_utc": "2026-08-01T22:46:07.413473Z"} +{"agent_id": "/root/v4_report_r042", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1042}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "07b61ec2c5394f6d8f9e9386553f737544d93c1607d908c726d58ff1d2f9e269", "run_id": "r042", "schema_version": 1, "sequence": 274, "sha256": "9b384e4d25bdffc9aa4778754f57056871249885fb3e9fae08083850432e5644", "time_utc": "2026-08-01T22:46:07.415300Z"} +{"details": {"cell_id": "bfbb18dae72c76b471f0597ee61354c1"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "61dd5f35961b297da7f68f6b2459d5cee67612ac3a84e483a2b45752c7666f6f", "run_id": "r043", "schema_version": 1, "sequence": 275, "sha256": "130dccdcf3582160fd958c0f3973bfa98266e50ed384ffe5f0d61b9f9b4ad179", "time_utc": "2026-08-01T22:46:12.614082Z"} +{"agent_id": "/root/v4_report_r043", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "5f9d82437f31e83e5f6ecb21914c6bfdded523e918232600052b76f7076a1aa0", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "f2234d2615125c239e93bb3aa88a358ef8e33c2eb30667a1dea4abd3b608dc8d", "run_id": "r043", "schema_version": 1, "sequence": 276, "time_utc": "2026-08-01T22:46:38.333172Z"} +{"agent_id": "/root/v4_report_r043", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "9e2de1a8442d447411056bb1af104a2a2a086ce467dc22818d6584ee8e6f6b59", "run_id": "r043", "schema_version": 1, "sequence": 277, "time_utc": "2026-08-01T22:49:49.162026Z"} +{"agent_id": "/root/v4_report_r043", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "5ecfbabcda2806e539908038e5ec79a09e299635a75722ba0fa33ea3a29bfec7", "run_id": "r043", "schema_version": 1, "sequence": 278, "sha256": "29b1f7f025d05f6182b64f65212e4e18b8e39b4a865c4336ed98e649f7f270bb", "time_utc": "2026-08-01T22:53:49.078670Z"} +{"agent_id": "/root/v4_report_r043", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "55d5bb5abe5b0d36d6385511b563efc3fcb4ebe3a1fe36b1567ed7cf1c5ab5c2", "run_id": "r043", "schema_version": 1, "sequence": 279, "time_utc": "2026-08-01T22:53:49.080369Z"} +{"agent_id": "/root/v4_report_r043", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1021}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "94a68e56a6441a06cf16c30f142ade35f12d826133e8e830cc09bdc7c8429c7a", "run_id": "r043", "schema_version": 1, "sequence": 280, "sha256": "31b3e62080d847ce3a1005a6f3e1a8359578a5859fd56f1e4fc3bbf6a95784ea", "time_utc": "2026-08-01T22:53:49.081999Z"} +{"details": {"cell_id": "649b1cb579bfd36bb7c870f71f4a710b"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "ecbd700beaf6c7caf936b6835f7a68d64166827657ad121aa1d60f05266414f6", "run_id": "r044", "schema_version": 1, "sequence": 281, "sha256": "69020d2663b386a049a588993ae221a2a7763e7da11d9df485461f543d30257d", "time_utc": "2026-08-01T22:53:58.846704Z"} +{"agent_id": "/root/v4_report_r044", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "46c0dd787958bc6e320e1903e4192ca2e05112c93e9e5ff0c3d8f2e2ecfb5772", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "6745bfbe015c93882f13742331062efa2b8c87d6a834329418be757161aadda2", "run_id": "r044", "schema_version": 1, "sequence": 282, "time_utc": "2026-08-01T22:54:20.284528Z"} +{"agent_id": "/root/v4_report_r044", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "6434e49ff099277c616d4d96f66b72e71adf0997de24f8bf2fb2d2629dd031ab", "run_id": "r044", "schema_version": 1, "sequence": 283, "time_utc": "2026-08-01T22:57:33.274795Z"} +{"agent_id": "/root/v4_report_r044", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "42a4d09a7c208f9c4d885053019e185a5ff35e3f3795d48a661ab3930fab9a5e", "run_id": "r044", "schema_version": 1, "sequence": 284, "sha256": "d9570c5f9c35bb09feff0083868cbe12fa23a8db79acd76aa69887df889ae5c3", "time_utc": "2026-08-01T23:00:00.808521Z"} +{"agent_id": "/root/v4_report_r044", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "1d345ce636d3fa4c177bd7f4f6a5af5fb3535d6065985938717ed28f3641061e", "run_id": "r044", "schema_version": 1, "sequence": 285, "time_utc": "2026-08-01T23:00:00.810253Z"} +{"agent_id": "/root/v4_report_r044", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1049}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "308222014ff70cd27303bead35bec7173e4488a9dc8e6aeb0bd7a0d58831561a", "run_id": "r044", "schema_version": 1, "sequence": 286, "sha256": "d64506354d1859a400f27a02b58acdc4c122d6b225fc2f9d0651e3f1017bebc6", "time_utc": "2026-08-01T23:00:00.811920Z"} +{"details": {"cell_id": "085efb6bfa93ab54a4f3cfef9ec74c56"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "fe00720ac134cb54fd1a06fbd1abf1430b5bdaa3cb54ab5bb7fdc21a8a538fa7", "run_id": "r045", "schema_version": 1, "sequence": 287, "sha256": "002a5f14b1d79a053431760c38e8610cc4b66d08f7656cb7c8831e6673a070e3", "time_utc": "2026-08-01T23:00:06.728405Z"} +{"agent_id": "/root/v4_report_r045", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "ac350d7df75a4415b6306ddc898d43b924d7101c0df43a0fd8e2cbad5aa6532f", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "77037b7933c84888954167a02a1c0386cf56d8e67eea5ca59fcea0d5503cc2a9", "run_id": "r045", "schema_version": 1, "sequence": 288, "time_utc": "2026-08-01T23:00:34.428157Z"} +{"agent_id": "/root/v4_report_r045", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "b0a6111b148e9512e528843ef775024824ddf3561d4d29251680c2abaa986344", "run_id": "r045", "schema_version": 1, "sequence": 289, "time_utc": "2026-08-01T23:03:51.054136Z"} +{"agent_id": "/root/v4_report_r045", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "ebb065a32f68831be2250ea8e678c49a33cd678ad3a93dd62c057af0ff62bce1", "run_id": "r045", "schema_version": 1, "sequence": 290, "sha256": "104e849428e450d18a4e648f4eecb98429d261561ecc7e1633f33ec049fb7433", "time_utc": "2026-08-01T23:10:02.305468Z"} +{"agent_id": "/root/v4_report_r045", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "53f03314b99a40b862604ce6d270b935320b93cabf80ec1a0ab14954e89045d3", "run_id": "r045", "schema_version": 1, "sequence": 291, "time_utc": "2026-08-01T23:10:02.307085Z"} +{"agent_id": "/root/v4_report_r045", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1584}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "075afc581a49c0d6f4b93f34909a2f41635d39ac2ac93f03384ef20f5858558b", "run_id": "r045", "schema_version": 1, "sequence": 292, "sha256": "79d94306111d77ca7b72fe0d5bc780e96009c10285753a0979c7e926977cefc8", "time_utc": "2026-08-01T23:10:02.308682Z"} +{"details": {"cell_id": "ba8cf964fdde681e2fee804faaa42bc7"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "335be47fc7101b0dcf720b43b5396eca2a9d27d45e667c19958318e83eada1f2", "run_id": "r046", "schema_version": 1, "sequence": 293, "sha256": "7964c9cac656f8b7ff3bd6a79a958877977295f86de59839ee356fb7535f263e", "time_utc": "2026-08-01T23:10:08.296097Z"} +{"agent_id": "/root/v4_report_r046", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "d92145fe8a39aef9370b1d7f38998ad293735ffbac7c9a0b5cb044cb74dbf46d", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "21f8ee542170c965465e69e547f52723c430dd2e31d5bae58ca47301f345849c", "run_id": "r046", "schema_version": 1, "sequence": 294, "time_utc": "2026-08-01T23:10:38.293512Z"} +{"agent_id": "/root/v4_report_r046", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "d7ecb85ce70c3e78fe25b62ea2e90d960732d1589b37cc6643dc2f185d1b712b", "run_id": "r046", "schema_version": 1, "sequence": 295, "time_utc": "2026-08-01T23:13:57.182371Z"} +{"agent_id": "/root/v4_report_r046", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "3ee79c927dd8df0364df025055a7f8b21ab95865fe2459166ab234cf97cfcb6b", "run_id": "r046", "schema_version": 1, "sequence": 296, "sha256": "444a1a4c9f5aaef7811b978a414202cef3a313dd7af746eabe934ef26a07734c", "time_utc": "2026-08-01T23:19:56.836150Z"} +{"agent_id": "/root/v4_report_r046", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "0983eae1f6741d09ce9997887ef11a1cb00d37892b73cf56754d08c149d664e8", "run_id": "r046", "schema_version": 1, "sequence": 297, "time_utc": "2026-08-01T23:19:56.838031Z"} +{"agent_id": "/root/v4_report_r046", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1388}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "dfb153456b9cd9e0cf46ffaf60cc82cc37f0c94eedb5c2a112005c3160635968", "run_id": "r046", "schema_version": 1, "sequence": 298, "sha256": "19d9b069a036a6d9da00ebbec8e5a48315b9a414cf4c353ef71e4e75d0560f62", "time_utc": "2026-08-01T23:19:56.839910Z"} +{"details": {"cell_id": "487d4d737d629f571b1f954076797aa2"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "4119ba71a928ffe6102543a81b1398fa1d050d1ded3da8e05274cf02b3893450", "run_id": "r047", "schema_version": 1, "sequence": 299, "sha256": "3bc280b2a27af7664aff24443735869f960d495d1cb039847abf5e22b0055249", "time_utc": "2026-08-01T23:20:05.444962Z"} +{"agent_id": "/root/v4_report_r047", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "1108e9ebd28bdfafb0f6813dec2cf1df7c4ee86e435cfa7aaa9689b0cfd7f81b", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "eff22dbea1750236123ae82a712bfa215630384720efceb66738413ed13be43b", "run_id": "r047", "schema_version": 1, "sequence": 300, "time_utc": "2026-08-01T23:20:29.381464Z"} +{"agent_id": "/root/v4_report_r047", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "ce85b7fd6ff1db835041289575934d353da435cd1bfd517c88eb2f3e3a9af658", "run_id": "r047", "schema_version": 1, "sequence": 301, "time_utc": "2026-08-01T23:23:38.198745Z"} +{"agent_id": "/root/v4_report_r047", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "d723677abdeed7d7487fd11a59af282d5356874af2ea241e9c19ddd5510f4b85", "run_id": "r047", "schema_version": 1, "sequence": 302, "sha256": "a30f14dc19c49d96960230d3db0ece8698e3ea9534f31b57e931c2aeff19ccac", "time_utc": "2026-08-02T00:01:22.555213Z"} +{"agent_id": "/root/v4_report_r047", "attempt": 1, "details": {"api_state": "INFRASTRUCTURE_FAILURE"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "9a50dadffe591ab41d5d5a98cc03024f84288d4b1ec9e12b7c2108ec83af90a7", "run_id": "r047", "schema_version": 1, "sequence": 303, "time_utc": "2026-08-02T00:01:22.557262Z"} +{"agent_id": "/root/v4_report_r047", "attempt": 1, "details": {"disposition": "ORCHESTRATOR_TOOL_FAILURE", "evidence": "Coordinator reported not_found after the started agent vanished during the turn interruption; no report artifact existed."}, "event": "infrastructure_failure", "phase": "collection", "previous_event_sha256": "5b1370a748456570d08eb40ef7c4a5287b81078168efd8ba58b0e1e4e2b67f4f", "run_id": "r047", "schema_version": 1, "sequence": 304, "time_utc": "2026-08-02T00:01:22.559031Z"} +{"agent_id": "/root/v4_report_r047_a2", "attempt": 2, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "1108e9ebd28bdfafb0f6813dec2cf1df7c4ee86e435cfa7aaa9689b0cfd7f81b", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "06424017463dd15e2665754e8c6c1699b385dd1a7f52d2a4157f701cf0d9a728", "run_id": "r047", "schema_version": 1, "sequence": 305, "time_utc": "2026-08-02T00:01:43.881408Z"} +{"details": {"cell_id": "115c6fcf19fa84b860611c79cbeb4c34"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "e2fc32be53ff19cd41db75ade71b7c4c4ab03f0cfee0c4d4170109a68988eb88", "run_id": "r048", "schema_version": 1, "sequence": 306, "sha256": "d686f556c7c3734081978176d938ffb3e61074b960f5101dc094104c3b1a49ad", "time_utc": "2026-08-02T00:01:49.877047Z"} +{"agent_id": "/root/v4_report_r048", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "e0681842154a323c8b339ac0acdde4dccc9df74ea314767fabcfb2494e2ea29c", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "af8e6a0a4cdf71bf6b63928c82ccdec03cdbc20f4cbe47fecdecde658acd0a67", "run_id": "r048", "schema_version": 1, "sequence": 307, "time_utc": "2026-08-02T00:02:33.845403Z"} +{"details": {"cell_id": "c64b92f9791af578be6d336f10ede80c"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "14ace3f16f5c1c37892ce8c256f826c1374d2f58901a04e2390147b5ab3ede0c", "run_id": "r049", "schema_version": 1, "sequence": 308, "sha256": "2bc61cb43d7751e680ce1c2a5a37394d16cb2af93cc0999c19d4d12b169ef93c", "time_utc": "2026-08-02T00:02:39.699390Z"} +{"agent_id": "/root/v4_report_r049", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "7fbe1180176b88021955160a8916283756bc92d61b79d2cb1033c102170901b4", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "069022c9cac538f6fff9496caef0b65f327e63fac3e8b001b32c220732bc5e04", "run_id": "r049", "schema_version": 1, "sequence": 309, "time_utc": "2026-08-02T00:03:22.661678Z"} +{"agent_id": "/root/v4_report_r047_a2", "attempt": 2, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "a51f30228922c9dd38b1ff96670accef4e55dde73639d80c2029f61b8522c2ef", "run_id": "r047", "schema_version": 1, "sequence": 310, "time_utc": "2026-08-02T00:05:02.606032Z"} +{"agent_id": "/root/v4_report_r048", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "cee9bcff84d74abab73b8a9c3c748813b9c43a831699874d472150711b501d01", "run_id": "r048", "schema_version": 1, "sequence": 311, "time_utc": "2026-08-02T00:06:36.852657Z"} +{"agent_id": "/root/v4_report_r049", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "73f43071ee0f89e993f9b89f8bb5a8ff6a1b5e0d6ee0e3eafc0e748d3e536650", "run_id": "r049", "schema_version": 1, "sequence": 312, "time_utc": "2026-08-02T00:07:40.906849Z"} +{"agent_id": "/root/v4_report_r047_a2", "attempt": 2, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "92a4d49008d5736036517f6106d57577ecb7fdd2d4c4060067953f24b0bbe5eb", "run_id": "r047", "schema_version": 1, "sequence": 313, "sha256": "d583231e5ea797d44ca8f22e1b0214ffce6eca689ce0ada1dcdc1dada54922fb", "time_utc": "2026-08-02T00:08:45.423970Z"} +{"agent_id": "/root/v4_report_r047_a2", "attempt": 2, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "16baff422e2c3a65eb8574c7423d629c3d3c3cb919945ea4fa4fb7e8710b9caa", "run_id": "r047", "schema_version": 1, "sequence": 314, "time_utc": "2026-08-02T00:08:45.425733Z"} +{"agent_id": "/root/v4_report_r047_a2", "attempt": 2, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 859}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "7211a2b1eb3f5e83d1023c43d3d6a232f2ee832aaf30597870dce48d7443e48a", "run_id": "r047", "schema_version": 1, "sequence": 315, "sha256": "d967f1aa39439c98ad3848738c66656c708d763c1a00a16a40ef58197b885149", "time_utc": "2026-08-02T00:08:45.427372Z"} +{"details": {"cell_id": "1c2c809641b0da11ce16902e21a56185"}, "event": "cell_prepared", "phase": "collection", "previous_event_sha256": "4edba3140128e5a3341c5514c2cd89d3ebb36f2c5772765569f1652e7171bf3a", "run_id": "r050", "schema_version": 1, "sequence": 316, "sha256": "eb69c26f867e208c6599525af9426e76a6f50ab5a454b2e6bd8ab414eac76de5", "time_utc": "2026-08-02T00:08:55.886533Z"} +{"agent_id": "/root/v4_report_r050", "attempt": 1, "details": {"fork_turns": "none", "model": "gpt-5.6-sol", "prompt_sha256": "e22ba8d9af7b1ebede0a6d368c1df620173915e43060c13da98d035ed89e04a4", "reasoning_effort": "ultra"}, "event": "agent_started", "phase": "collection", "previous_event_sha256": "c2d7e1ffbac8e60bc2ab2e64128d14d49b49c563e1c6a6236236fdcbfb71502f", "run_id": "r050", "schema_version": 1, "sequence": 317, "time_utc": "2026-08-02T00:09:25.104667Z"} +{"agent_id": "/root/v4_report_r048", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "cf7cd647b4ded316c2c5d69926713a2e43504e5d37b10e15934ac5447ede8a8e", "run_id": "r048", "schema_version": 1, "sequence": 318, "sha256": "2ecfd38d2c28f07df0271ee666c151f2ca7a29074bb37908a28c31050be07eae", "time_utc": "2026-08-02T00:11:49.362113Z"} +{"agent_id": "/root/v4_report_r048", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "b1d90b0eb45e321a34e44c6b089836de4044b795fc141bbbaf007f474fc324e0", "run_id": "r048", "schema_version": 1, "sequence": 319, "time_utc": "2026-08-02T00:11:49.364074Z"} +{"agent_id": "/root/v4_report_r048", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 835}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "96555e77f1a34f853ad87c796ec8b114cd3b1cb926e807148fa4410ba224bbe3", "run_id": "r048", "schema_version": 1, "sequence": 320, "sha256": "9710335249669b879feff80e14868026cb6161579aefe7fb97213aa0af27872f", "time_utc": "2026-08-02T00:11:49.365792Z"} +{"agent_id": "/root/v4_report_r050", "attempt": 1, "details": {"text_sha256": "80ecb14005c4401b3db35f99feead6419a5337aed39f70cfb85987533f92847b"}, "event": "reminder_sent", "phase": "collection", "previous_event_sha256": "8283fcc30729d45fec66d96fe7b9056af3c69a5ce357a98b536ec77c939844b5", "run_id": "r050", "schema_version": 1, "sequence": 321, "time_utc": "2026-08-02T00:12:41.376059Z"} +{"agent_id": "/root/v4_report_r049", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "6c93938208911e2885191734865170df553c05f0cb3de73d82100dfdb475d2d8", "run_id": "r049", "schema_version": 1, "sequence": 322, "sha256": "b643eae5008ca712f68308ce01fdee5e424db86855fdd4cd761cb1b9adac913e", "time_utc": "2026-08-02T00:14:24.855496Z"} +{"agent_id": "/root/v4_report_r049", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "8ecc200b2f49ba16186b22dbac743740634e9296577c4eb1f604e3aa25419628", "run_id": "r049", "schema_version": 1, "sequence": 323, "time_utc": "2026-08-02T00:14:24.857134Z"} +{"agent_id": "/root/v4_report_r049", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1322}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "08b5c194457c1db263233c8fe59f57c427c33d57a3d8d618f048e91c0352cd99", "run_id": "r049", "schema_version": 1, "sequence": 324, "sha256": "2704f92807aeb17dd1fc54a8fd5e62078d69443c921b458532bd1995e34738bf", "time_utc": "2026-08-02T00:14:24.858795Z"} +{"agent_id": "/root/v4_report_r050", "attempt": 1, "details": {"disposition": "COMPLETE"}, "event": "attempt_preserved", "phase": "collection", "previous_event_sha256": "70b6483dcd12a5a06955f416677ef14cb4528f41d248025c69554494c90a44b4", "run_id": "r050", "schema_version": 1, "sequence": 325, "sha256": "ea59a41276d3afa16f4dc6965a821b76663bbb164657bf56de6c658a9d738e96", "time_utc": "2026-08-02T00:19:05.211605Z"} +{"agent_id": "/root/v4_report_r050", "attempt": 1, "details": {"api_state": "COMPLETED"}, "event": "agent_returned", "phase": "collection", "previous_event_sha256": "972995657403ef14e81b5e0a81b6fd54f8d622cfe082e0a6a018ad2f050ad977", "run_id": "r050", "schema_version": 1, "sequence": 326, "time_utc": "2026-08-02T00:19:05.213397Z"} +{"agent_id": "/root/v4_report_r050", "attempt": 1, "details": {"disposition": "COMPLETE", "operational_scope_deviation": false, "within_word_cap": true, "word_count": 1578}, "event": "report_preserved", "phase": "collection", "previous_event_sha256": "0325b46e33becbf08333600a11026cd4229abe4e7dbe6e0e8812c7e8e70f6520", "run_id": "r050", "schema_version": 1, "sequence": 327, "sha256": "fad0c995d3639d93a74d17be5c17ee86615a76ffca5ae9b91756e8a77834b1fe", "time_utc": "2026-08-02T00:19:05.214980Z"} +{"details": {"report_count": 50}, "event": "collection_locked", "phase": "collection", "previous_event_sha256": "032b188b268ff6d1a3ac942437ae1593a746f1ff5539ff93971e2624d5264944", "schema_version": 1, "sequence": 328, "sha256": "3dcd484f59b67b0de4b3a17f04641bf0ed80094e59b1420f7ae4f3ef084d20bd", "time_utc": "2026-08-02T00:19:14.784669Z"} +{"details": {"mode": "P", "scorer": "s1"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "d2e860c002adb0884f8e5ea78c5e4ed0ec5b2f5a99e090fb3171b95fd0fe21ca", "schema_version": 1, "sequence": 329, "sha256": "9572ba6310f2ba36bf52c1506d8af7bc23b86fc630b795042e1aa27d04aed1c3", "time_utc": "2026-08-02T00:19:14.798630Z"} +{"details": {"mode": "P", "scorer": "s2"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "4c2d4769c2f31ceb7b7451bc4cb82c28a9b52cd6b74ad6231120dc4ee3062408", "schema_version": 1, "sequence": 330, "sha256": "4e436dd6ddf55ac96cc09a7d175fa02ad296fbf0f41458e86b9769119851b880", "time_utc": "2026-08-02T00:19:14.809884Z"} +{"details": {"mode": "B", "scorer": "s1"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "df2375fe324ed8879587abe89e3ad13eea9075cfba5439b80e2adad839569251", "schema_version": 1, "sequence": 331, "sha256": "d2a2885dd9f9d4377d3aca40571a9429952662bf751033963b05eaf6b292515c", "time_utc": "2026-08-02T00:19:14.821724Z"} +{"details": {"mode": "B", "scorer": "s2"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "2d5f2cf365741decba09a0fda2e80cf5c4f4ea42e4470a5393102c7f847489db", "schema_version": 1, "sequence": 332, "sha256": "40484b8b6b61a7835e3409f0c50c2023c7026491fc6f33ccfbd41d11f928bd73", "time_utc": "2026-08-02T00:19:14.833207Z"} +{"details": {"mode": "L", "scorer": "s1"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "f3262ab7cff0faed70471dc320516b580a484c3229c596fbcee6a2543853968e", "schema_version": 1, "sequence": 333, "sha256": "a63d08c8b17e6f9a05e8ca9c65bfeea75813b9ab005eef0466f6b904f61efa24", "time_utc": "2026-08-02T00:19:14.846561Z"} +{"details": {"mode": "L", "scorer": "s2"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "95e213024c763de2fe527c4329601656855b2c1b2b86579f3ba0da6dd5419e58", "schema_version": 1, "sequence": 334, "sha256": "5e3fe1603eb539dfc58ee822f1f3d02c862bd820717790f1fbd8841b88ad3fd1", "time_utc": "2026-08-02T00:19:14.855435Z"} +{"details": {"mode": "Q", "scorer": "s1"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "00e3d3600bd17bdff55270138af7fe3952ac2b30175003a88e067a1a4920ab65", "schema_version": 1, "sequence": 335, "sha256": "418ce57d0626b1211595f845c4f664871ec1ff9cfce6729c94dde09780e06eb7", "time_utc": "2026-08-02T00:19:14.865897Z"} +{"details": {"mode": "Q", "scorer": "s2"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "79be6fceb38b22cc32a3483207361b317aa5a9b2f2fc543524772af6a3a93ded", "schema_version": 1, "sequence": 336, "sha256": "634d7df5835eb9eb19ce5d22d3a36ef532550d7f8149104ee16fc3a953633a1b", "time_utc": "2026-08-02T00:19:14.876049Z"} +{"details": {"mode": "R", "scorer": "s1"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "7db6e5e8ae7fd4afa76a45a80a5ea4130b43e7766c9b847e5ab30e9fc99da4f7", "schema_version": 1, "sequence": 337, "sha256": "f2fd13517d31ee58205668eca898464350b393225742baab9b2dfcdcc5da8ba4", "time_utc": "2026-08-02T00:19:14.885298Z"} +{"details": {"mode": "R", "scorer": "s2"}, "event": "blind_packet_preserved", "phase": "scoring", "previous_event_sha256": "df75a9bd0fb6c80c4e2286d1d00a385019d80bbb01a0313cfc069103f704dfa9", "schema_version": 1, "sequence": 338, "sha256": "0799cf203d1a61001dd4628d72b5a7d6bbfc72757d7e795efea883c64547008b", "time_utc": "2026-08-02T00:19:14.894322Z"} +{"details": {"packet_count": 10}, "event": "blind_packets_built", "phase": "scoring", "previous_event_sha256": "b72968890cf8c700a3a872148b2cb0cf2f89a462a99ea30d67e807fa9010a242", "schema_version": 1, "sequence": 339, "sha256": "ed8daafbf160c3f651aa7f68bc1c53532b929cd2ffe50954b15d66d297e84574", "time_utc": "2026-08-02T00:19:14.896011Z"} +{"agent_id": "/root/v4_score_b_s2", "attempt": 1, "details": {"fork_turns": "none", "identity": "B-s2", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "df4d9ebfae4c28c74e590821c62144b195badd3fa6df38e0a0275a70bc07bf81", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "39b9af6228d8a1d2e5ad34a338bab1d8d1a6ee3efd2f7486cd3ce7e72e240fc1", "schema_version": 1, "sequence": 340, "time_utc": "2026-08-02T00:20:45.464155Z"} +{"agent_id": "/root/v4_score_p_s2", "attempt": 1, "details": {"fork_turns": "none", "identity": "P-s2", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "74183840a5f08260acc8b9eadcfd125bee029787466efd49e00501586d2d3bda", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "65815a83fbbb3a3cf4a094da9c5662903aaeda00c1cf847ff7e6decb5ec210c2", "schema_version": 1, "sequence": 341, "time_utc": "2026-08-02T00:21:17.856875Z"} +{"agent_id": "/root/v4_score_p_s1", "attempt": 1, "details": {"fork_turns": "none", "identity": "P-s1", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "30ea99e421e2821117ab52b8c121fe5f2ae21d68595a93c5f737dbd4fadf7cdf", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "6482183dee57cf426551116f9d84af91602d279f849312f090fa6f0e85c0ec27", "schema_version": 1, "sequence": 342, "time_utc": "2026-08-02T00:21:48.165628Z"} +{"agent_id": "/root/v4_score_p_s1", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "P-s1", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "d21e82187d6d6fbf15c937a0ae6a4b473341ba9b8020fdd7ee5b4bc3738bc43f", "schema_version": 1, "sequence": 343, "sha256": "8d9bd72d15089be74b9b276b9d7f65d42b24e53cfac125b02bd76469741cf3e3", "time_utc": "2026-08-02T00:34:32.227558Z"} +{"agent_id": "/root/v4_score_p_s1", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "P-s1", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "c177fa1dc129aaa8b40c15795cff1b9c4d081723dab75b52fc24cf6ac44061a7", "schema_version": 1, "sequence": 344, "time_utc": "2026-08-02T00:34:32.233592Z"} +{"agent_id": "/root/v4_score_p_s1", "attempt": 1, "details": {"mode": "P", "scorer": "s1"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "5cf04b8a3cbe005b7a43dec1ee3b544aa575178ab7cff7cc531e1bcd144fedf3", "schema_version": 1, "sequence": 345, "sha256": "98b837424d1eacde07a4d82a2c92a9697f680780bfe06056ae5015a4a067c764", "time_utc": "2026-08-02T00:34:32.235261Z"} +{"agent_id": "/root/v4_score_r_s2", "attempt": 1, "details": {"fork_turns": "none", "identity": "R-s2", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "9ea87b121d7d2cbdc42e0b4ff2b831a1251f88222d16280a7c42ac802c8aafe4", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "26d0b7841c89a3b586546c82f4dea27d449819ab15d5d9f69f6b203d8ba754dd", "schema_version": 1, "sequence": 346, "time_utc": "2026-08-02T00:34:56.942966Z"} +{"agent_id": "/root/v4_score_p_s2", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "P-s2", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "f8aee87e3145b3597241f9e067c6a1e108ef749602d29659d2a0f77d9f743d60", "schema_version": 1, "sequence": 347, "sha256": "904d51dc3b3f89949549d56c3284be633e1beb02fc41d26c74d415c9ddde8058", "time_utc": "2026-08-02T00:36:40.487996Z"} +{"agent_id": "/root/v4_score_p_s2", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "P-s2", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "6d57e0e953a0101b77be64f55ba03912fc9c8ae5a09bcec9033cc6725fe5c576", "schema_version": 1, "sequence": 348, "time_utc": "2026-08-02T00:36:40.491756Z"} +{"agent_id": "/root/v4_score_p_s2", "attempt": 1, "details": {"mode": "P", "scorer": "s2"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "4855f2ef4e85c61377e14fed2083f159b8fbeda662a029403a8779823a503204", "schema_version": 1, "sequence": 349, "sha256": "040fcb90b1466aa92a9609e415f8030300535af6c5555b4e43c34c822e1ba243", "time_utc": "2026-08-02T00:36:40.493619Z"} +{"agent_id": "/root/v4_score_q_s2", "attempt": 1, "details": {"fork_turns": "none", "identity": "Q-s2", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "523db0598f6fe168dca615b886ed766e78ff8a6eed1dfb2efeb8a300321e7a05", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "6525cc4a5ac3d744466f35d86c84cb16706a19d68b07a42a9f99f538d68e6a39", "schema_version": 1, "sequence": 350, "time_utc": "2026-08-02T00:37:09.510205Z"} +{"agent_id": "/root/v4_score_b_s2", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "B-s2", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "f5a920aff64e7cc50d502fd2a9aa95bb0ea3ea7e9460214da165a9c277df88e2", "schema_version": 1, "sequence": 351, "sha256": "ee8da1f5cee4963486e4b85ff972fd341a3ea43a19b0f39de3a790f8feebbb00", "time_utc": "2026-08-02T00:37:18.256196Z"} +{"agent_id": "/root/v4_score_b_s2", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "B-s2", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "4b6e0320f3bfee0370bdbbc315d071d2392ec17722a24f114fa524aa434d55c5", "schema_version": 1, "sequence": 352, "time_utc": "2026-08-02T00:37:18.260147Z"} +{"agent_id": "/root/v4_score_b_s2", "attempt": 1, "details": {"mode": "B", "scorer": "s2"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "396496dc8783bb1b2293c17d4d9b62a2fdd663b3fd12dfd49cf9a837c8b90e69", "schema_version": 1, "sequence": 353, "sha256": "f3be21eb3a23aca4f0f6fe5b50548fbbb7c7716734ecd31ae4f9b2ace2196b8c", "time_utc": "2026-08-02T00:37:18.261882Z"} +{"agent_id": "/root/v4_score_l_s2", "attempt": 1, "details": {"fork_turns": "none", "identity": "L-s2", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "d13f0464231b6ece91af2ff989bd68b3ca2ea37d10054c3b09bdd9fec25aa0fb", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "978d40116aec97fee663106b6156299c7ebf6326c0568612da3f308fb98c2344", "schema_version": 1, "sequence": 354, "time_utc": "2026-08-02T00:37:41.450365Z"} +{"agent_id": "/root/v4_score_q_s2", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "Q-s2", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "b19279f2d9be8948d9f81ef38893101d2e200c9332fc5bd5a37c4dd8b276b34e", "schema_version": 1, "sequence": 355, "sha256": "911f93a8c316e27913e900f7d18cda3871150005b1e9ad6f48530e7d4f070ead", "time_utc": "2026-08-02T00:42:53.973658Z"} +{"agent_id": "/root/v4_score_q_s2", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "Q-s2", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "4eaf720cae6eefba8f331285c4b31b14afd73d8fb3d976fb1b05ee54156b96fe", "schema_version": 1, "sequence": 356, "time_utc": "2026-08-02T00:42:53.978257Z"} +{"agent_id": "/root/v4_score_q_s2", "attempt": 1, "details": {"mode": "Q", "scorer": "s2"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "c9112ff6d59d795ef56997cabc0daf5439e71acf217b1a657d5a2ec4c9d263cf", "schema_version": 1, "sequence": 357, "sha256": "33efb931c53a108e1ce6f6d396e88e382f64a70e00ce6f8478ab8b42378c3e98", "time_utc": "2026-08-02T00:42:53.979973Z"} +{"agent_id": "/root/v4_score_l_s1", "attempt": 1, "details": {"fork_turns": "none", "identity": "L-s1", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "ebed4792a8868a561e3b404f2ac8efe15ac6c31f08e9f3607964afdf7cfb33b8", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "44fba60f1a67707c810d29b5ea4d6f5d35f8c61c833386462a767fa2784382bd", "schema_version": 1, "sequence": 358, "time_utc": "2026-08-02T00:43:20.687498Z"} +{"agent_id": "/root/v4_score_r_s2", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "R-s2", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "d4b02d06bf082bb3faddd5b1e2df608e1c592b4468f217651bf5e892beee9f47", "schema_version": 1, "sequence": 359, "sha256": "0480e6d09e4ab926a8b6a73412b289070d763093431886165f5d80e7a2c0ab70", "time_utc": "2026-08-02T00:44:19.985414Z"} +{"agent_id": "/root/v4_score_r_s2", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "R-s2", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "26c833a63e0f09cafc1751cd36d183dc4b654166e7e6f67b0d380009d33221ef", "schema_version": 1, "sequence": 360, "time_utc": "2026-08-02T00:44:19.988999Z"} +{"agent_id": "/root/v4_score_r_s2", "attempt": 1, "details": {"mode": "R", "scorer": "s2"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "c19e3b8d8331de5be47d4381348bf73b714889df9d21505e04e76aaca81d118b", "schema_version": 1, "sequence": 361, "sha256": "ad35d444b56e37377ddc62292f8aaae8924127adc72f8f4c970ae2b54526832f", "time_utc": "2026-08-02T00:44:19.990984Z"} +{"agent_id": "/root/v4_score_r_s1", "attempt": 1, "details": {"fork_turns": "none", "identity": "R-s1", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "d4cebb1cbbc2cf57f7703dea8cc9e70c66db4680132f519d4cf84deee2e920a0", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "065341ee063c0f9444ec62c35e4a25b40e6ab3b17feef337c6097a8b97708631", "schema_version": 1, "sequence": 362, "time_utc": "2026-08-02T00:44:44.785092Z"} +{"agent_id": "/root/v4_score_l_s2", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "L-s2", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "0a64ba3367fba41076205a4e0941f7a263ea05b5493e2ee8b7047b30cb9cfa11", "schema_version": 1, "sequence": 363, "sha256": "f23659ae2b47a0885475d2ddcc1961d403733ce36090376e55a3ef6da2f1ad7a", "time_utc": "2026-08-02T00:51:44.008345Z"} +{"agent_id": "/root/v4_score_l_s2", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "L-s2", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "6568989575709a86cedf1a9b4f8bae81e018fbbd1f9c9db5dc00c9941af23526", "schema_version": 1, "sequence": 364, "time_utc": "2026-08-02T00:51:44.011994Z"} +{"agent_id": "/root/v4_score_l_s2", "attempt": 1, "details": {"mode": "L", "scorer": "s2"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "ee5e898f45196431699bcf791f88380a718010e69a3ab448b0ab810a32f8bf06", "schema_version": 1, "sequence": 365, "sha256": "99564b83ed633e6194dbb67918706172806638a651a800fc3a7d5d939c99d479", "time_utc": "2026-08-02T00:51:44.013824Z"} +{"agent_id": "/root/v4_score_b_s1", "attempt": 1, "details": {"fork_turns": "none", "identity": "B-s1", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "acbcc9090744fa3942f6f8206d996c84d488f68fd1e2dbd28e93df2acd4bd4c3", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "e9f8fefaf23c42d59063ef3b58fe7d943824fad4635dfcf27e9cf9e9e65a84b9", "schema_version": 1, "sequence": 366, "time_utc": "2026-08-02T00:52:05.654600Z"} +{"agent_id": "/root/v4_score_r_s1", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "R-s1", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "976a20f093866e546e2c615ba3b1f878efb44bec6442f7e066940dc3fe291f05", "schema_version": 1, "sequence": 367, "sha256": "ab426ee703c7801e2cff9f48d048beb6a5df66a5475dc737457170f4d3fd3f26", "time_utc": "2026-08-02T00:54:20.563841Z"} +{"agent_id": "/root/v4_score_r_s1", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "R-s1", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "b02ac89a57365cddbb6c4c0af2c4cb075b4f92ce98dbc0ece20ab4346febc5ce", "schema_version": 1, "sequence": 368, "time_utc": "2026-08-02T00:54:20.567552Z"} +{"agent_id": "/root/v4_score_r_s1", "attempt": 1, "details": {"mode": "R", "scorer": "s1"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "8baf2a4d296724582992bfc79fefe6f6d596846984b7e7d727e28f2638e756e0", "schema_version": 1, "sequence": 369, "sha256": "18ace2d3d6ffc4b2ba1aa686a459a387258b03d0e321d46c6f34548af3ba67a9", "time_utc": "2026-08-02T00:54:20.570179Z"} +{"agent_id": "/root/v4_score_q_s1", "attempt": 1, "details": {"fork_turns": "none", "identity": "Q-s1", "kind": "scorer", "model": "gpt-5.6-sol", "prompt_sha256": "c92065dc6619d2c560d3ac04f46621c59b08508d6242a51d39b1ab6964bedfa5", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "scoring", "previous_event_sha256": "96268ddcad25c0acc02fd3179ebc573695621238cdad5e6dca0216bcc45c0453", "schema_version": 1, "sequence": 370, "time_utc": "2026-08-02T00:54:49.137930Z"} +{"agent_id": "/root/v4_score_q_s1", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "Q-s1", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "17b8fcfc9d09c5fe32c80d3f6241edef89cb13290b9a58e1b788e06db244a200", "schema_version": 1, "sequence": 371, "sha256": "220b02a819ed4799c19e7c688be56e072a6ce2377a836b4a830759e1dc433bab", "time_utc": "2026-08-02T01:00:40.514899Z"} +{"agent_id": "/root/v4_score_q_s1", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "Q-s1", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "1e3c75b3c7ca27d5c1a49d1507ae17ef934c28803d2ff52e68f900a8c42609ba", "schema_version": 1, "sequence": 372, "time_utc": "2026-08-02T01:00:40.518574Z"} +{"agent_id": "/root/v4_score_q_s1", "attempt": 1, "details": {"mode": "Q", "scorer": "s1"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "501b4575df7f6d37f57b8564bed5af012a1291ec41734c717bc138829b25c7fe", "schema_version": 1, "sequence": 373, "sha256": "f0a834ba924f88ce435031c3c3e30ec2aee1cb2d24b09eb032bc8fd861b508e0", "time_utc": "2026-08-02T01:00:40.520177Z"} +{"agent_id": "/root/v4_score_l_s1", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "L-s1", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "0d3e9114b8e3359568d2601f252311281798c5237b0de252cbbc873cfa68a232", "schema_version": 1, "sequence": 374, "sha256": "2a23d68dc047abc18a797aad364240305f4a803e6107a38812af54cb124866a6", "time_utc": "2026-08-02T01:00:50.971244Z"} +{"agent_id": "/root/v4_score_l_s1", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "L-s1", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "71e9dbd90fb713ed2ee4ead8564a3b299d81074c4d984f1fc067086cef9cc74e", "schema_version": 1, "sequence": 375, "time_utc": "2026-08-02T01:00:50.974994Z"} +{"agent_id": "/root/v4_score_l_s1", "attempt": 1, "details": {"mode": "L", "scorer": "s1"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "d3e731804f19246302455612396f1aedd66d07c48148500bd0265b6768ab21d3", "schema_version": 1, "sequence": 376, "sha256": "87526ee57cfbfc1982ea9fdf0470262453682430fc4fe0193d26e7c0c0fc317b", "time_utc": "2026-08-02T01:00:50.976623Z"} +{"agent_id": "/root/v4_score_b_s1", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "B-s1", "kind": "scorer"}, "event": "evaluator_attempt_preserved", "phase": "scoring", "previous_event_sha256": "31caea2c9643bc973e6c686263a47ae6554b11755796150aa8e472ffea3cb72a", "schema_version": 1, "sequence": 377, "sha256": "5d38f59ccbcdde23532735468aabbd3bb02a778da81a7ab49cea2f1f3b432117", "time_utc": "2026-08-02T01:19:55.127897Z"} +{"agent_id": "/root/v4_score_b_s1", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "B-s1", "kind": "scorer"}, "event": "evaluator_returned", "phase": "scoring", "previous_event_sha256": "f672845738496169329835d427f09379e04657782fcbe47d6f2dfeacf5a8babd", "schema_version": 1, "sequence": 378, "time_utc": "2026-08-02T01:19:55.131672Z"} +{"agent_id": "/root/v4_score_b_s1", "attempt": 1, "details": {"mode": "B", "scorer": "s1"}, "event": "score_preserved", "phase": "scoring", "previous_event_sha256": "5d99490befd54a4fc15a5ad87f26d3c3dd08904291347bbcdb474cab32aeea41", "schema_version": 1, "sequence": 379, "sha256": "68aa251dab96542fd092f97d4de606a072ff2e0f77f107c5ed25a91d01960d0d", "time_utc": "2026-08-02T01:19:55.133562Z"} +{"details": {"mode": "L", "source_score_packet_sha256": "a63d08c8b17e6f9a05e8ca9c65bfeea75813b9ab005eef0466f6b904f61efa24"}, "event": "consistency_packet_preserved", "phase": "consistency", "previous_event_sha256": "edeb738baa9320a5f6c5f18d7d041cbd1fda122cd97e0d6f6463ae1a3899de6b", "schema_version": 1, "sequence": 380, "sha256": "b26b31bb5245b6efa308aca851520ad37efd911c4cdb1e9087993a50ded652d0", "time_utc": "2026-08-02T01:20:12.750656Z"} +{"details": {"mode": "Q", "source_score_packet_sha256": "418ce57d0626b1211595f845c4f664871ec1ff9cfce6729c94dde09780e06eb7"}, "event": "consistency_packet_preserved", "phase": "consistency", "previous_event_sha256": "95d04a234dc06ba2e7307e0e8cf3b6d512710edae1feb895363cbaa0d068cc77", "schema_version": 1, "sequence": 381, "sha256": "099b5625f96e8ee040697ba067361a2e30986529cf2d0404f1f9d2c43cacc60c", "time_utc": "2026-08-02T01:20:13.009026Z"} +{"details": {"mode": "B", "source_score_packet_sha256": "d2a2885dd9f9d4377d3aca40571a9429952662bf751033963b05eaf6b292515c"}, "event": "consistency_packet_preserved", "phase": "consistency", "previous_event_sha256": "ac2c1d66b7efb562cc7a58ad53f53672ed462003e1f1d3b70a94246aa7485958", "schema_version": 1, "sequence": 382, "sha256": "de725d8c4c1ed4c2c6266f2947755fb91471ab38564f1481e312b73b7402c5e6", "time_utc": "2026-08-02T01:20:13.269134Z"} +{"details": {"mode": "P", "source_score_packet_sha256": "9572ba6310f2ba36bf52c1506d8af7bc23b86fc630b795042e1aa27d04aed1c3"}, "event": "consistency_packet_preserved", "phase": "consistency", "previous_event_sha256": "05ebeba6df0cd130904670ee2c3382983eccc159a2020f133efcb728c863b242", "schema_version": 1, "sequence": 383, "sha256": "1c88aa59d92afeed0a0d3670e030a148af62e797402932d9f3836b58791cb4af", "time_utc": "2026-08-02T01:20:13.531279Z"} +{"details": {"mode": "R", "source_score_packet_sha256": "f2fd13517d31ee58205668eca898464350b393225742baab9b2dfcdcc5da8ba4"}, "event": "consistency_packet_preserved", "phase": "consistency", "previous_event_sha256": "a642151d19257ff16b2a09ecbee5af4a0c18dbf72817c4f46631a4c62e03c06b", "schema_version": 1, "sequence": 384, "sha256": "14cd102b127fca7ec5d82aa7fe9a0ed736cd4bb9755cf65bae819273a91234d4", "time_utc": "2026-08-02T01:20:13.785756Z"} +{"agent_id": "/root/v4_consistency_l", "attempt": 1, "details": {"fork_turns": "none", "identity": "L", "kind": "consistency", "model": "gpt-5.6-sol", "prompt_sha256": "55b4cdaa2d5f4ecd33fc97bee7311148f5b9a8bd1653dd3467d109883637840e", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "consistency", "previous_event_sha256": "96e91a51c0f634f3c73346af8bcd0349896414843638fa6d891f782bfd743173", "schema_version": 1, "sequence": 385, "time_utc": "2026-08-02T01:20:51.301801Z"} +{"agent_id": "/root/v4_consistency_q", "attempt": 1, "details": {"fork_turns": "none", "identity": "Q", "kind": "consistency", "model": "gpt-5.6-sol", "prompt_sha256": "9bc1f8f3d5af3db56c2d515eb209487211b9355c005bb0e6b5657f9a00060adf", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "consistency", "previous_event_sha256": "9b0e52fa7f11dadcb01823ae2cc323a25b60245f50d8dbf030a6b2cf2eacbf29", "schema_version": 1, "sequence": 386, "time_utc": "2026-08-02T01:21:16.268963Z"} +{"agent_id": "/root/v4_consistency_b", "attempt": 1, "details": {"fork_turns": "none", "identity": "B", "kind": "consistency", "model": "gpt-5.6-sol", "prompt_sha256": "804f253cd4b7281323a4bd70a29778000442112f0187e6f384483afa44e46207", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "consistency", "previous_event_sha256": "a52861ad1a9212a70599b508c037e34eac1559a7a4c5b04230a4d73ba2f250a1", "schema_version": 1, "sequence": 387, "time_utc": "2026-08-02T01:21:50.229777Z"} +{"agent_id": "/root/v4_consistency_q", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "Q", "kind": "consistency"}, "event": "evaluator_attempt_preserved", "phase": "consistency", "previous_event_sha256": "b19de73013b05bc17bcb205b6dde745ceb2bef6880f3dfd09d0f9439529d410a", "schema_version": 1, "sequence": 388, "sha256": "06e5f264b7e0bc1c66f173599e315af68b7301a8ce5bc2c5f940f9d28f9d4b14", "time_utc": "2026-08-02T01:26:05.621266Z"} +{"agent_id": "/root/v4_consistency_q", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "Q", "kind": "consistency"}, "event": "evaluator_returned", "phase": "consistency", "previous_event_sha256": "78cf1aee2fe1b4db1be86357e6d4f72d44cb500e1f2a4b25d8cccd518ffd46bc", "schema_version": 1, "sequence": 389, "time_utc": "2026-08-02T01:26:05.624746Z"} +{"agent_id": "/root/v4_consistency_q", "attempt": 1, "details": {"mode": "Q"}, "event": "consistency_review_preserved", "phase": "consistency", "previous_event_sha256": "643ea26485b5062890e438cc54511cde09659b9186b378f3289f159eb2c919c1", "schema_version": 1, "sequence": 390, "sha256": "460b7df3a9d496bf9a6c1b3e3b5c44ca77c75915cb817e0c360390605e5bc521", "time_utc": "2026-08-02T01:26:05.626606Z"} +{"agent_id": "/root/v4_consistency_p", "attempt": 1, "details": {"fork_turns": "none", "identity": "P", "kind": "consistency", "model": "gpt-5.6-sol", "prompt_sha256": "1f57297bab8b40131819a2ba84d91ff98c984da611da35fefea42a6528859ef1", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "consistency", "previous_event_sha256": "20af490b2b6c41264c0337acc3b1f8d2c402bf3033495d4fe6a4c3cb249e1a33", "schema_version": 1, "sequence": 391, "time_utc": "2026-08-02T01:26:35.190168Z"} +{"agent_id": "/root/v4_consistency_p", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "P", "kind": "consistency"}, "event": "evaluator_attempt_preserved", "phase": "consistency", "previous_event_sha256": "50787380767a141a1c96b963f9c3dfd4f21ee3037e09aab06140236c7b52407f", "schema_version": 1, "sequence": 392, "sha256": "b4f7baa8e4f120b305967b9a5f6bb06a0578fca22928daa9670e07da9a1efd4a", "time_utc": "2026-08-02T01:33:48.222930Z"} +{"agent_id": "/root/v4_consistency_p", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "P", "kind": "consistency"}, "event": "evaluator_returned", "phase": "consistency", "previous_event_sha256": "402d02ebc5f981d72445f4c71038f6f1aae4a60cf4803f91bb1e7b7be8dc9cef", "schema_version": 1, "sequence": 393, "time_utc": "2026-08-02T01:33:48.226640Z"} +{"agent_id": "/root/v4_consistency_p", "attempt": 1, "details": {"mode": "P"}, "event": "consistency_review_preserved", "phase": "consistency", "previous_event_sha256": "d63d5260174415ad922a1ed627bae12880ef8fc1c01b4a1a3494e63848561e09", "schema_version": 1, "sequence": 394, "sha256": "9f4eb035e7c6d6bedd98431f3bdc0bf6453dff7eb0fc5b64339bcb52cf4a1372", "time_utc": "2026-08-02T01:33:48.228535Z"} +{"agent_id": "/root/v4_consistency_r", "attempt": 1, "details": {"fork_turns": "none", "identity": "R", "kind": "consistency", "model": "gpt-5.6-sol", "prompt_sha256": "594b0b574c5084e5b8be4dd7b52570b20d689b4e95c3a0b34221f7feeb31d7ea", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "consistency", "previous_event_sha256": "73f58bc5aa21e480b2e067281d5fd74d7fb8f6e9385a3b38492bec16ff1dfe87", "schema_version": 1, "sequence": 395, "time_utc": "2026-08-02T01:34:15.899001Z"} +{"agent_id": "/root/v4_consistency_l", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "L", "kind": "consistency"}, "event": "evaluator_attempt_preserved", "phase": "consistency", "previous_event_sha256": "805fad31f5f432cd41218241b00926c5cc647dc1c172c412c5c478b21f68caed", "schema_version": 1, "sequence": 396, "sha256": "2963fd1384e9c18416c2422838bc1de30ff236cbf817369943b1237fe38e77ea", "time_utc": "2026-08-02T01:35:10.751582Z"} +{"agent_id": "/root/v4_consistency_l", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "L", "kind": "consistency"}, "event": "evaluator_returned", "phase": "consistency", "previous_event_sha256": "809eae5b6b982a252630fb940d768748e93ae13d57aeefd48c9f59b238d27273", "schema_version": 1, "sequence": 397, "time_utc": "2026-08-02T01:35:10.755436Z"} +{"agent_id": "/root/v4_consistency_l", "attempt": 1, "details": {"mode": "L"}, "event": "consistency_review_preserved", "phase": "consistency", "previous_event_sha256": "ad4e1361af0d2076032c84d96aa85a4c6e5be95d5709e5f22be465f3dd62f2a1", "schema_version": 1, "sequence": 398, "sha256": "b0d6538a142c385651ccbae0bd29176fedbdca3db1cb1c02817e258b11d1bde3", "time_utc": "2026-08-02T01:35:10.757201Z"} +{"agent_id": "/root/v4_consistency_b", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "B", "kind": "consistency"}, "event": "evaluator_attempt_preserved", "phase": "consistency", "previous_event_sha256": "c46fa88fb1162cdf2c2879979514fc96db00f5f0d617be1ed5d708ca2119a3a5", "schema_version": 1, "sequence": 399, "sha256": "23f50ed4c121c267a100d461c7eee88ddcdedb03fbb45a560f758370831e919b", "time_utc": "2026-08-02T01:36:43.031173Z"} +{"agent_id": "/root/v4_consistency_b", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "B", "kind": "consistency"}, "event": "evaluator_returned", "phase": "consistency", "previous_event_sha256": "66a02ffcf50764a41f96f45c955fa9cb57b378aaca43441419b5f7b95dfaa3b1", "schema_version": 1, "sequence": 400, "time_utc": "2026-08-02T01:36:43.037447Z"} +{"agent_id": "/root/v4_consistency_b", "attempt": 1, "details": {"mode": "B"}, "event": "consistency_review_preserved", "phase": "consistency", "previous_event_sha256": "7671b642d0d087d7dacb6c44d632c45312498471d5a5b1e3387e56acf2a1781d", "schema_version": 1, "sequence": 401, "sha256": "c102e88e1276a6dde4bf0f7a6e0cf94c227279bff0ff3b5ddbbae3af6da1fbb4", "time_utc": "2026-08-02T01:36:43.039617Z"} +{"agent_id": "/root/v4_consistency_r", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "R", "kind": "consistency"}, "event": "evaluator_attempt_preserved", "phase": "consistency", "previous_event_sha256": "8c0829fd4539407f5adaf2d36426d3cff3e9b5980289c873f08db1bbce3cdf5f", "schema_version": 1, "sequence": 402, "sha256": "5b3790be3fbefc7f5df9b05adcbf40c4ca5413760184365671a405bce5d7fe71", "time_utc": "2026-08-02T01:41:38.198035Z"} +{"agent_id": "/root/v4_consistency_r", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "R", "kind": "consistency"}, "event": "evaluator_returned", "phase": "consistency", "previous_event_sha256": "5f07f92aeb78589b734937069369565c8386384d8de6dca834b2ee05d791fe24", "schema_version": 1, "sequence": 403, "time_utc": "2026-08-02T01:41:38.201640Z"} +{"agent_id": "/root/v4_consistency_r", "attempt": 1, "details": {"mode": "R"}, "event": "consistency_review_preserved", "phase": "consistency", "previous_event_sha256": "21b28d4774fbab2229ca52214f8689a0f9e96781de3f159aa2ed2c5f616d8ae5", "schema_version": 1, "sequence": 404, "sha256": "1418b5c85bfbde5a2ba6ae156bd8728fb23b95e2203704e6bb98ff53dc928ec2", "time_utc": "2026-08-02T01:41:38.203405Z"} +{"details": {"count": 6, "mode": "P"}, "event": "adjudication_cells_materialized", "phase": "adjudication", "previous_event_sha256": "4036da3e66a8e5d76c2052163e0f9f3d30107fda240bcb707fd86e57c7fdcab0", "schema_version": 1, "sequence": 405, "sha256": "15aa3813405931934d064e2fdea00f06c51399168c4deec0113e4b6a79a18c7e", "time_utc": "2026-08-02T01:41:59.308634Z"} +{"details": {"count": 153, "mode": "B"}, "event": "adjudication_cells_materialized", "phase": "adjudication", "previous_event_sha256": "aa8025b0e4ceb86595d3dd600cb91098f9929e73ec305cd9e43a377ce113c6e1", "schema_version": 1, "sequence": 406, "sha256": "d18e3fece657958c3fb7a4d8571da7bbedaf4083febc04e3cacc305dc81f4316", "time_utc": "2026-08-02T01:41:59.609771Z"} +{"details": {"count": 36, "mode": "L"}, "event": "adjudication_cells_materialized", "phase": "adjudication", "previous_event_sha256": "280ac5ddf96afabdf6bc07b6c3bf1535a6452430f97ee46a6bc6e138aff0449e", "schema_version": 1, "sequence": 407, "sha256": "4dfc98a2fc915b489b9657cc6a85cd5a76525bc0e784e2d9be9b36f48be8ce42", "time_utc": "2026-08-02T01:41:59.862987Z"} +{"details": {"count": 0, "mode": "Q"}, "event": "adjudication_cells_materialized", "phase": "adjudication", "previous_event_sha256": "6b6c86b63def18bfdc98a2c9129e87bbfa6c541cf8ee0dc2e208866d574bd342", "schema_version": 1, "sequence": 408, "sha256": "49778d2e872a62d3cc55308439e6580b5ebc6d6da497300f29b03a9d5e50a764", "time_utc": "2026-08-02T01:42:00.120036Z"} +{"details": {"count": 20, "mode": "R"}, "event": "adjudication_cells_materialized", "phase": "adjudication", "previous_event_sha256": "fd51476a4e134ee1986362c20753c318f98197792b75fc4a0bac47b75b526c20", "schema_version": 1, "sequence": 409, "sha256": "ec0b95e018171e6c9884bce99c6bfaad3272db6732129a54b8bb813e4b2fcf85", "time_utc": "2026-08-02T01:42:00.372724Z"} +{"details": {"consistency_review_sha256": "9f4eb035e7c6d6bedd98431f3bdc0bf6453dff7eb0fc5b64339bcb52cf4a1372", "mode": "P", "source_score_packet_sha256": "9572ba6310f2ba36bf52c1506d8af7bc23b86fc630b795042e1aa27d04aed1c3"}, "event": "adjudication_packet_preserved", "phase": "adjudication", "previous_event_sha256": "3cc613b98eb92e72c7e3e2f93a238349ec88c7fd0c10abcdc8e6455efe47ace0", "schema_version": 1, "sequence": 410, "sha256": "69389df1c33d2ddc46cfc04358c942978d89e33671ec572f462ac10e95b4e661", "time_utc": "2026-08-02T01:42:07.832627Z"} +{"details": {"consistency_review_sha256": "c102e88e1276a6dde4bf0f7a6e0cf94c227279bff0ff3b5ddbbae3af6da1fbb4", "mode": "B", "source_score_packet_sha256": "d2a2885dd9f9d4377d3aca40571a9429952662bf751033963b05eaf6b292515c"}, "event": "adjudication_packet_preserved", "phase": "adjudication", "previous_event_sha256": "4f3ad767af7cf2449a42f9b1a0187996bbd2f6ad7eef79c82923662d21968dec", "schema_version": 1, "sequence": 411, "sha256": "ac6643a1bb9fc27ef30dab96534de97eb718f76854cd1c81231d849fab797391", "time_utc": "2026-08-02T01:42:08.095233Z"} +{"details": {"consistency_review_sha256": "b0d6538a142c385651ccbae0bd29176fedbdca3db1cb1c02817e258b11d1bde3", "mode": "L", "source_score_packet_sha256": "a63d08c8b17e6f9a05e8ca9c65bfeea75813b9ab005eef0466f6b904f61efa24"}, "event": "adjudication_packet_preserved", "phase": "adjudication", "previous_event_sha256": "8f3a4f9a6590154b38cf6c0d6ba5dd9330f7f70740dc52976597e0182ed4310b", "schema_version": 1, "sequence": 412, "sha256": "74316b16f70d979b393e3981da13326794bd3948c0f783d0f830435cf98eb542", "time_utc": "2026-08-02T01:42:08.350536Z"} +{"details": {"consistency_review_sha256": "1418b5c85bfbde5a2ba6ae156bd8728fb23b95e2203704e6bb98ff53dc928ec2", "mode": "R", "source_score_packet_sha256": "f2fd13517d31ee58205668eca898464350b393225742baab9b2dfcdcc5da8ba4"}, "event": "adjudication_packet_preserved", "phase": "adjudication", "previous_event_sha256": "ac8b1eda675f99d12f803342d964b8cd124662e0099f207ade01e0d2dab0c9f7", "schema_version": 1, "sequence": 413, "sha256": "0aaaaaaed1d02f5ac30f955fd518fc14f6398bdcf5e90ffbb51bfa08930e03eb", "time_utc": "2026-08-02T01:42:08.605435Z"} +{"details": {"mode": "Q"}, "event": "final_blind_score_locked", "phase": "adjudication", "previous_event_sha256": "3c939cb59e736630b360ad30564f1d0c546ef8b81bb15711367ebcafacf509c6", "schema_version": 1, "sequence": 414, "sha256": "ac39b01aeb020d54d50a2cc5eefa0a7a9d155acfb8745195d0a46e77fd421e7b", "time_utc": "2026-08-02T01:42:13.994069Z"} +{"agent_id": "/root/v4_adjudicate_p", "attempt": 1, "details": {"fork_turns": "none", "identity": "P", "kind": "adjudicator", "model": "gpt-5.6-sol", "prompt_sha256": "f6e7e4e7d5705705f430649a1b3454395d34700afdc86f901b3f7376b4d133e1", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "adjudication", "previous_event_sha256": "571d15882fd07b32309cca238672e0f4eb4c1d2fe2c34dce297cfd343fd39263", "schema_version": 1, "sequence": 415, "time_utc": "2026-08-02T01:42:56.770654Z"} +{"agent_id": "/root/v4_adjudicate_b", "attempt": 1, "details": {"fork_turns": "none", "identity": "B", "kind": "adjudicator", "model": "gpt-5.6-sol", "prompt_sha256": "f7af9beb004480a74bf6dcccfc6088a0f6a68b89c529f48e4e9b5e37e0c4a887", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "adjudication", "previous_event_sha256": "282c854a123a348b59ed316df906c9ee28aab71e48c970e5132c86b7d67bb8a0", "schema_version": 1, "sequence": 416, "time_utc": "2026-08-02T01:43:22.305742Z"} +{"agent_id": "/root/v4_adjudicate_l", "attempt": 1, "details": {"fork_turns": "none", "identity": "L", "kind": "adjudicator", "model": "gpt-5.6-sol", "prompt_sha256": "9b9cad28d1cc87575417872ece765d7ce4a4c4c933672c652ffe23423c4b5e82", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "adjudication", "previous_event_sha256": "723dd5e4532982ad1bcb3e828614c5a5958b0fea4d35056ced30fbae934665de", "schema_version": 1, "sequence": 417, "time_utc": "2026-08-02T01:43:53.209139Z"} +{"agent_id": "/root/v4_adjudicate_p", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "P", "kind": "adjudicator"}, "event": "evaluator_attempt_preserved", "phase": "adjudication", "previous_event_sha256": "7e7f3674fa1d9a202066a9d272b0d0aa1e8adb0a019712d7c8bef08902858451", "schema_version": 1, "sequence": 418, "sha256": "574b9d49894130b1eb6fa049927c088d3eeb318150114caa26235a36700a14b6", "time_utc": "2026-08-02T01:46:15.583646Z"} +{"agent_id": "/root/v4_adjudicate_p", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "P", "kind": "adjudicator"}, "event": "evaluator_returned", "phase": "adjudication", "previous_event_sha256": "fd3f203e981058c64810a82441351689bf15b1b8e1fa43b2dccbfc840026de66", "schema_version": 1, "sequence": 419, "time_utc": "2026-08-02T01:46:15.587760Z"} +{"agent_id": "/root/v4_adjudicate_p", "attempt": 1, "details": {"mode": "P"}, "event": "adjudication_preserved", "phase": "adjudication", "previous_event_sha256": "8e9a40ac2dccb8b42f2afe5b8f44b7f5e1d57e892e3244ce1bea20949168db69", "schema_version": 1, "sequence": 420, "sha256": "b10a254798f7f99d3668e10943d6dcd70123d3ad5f51de4c67e571017af2f1af", "time_utc": "2026-08-02T01:46:15.589526Z"} +{"details": {"mode": "P"}, "event": "final_blind_score_locked", "phase": "adjudication", "previous_event_sha256": "6c274ddbc402b026d03717a03d663431eef10dba61a6e9c9a26bc8e6857b6b08", "schema_version": 1, "sequence": 421, "sha256": "03ed2a9cab7cf45702bac4b9319c979e14ed63e854ae4d29fccfe3c780d2e290", "time_utc": "2026-08-02T01:46:21.467410Z"} +{"agent_id": "/root/v4_adjudicate_r", "attempt": 1, "details": {"fork_turns": "none", "identity": "R", "kind": "adjudicator", "model": "gpt-5.6-sol", "prompt_sha256": "a5fea0413abd1333d0e096cc5f06a56d96066456072f2391f0370edb8441d302", "reasoning_effort": "ultra"}, "event": "evaluator_started", "phase": "adjudication", "previous_event_sha256": "40b2aa64446a1533a79d0fabda7e4ffd5c8f874c147c013af50bebf031a3c903", "schema_version": 1, "sequence": 422, "time_utc": "2026-08-02T01:46:53.710169Z"} +{"agent_id": "/root/v4_adjudicate_l", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "L", "kind": "adjudicator"}, "event": "evaluator_attempt_preserved", "phase": "adjudication", "previous_event_sha256": "d9dbbe890066c080d9ac69a05881ac55bb3af6f24c63d92b65428f67e7f82185", "schema_version": 1, "sequence": 423, "sha256": "37d9ea2d17a29d177e05eb312f046e622652c544773abf6b3f271a3749d0f659", "time_utc": "2026-08-02T01:52:05.363417Z"} +{"agent_id": "/root/v4_adjudicate_l", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "L", "kind": "adjudicator"}, "event": "evaluator_returned", "phase": "adjudication", "previous_event_sha256": "8d04d10846b10e9e9cd6db0f6ff9d157150d6eb65d14f8b45f90617dcb151118", "schema_version": 1, "sequence": 424, "time_utc": "2026-08-02T01:52:05.366638Z"} +{"agent_id": "/root/v4_adjudicate_l", "attempt": 1, "details": {"mode": "L"}, "event": "adjudication_preserved", "phase": "adjudication", "previous_event_sha256": "6c926276cee8cb42787997893fd570d2b5997263bfbabdf8c240c8ef88dd263f", "schema_version": 1, "sequence": 425, "sha256": "9b4401c0a9f2e82e624a43443bec90f280499fc4d380460954c8c1856a23cddb", "time_utc": "2026-08-02T01:52:05.368394Z"} +{"details": {"mode": "L"}, "event": "final_blind_score_locked", "phase": "adjudication", "previous_event_sha256": "d2cfbae344d9adf4d70c827e432b716c5affa636d6b8ed03a7b82e41b1f20c9b", "schema_version": 1, "sequence": 426, "sha256": "7c1c2ce5335cb1c91d2610029636bf531075b76e8a72e82015868f607a9a0944", "time_utc": "2026-08-02T01:52:11.474819Z"} +{"agent_id": "/root/v4_adjudicate_r", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "R", "kind": "adjudicator"}, "event": "evaluator_attempt_preserved", "phase": "adjudication", "previous_event_sha256": "72f553a5204eb59d4347461a43556ce3a45e74c728f2c53fe58759f5aa3ae27a", "schema_version": 1, "sequence": 427, "sha256": "71dba92835971f5ac7fd2d81c12c138f474d51480ec06e8cbfbf475084212a92", "time_utc": "2026-08-02T01:52:38.085815Z"} +{"agent_id": "/root/v4_adjudicate_r", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "R", "kind": "adjudicator"}, "event": "evaluator_returned", "phase": "adjudication", "previous_event_sha256": "4ebf1a24c800cf2a070b418d9fb75988c6a2b7efa802db7533bb5d3c3e890d27", "schema_version": 1, "sequence": 428, "time_utc": "2026-08-02T01:52:38.089525Z"} +{"agent_id": "/root/v4_adjudicate_r", "attempt": 1, "details": {"mode": "R"}, "event": "adjudication_preserved", "phase": "adjudication", "previous_event_sha256": "46357eb138d37290ccf60052fc8c3f015c2b648a1f5cfbc60587e3329d7c57f4", "schema_version": 1, "sequence": 429, "sha256": "cfc4183ddc22bbdd4f7c93a1cb6fe1c422f87cfc51a9568aff0b2770a80958f1", "time_utc": "2026-08-02T01:52:38.091667Z"} +{"details": {"mode": "R"}, "event": "final_blind_score_locked", "phase": "adjudication", "previous_event_sha256": "84f1363bb3463e3e8967fc970d4c9cea3ab65b458973eb2e3b7b150f750a6441", "schema_version": 1, "sequence": 430, "sha256": "c5e372423dbeded79ccad0565bfe10e18bd82ca5eead7211e548f2b1d62c046c", "time_utc": "2026-08-02T01:52:44.484809Z"} +{"agent_id": "/root/v4_adjudicate_b", "attempt": 1, "details": {"disposition": "COMPLETE", "identity": "B", "kind": "adjudicator"}, "event": "evaluator_attempt_preserved", "phase": "adjudication", "previous_event_sha256": "4df4a190ff460d4358f0fdb00a8eb0566001a6fb98271b83288ad5b50f6c0218", "schema_version": 1, "sequence": 431, "sha256": "03c80da8dd103f1d0fac1af0732139d9c1c739e9056b569f1050f57ee8c60a48", "time_utc": "2026-08-02T01:57:14.295311Z"} +{"agent_id": "/root/v4_adjudicate_b", "attempt": 1, "details": {"api_state": "COMPLETED", "identity": "B", "kind": "adjudicator"}, "event": "evaluator_returned", "phase": "adjudication", "previous_event_sha256": "03e6c935bdc93a34738ce7aa4e9f2e6ba8f4a7ffdd1856b3bf9079c77517128b", "schema_version": 1, "sequence": 432, "time_utc": "2026-08-02T01:57:14.299994Z"} +{"agent_id": "/root/v4_adjudicate_b", "attempt": 1, "details": {"mode": "B"}, "event": "adjudication_preserved", "phase": "adjudication", "previous_event_sha256": "a970aaf9f4a4379360f92d149ea0fecacd1405ecc7c330e815b759c05ed10d56", "schema_version": 1, "sequence": 433, "sha256": "2e40999e4ebff5000e5ff3b0ecce3c4f18a5e6a890514f2d994c161fe7a6b11d", "time_utc": "2026-08-02T01:57:14.301924Z"} +{"details": {"mode": "B"}, "event": "final_blind_score_locked", "phase": "adjudication", "previous_event_sha256": "e75a11ea4ba9aef430d2d142a637061903d14d823299146e2e42ddead0edb68f", "schema_version": 1, "sequence": 434, "sha256": "349ed96867c3f75e0e65723a8b11b60a96c1d32eeed28b39338f40760afae777", "time_utc": "2026-08-02T01:57:24.897310Z"} +{"details": {}, "event": "conditions_revealed", "phase": "unblinding", "previous_event_sha256": "4675c652fd78df7e94eda2360a3e0420452fa4193191fec4dadf8efb6449b746", "schema_version": 1, "sequence": 435, "sha256": "3d0710929ad67c443911d679424527c183382b7058272e9517daefc4e12b9225", "time_utc": "2026-08-02T01:57:38.019389Z"} +{"details": {"summary_sha256": "72df8d9c5c3281bae26ee3878388f2158703f58a2cbf56e0627a800cd6f881ae", "v4_gate": false}, "event": "aggregate_written", "phase": "result", "previous_event_sha256": "b9e38ad2eb6fa4531eeab042ed2534bdfa7a7f1aaf68e5ac237490b893c9423e", "schema_version": 1, "sequence": 436, "sha256": "31afe5f438d093266386f71807e10175783ab19205986c54fca15d587117020e", "time_utc": "2026-08-02T01:57:38.021269Z"} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/results/aggregate.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/results/aggregate.json new file mode 100644 index 0000000000..1f79ca27ed --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/results/aggregate.json @@ -0,0 +1,2190 @@ +{ + "condition_map": { + "c0": "v3", + "c1": "v4" + }, + "confirmed_novel_findings": [], + "counts": { + "B": { + "v3": { + "B1": 5, + "B10": 0, + "B11": 0, + "B12": 0, + "B13": 0, + "B14": 0, + "B15": 0, + "B2": 1, + "B3": 0, + "B4": 0, + "B5": 0, + "B6": 0, + "B7": 2, + "B8": 0, + "B9": 0 + }, + "v4": { + "B1": 5, + "B10": 1, + "B11": 1, + "B12": 1, + "B13": 1, + "B14": 1, + "B15": 1, + "B2": 2, + "B3": 1, + "B4": 1, + "B5": 2, + "B6": 2, + "B7": 3, + "B8": 1, + "B9": 2 + } + }, + "L": { + "v3": { + "L1": 5, + "L10": 1, + "L11": 1, + "L2": 5, + "L3": 5, + "L4": 5, + "L5": 5, + "L6": 5, + "L7": 5, + "L8": 5, + "L9": 4 + }, + "v4": { + "L1": 5, + "L10": 2, + "L11": 2, + "L2": 5, + "L3": 4, + "L4": 3, + "L5": 5, + "L6": 3, + "L7": 5, + "L8": 3, + "L9": 3 + } + }, + "P": { + "v3": { + "P1": 4, + "P10": 5, + "P11": 5, + "P12": 4, + "P13": 5, + "P14": 5, + "P15": 5, + "P16": 5, + "P17": 5, + "P18": 4, + "P19": 4, + "P2": 4, + "P20": 4, + "P21": 5, + "P22": 4, + "P23": 4, + "P24": 4, + "P25": 5, + "P26": 4, + "P27": 4, + "P3": 5, + "P4": 5, + "P5": 5, + "P6": 5, + "P7": 5, + "P8": 5, + "P9": 5 + }, + "v4": { + "P1": 5, + "P10": 5, + "P11": 5, + "P12": 5, + "P13": 5, + "P14": 5, + "P15": 5, + "P16": 5, + "P17": 5, + "P18": 5, + "P19": 5, + "P2": 5, + "P20": 5, + "P21": 5, + "P22": 5, + "P23": 5, + "P24": 5, + "P25": 5, + "P26": 5, + "P27": 5, + "P3": 5, + "P4": 5, + "P5": 5, + "P6": 5, + "P7": 5, + "P8": 5, + "P9": 5 + } + }, + "Q": { + "v3": { + "Q1": 5, + "Q2": 5, + "Q3": 5, + "Q4": 5, + "Q5": 5 + }, + "v4": { + "Q1": 5, + "Q2": 5, + "Q3": 5, + "Q4": 5, + "Q5": 5 + } + }, + "R": { + "v3": { + "R1": 2, + "R2": 2, + "R3": 2, + "R4": 5, + "R5": 5, + "R6": 5, + "R7": 2 + }, + "v4": { + "R1": 3, + "R2": 3, + "R3": 3, + "R4": 5, + "R5": 5, + "R6": 5, + "R7": 3 + } + } + }, + "defects": { + "B": { + "v3": [ + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "A", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r050", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "B", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r029", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "C", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r034", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "F", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r014", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "H", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r008", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + } + ], + "v4": [ + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "D", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r027", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "G", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r010", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "I", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r018", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "J", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r040", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + } + ] + }, + "L": { + "v3": [ + { + "hard_errors": [ + "G1" + ], + "label": "B", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r038", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [], + "label": "D", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r017", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [], + "label": "G", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r048", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [], + "label": "I", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r004", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + } + ], + "v4": [ + { + "hard_errors": [ + "G11", + "LH4" + ], + "label": "E", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r019", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G11", + "LH4" + ], + "label": "F", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r007", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [], + "label": "J", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r041", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + } + ] + }, + "P": { + "v3": [ + { + "hard_errors": [ + "G11", + "PH4", + "PH5" + ], + "label": "H", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r035", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + } + ], + "v4": [] + }, + "Q": { + "v3": [], + "v4": [] + }, + "R": { + "v3": [ + { + "hard_errors": [ + "G5", + "G11" + ], + "label": "A", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r030", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11" + ], + "label": "F", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r033", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11" + ], + "label": "J", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r016", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + } + ], + "v4": [ + { + "hard_errors": [ + "G5", + "G11" + ], + "label": "D", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r032", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + }, + { + "hard_errors": [ + "G5", + "G11" + ], + "label": "G", + "operational_scope_deviation": false, + "proposal_laundering": false, + "run_id": "r012", + "semantic_noncompletion": false, + "tcb_authority_defect": true, + "visible_scope_defect": false, + "word_budget_defect": false + } + ] + } + }, + "diagnostic_comparison": { + "any_v4_below_v3": true, + "atoms": [ + { + "atom": "P1", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P2", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P3", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P4", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P5", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P6", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P7", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P8", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P9", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P10", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P11", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P12", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P13", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P14", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P15", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P16", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P17", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P18", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P19", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P20", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P21", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P22", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P23", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P24", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P25", + "classification": "CEILING_REPLICATION", + "mode": "P", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "P26", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "P27", + "classification": "TARGETED_LIFT_EVIDENCE", + "mode": "P", + "v3_passes": 4, + "v4_passes": 5 + }, + { + "atom": "B1", + "classification": "CEILING_REPLICATION", + "mode": "B", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "B2", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 1, + "v4_passes": 2 + }, + { + "atom": "B3", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B4", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B5", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 2 + }, + { + "atom": "B6", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 2 + }, + { + "atom": "B7", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 2, + "v4_passes": 3 + }, + { + "atom": "B8", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B9", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 2 + }, + { + "atom": "B10", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B11", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B12", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B13", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B14", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "B15", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "B", + "v3_passes": 0, + "v4_passes": 1 + }, + { + "atom": "L1", + "classification": "CEILING_REPLICATION", + "mode": "L", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "L2", + "classification": "CEILING_REPLICATION", + "mode": "L", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "L3", + "classification": "V4_BELOW_V3", + "mode": "L", + "v3_passes": 5, + "v4_passes": 4 + }, + { + "atom": "L4", + "classification": "V4_BELOW_V3", + "mode": "L", + "v3_passes": 5, + "v4_passes": 3 + }, + { + "atom": "L5", + "classification": "CEILING_REPLICATION", + "mode": "L", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "L6", + "classification": "V4_BELOW_V3", + "mode": "L", + "v3_passes": 5, + "v4_passes": 3 + }, + { + "atom": "L7", + "classification": "CEILING_REPLICATION", + "mode": "L", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "L8", + "classification": "V4_BELOW_V3", + "mode": "L", + "v3_passes": 5, + "v4_passes": 3 + }, + { + "atom": "L9", + "classification": "V4_BELOW_V3", + "mode": "L", + "v3_passes": 4, + "v4_passes": 3 + }, + { + "atom": "L10", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "L", + "v3_passes": 1, + "v4_passes": 2 + }, + { + "atom": "L11", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "L", + "v3_passes": 1, + "v4_passes": 2 + }, + { + "atom": "Q1", + "classification": "CEILING_REPLICATION", + "mode": "Q", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "Q2", + "classification": "CEILING_REPLICATION", + "mode": "Q", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "Q3", + "classification": "CEILING_REPLICATION", + "mode": "Q", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "Q4", + "classification": "CEILING_REPLICATION", + "mode": "Q", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "Q5", + "classification": "CEILING_REPLICATION", + "mode": "Q", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "R1", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "R", + "v3_passes": 2, + "v4_passes": 3 + }, + { + "atom": "R2", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "R", + "v3_passes": 2, + "v4_passes": 3 + }, + { + "atom": "R3", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "R", + "v3_passes": 2, + "v4_passes": 3 + }, + { + "atom": "R4", + "classification": "CEILING_REPLICATION", + "mode": "R", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "R5", + "classification": "CEILING_REPLICATION", + "mode": "R", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "R6", + "classification": "CEILING_REPLICATION", + "mode": "R", + "v3_passes": 5, + "v4_passes": 5 + }, + { + "atom": "R7", + "classification": "V4_HIGHER_BUT_CONFIRMATION_FAILED", + "mode": "R", + "v3_passes": 2, + "v4_passes": 3 + } + ], + "causal_claim": false, + "reason": "The coherent V4 and V3 packages differ in more than one isolated instruction." + }, + "failed_atom_cells": [ + { + "atom": "P1", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P12", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P18", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P19", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P2", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P20", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P22", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P23", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P24", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P26", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "P27", + "label": "H", + "mode": "P", + "role": "v3", + "run_id": "r035" + }, + { + "atom": "B10", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B11", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B12", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B13", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B14", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B15", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B2", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B3", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B4", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B5", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B6", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B7", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B8", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B9", + "label": "A", + "mode": "B", + "role": "v3", + "run_id": "r050" + }, + { + "atom": "B10", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B11", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B12", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B13", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B14", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B15", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B3", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B4", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B5", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B6", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B7", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B8", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B9", + "label": "B", + "mode": "B", + "role": "v3", + "run_id": "r029" + }, + { + "atom": "B10", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B11", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B12", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B13", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B14", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B15", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B2", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B3", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B4", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B5", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B6", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B8", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B9", + "label": "C", + "mode": "B", + "role": "v3", + "run_id": "r034" + }, + { + "atom": "B10", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B11", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B12", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B13", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B14", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B15", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B3", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B4", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B8", + "label": "D", + "mode": "B", + "role": "v4", + "run_id": "r027" + }, + { + "atom": "B10", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B11", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B12", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B13", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B14", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B15", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B2", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B3", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B4", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B5", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B6", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B8", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B9", + "label": "F", + "mode": "B", + "role": "v3", + "run_id": "r014" + }, + { + "atom": "B10", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B11", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B12", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B13", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B14", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B15", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B2", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B3", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B4", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B5", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B6", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B7", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B8", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B9", + "label": "G", + "mode": "B", + "role": "v4", + "run_id": "r010" + }, + { + "atom": "B10", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B11", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B12", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B13", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B14", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B15", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B2", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B3", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B4", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B5", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B6", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B7", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B8", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B9", + "label": "H", + "mode": "B", + "role": "v3", + "run_id": "r008" + }, + { + "atom": "B10", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B11", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B12", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B13", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B14", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B15", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B2", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B3", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B4", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B5", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B6", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B7", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B8", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B9", + "label": "I", + "mode": "B", + "role": "v4", + "run_id": "r018" + }, + { + "atom": "B10", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B11", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B12", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B13", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B14", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B15", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B2", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B3", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B4", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B5", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B6", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B8", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "B9", + "label": "J", + "mode": "B", + "role": "v4", + "run_id": "r040" + }, + { + "atom": "L10", + "label": "B", + "mode": "L", + "role": "v3", + "run_id": "r038" + }, + { + "atom": "L11", + "label": "B", + "mode": "L", + "role": "v3", + "run_id": "r038" + }, + { + "atom": "L10", + "label": "D", + "mode": "L", + "role": "v3", + "run_id": "r017" + }, + { + "atom": "L11", + "label": "D", + "mode": "L", + "role": "v3", + "run_id": "r017" + }, + { + "atom": "L10", + "label": "E", + "mode": "L", + "role": "v4", + "run_id": "r019" + }, + { + "atom": "L11", + "label": "E", + "mode": "L", + "role": "v4", + "run_id": "r019" + }, + { + "atom": "L3", + "label": "E", + "mode": "L", + "role": "v4", + "run_id": "r019" + }, + { + "atom": "L4", + "label": "E", + "mode": "L", + "role": "v4", + "run_id": "r019" + }, + { + "atom": "L6", + "label": "E", + "mode": "L", + "role": "v4", + "run_id": "r019" + }, + { + "atom": "L8", + "label": "E", + "mode": "L", + "role": "v4", + "run_id": "r019" + }, + { + "atom": "L9", + "label": "E", + "mode": "L", + "role": "v4", + "run_id": "r019" + }, + { + "atom": "L10", + "label": "F", + "mode": "L", + "role": "v4", + "run_id": "r007" + }, + { + "atom": "L11", + "label": "F", + "mode": "L", + "role": "v4", + "run_id": "r007" + }, + { + "atom": "L4", + "label": "F", + "mode": "L", + "role": "v4", + "run_id": "r007" + }, + { + "atom": "L6", + "label": "F", + "mode": "L", + "role": "v4", + "run_id": "r007" + }, + { + "atom": "L8", + "label": "F", + "mode": "L", + "role": "v4", + "run_id": "r007" + }, + { + "atom": "L9", + "label": "F", + "mode": "L", + "role": "v4", + "run_id": "r007" + }, + { + "atom": "L10", + "label": "G", + "mode": "L", + "role": "v3", + "run_id": "r048" + }, + { + "atom": "L11", + "label": "G", + "mode": "L", + "role": "v3", + "run_id": "r048" + }, + { + "atom": "L9", + "label": "G", + "mode": "L", + "role": "v3", + "run_id": "r048" + }, + { + "atom": "L10", + "label": "I", + "mode": "L", + "role": "v3", + "run_id": "r004" + }, + { + "atom": "L11", + "label": "I", + "mode": "L", + "role": "v3", + "run_id": "r004" + }, + { + "atom": "L10", + "label": "J", + "mode": "L", + "role": "v4", + "run_id": "r041" + }, + { + "atom": "L11", + "label": "J", + "mode": "L", + "role": "v4", + "run_id": "r041" + }, + { + "atom": "R1", + "label": "A", + "mode": "R", + "role": "v3", + "run_id": "r030" + }, + { + "atom": "R2", + "label": "A", + "mode": "R", + "role": "v3", + "run_id": "r030" + }, + { + "atom": "R3", + "label": "A", + "mode": "R", + "role": "v3", + "run_id": "r030" + }, + { + "atom": "R7", + "label": "A", + "mode": "R", + "role": "v3", + "run_id": "r030" + }, + { + "atom": "R1", + "label": "D", + "mode": "R", + "role": "v4", + "run_id": "r032" + }, + { + "atom": "R2", + "label": "D", + "mode": "R", + "role": "v4", + "run_id": "r032" + }, + { + "atom": "R3", + "label": "D", + "mode": "R", + "role": "v4", + "run_id": "r032" + }, + { + "atom": "R7", + "label": "D", + "mode": "R", + "role": "v4", + "run_id": "r032" + }, + { + "atom": "R1", + "label": "F", + "mode": "R", + "role": "v3", + "run_id": "r033" + }, + { + "atom": "R2", + "label": "F", + "mode": "R", + "role": "v3", + "run_id": "r033" + }, + { + "atom": "R3", + "label": "F", + "mode": "R", + "role": "v3", + "run_id": "r033" + }, + { + "atom": "R7", + "label": "F", + "mode": "R", + "role": "v3", + "run_id": "r033" + }, + { + "atom": "R1", + "label": "G", + "mode": "R", + "role": "v4", + "run_id": "r012" + }, + { + "atom": "R2", + "label": "G", + "mode": "R", + "role": "v4", + "run_id": "r012" + }, + { + "atom": "R3", + "label": "G", + "mode": "R", + "role": "v4", + "run_id": "r012" + }, + { + "atom": "R7", + "label": "G", + "mode": "R", + "role": "v4", + "run_id": "r012" + }, + { + "atom": "R1", + "label": "J", + "mode": "R", + "role": "v3", + "run_id": "r016" + }, + { + "atom": "R2", + "label": "J", + "mode": "R", + "role": "v3", + "run_id": "r016" + }, + { + "atom": "R3", + "label": "J", + "mode": "R", + "role": "v3", + "run_id": "r016" + }, + { + "atom": "R7", + "label": "J", + "mode": "R", + "role": "v3", + "run_id": "r016" + } + ], + "final_score_sha256": { + "B": "349ed96867c3f75e0e65723a8b11b60a96c1d32eeed28b39338f40760afae777", + "L": "7c1c2ce5335cb1c91d2610029636bf531075b76e8a72e82015868f607a9a0944", + "P": "03ed2a9cab7cf45702bac4b9319c979e14ed63e854ae4d29fccfe3c780d2e290", + "Q": "ac39b01aeb020d54d50a2cc5eefa0a7a9d155acfb8745195d0a46e77fd421e7b", + "R": "c5e372423dbeded79ccad0565bfe10e18bd82ca5eead7211e548f2b1d62c046c" + }, + "schema_version": 1, + "unblinded_utc": "2026-08-02T01:57:38.011024Z", + "v4_gate": { + "all_v4_atoms_5_of_5": false, + "overall": false, + "zero_v4_confirmed_novel_findings": true, + "zero_v4_hard_errors": false, + "zero_v4_proposal_laundering": true, + "zero_v4_scope_budget_defects": true, + "zero_v4_semantic_noncompletion": true, + "zero_v4_tcb_authority_defects": false + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/results/summary.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/results/summary.md new file mode 100644 index 0000000000..a248818080 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/results/summary.md @@ -0,0 +1,112 @@ +# V4 Focused Confirmation Results + +**Primary V4 gate: FAIL.** + +Each atom cell is a pass count out of five. V4 is the confirmatory candidate; V3 is diagnostic. + +| Mode | Condition | Atom pass counts | Defective reports | +|---|---|---|---:| +| P | V4 | P1 5/5; P2 5/5; P3 5/5; P4 5/5; P5 5/5; P6 5/5; P7 5/5; P8 5/5; P9 5/5; P10 5/5; P11 5/5; P12 5/5; P13 5/5; P14 5/5; P15 5/5; P16 5/5; P17 5/5; P18 5/5; P19 5/5; P20 5/5; P21 5/5; P22 5/5; P23 5/5; P24 5/5; P25 5/5; P26 5/5; P27 5/5 | 0 | +| P | V3 | P1 4/5; P2 4/5; P3 5/5; P4 5/5; P5 5/5; P6 5/5; P7 5/5; P8 5/5; P9 5/5; P10 5/5; P11 5/5; P12 4/5; P13 5/5; P14 5/5; P15 5/5; P16 5/5; P17 5/5; P18 4/5; P19 4/5; P20 4/5; P21 5/5; P22 4/5; P23 4/5; P24 4/5; P25 5/5; P26 4/5; P27 4/5 | 1 | +| B | V4 | B1 5/5; B2 2/5; B3 1/5; B4 1/5; B5 2/5; B6 2/5; B7 3/5; B8 1/5; B9 2/5; B10 1/5; B11 1/5; B12 1/5; B13 1/5; B14 1/5; B15 1/5 | 4 | +| B | V3 | B1 5/5; B2 1/5; B3 0/5; B4 0/5; B5 0/5; B6 0/5; B7 2/5; B8 0/5; B9 0/5; B10 0/5; B11 0/5; B12 0/5; B13 0/5; B14 0/5; B15 0/5 | 5 | +| L | V4 | L1 5/5; L2 5/5; L3 4/5; L4 3/5; L5 5/5; L6 3/5; L7 5/5; L8 3/5; L9 3/5; L10 2/5; L11 2/5 | 3 | +| L | V3 | L1 5/5; L2 5/5; L3 5/5; L4 5/5; L5 5/5; L6 5/5; L7 5/5; L8 5/5; L9 4/5; L10 1/5; L11 1/5 | 4 | +| Q | V4 | Q1 5/5; Q2 5/5; Q3 5/5; Q4 5/5; Q5 5/5 | 0 | +| Q | V3 | Q1 5/5; Q2 5/5; Q3 5/5; Q4 5/5; Q5 5/5 | 0 | +| R | V4 | R1 3/5; R2 3/5; R3 3/5; R4 5/5; R5 5/5; R6 5/5; R7 3/5 | 2 | +| R | V3 | R1 2/5; R2 2/5; R3 2/5; R4 5/5; R5 5/5; R6 5/5; R7 2/5 | 3 | + +## Diagnostic comparison + +Any V4 atom below matched V3: YES. + +`TARGETED_LIFT_EVIDENCE` means V4 passed 5/5 while matched V3 was lower. `CEILING_REPLICATION` means both passed 5/5. These coherent packages differ in more than one isolated instruction, so no classification is causal proof. + +| Mode | Atom | V4 | V3 | Classification | +|---|---|---:|---:|---| +| P | P1 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P2 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P3 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P4 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P5 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P6 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P7 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P8 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P9 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P10 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P11 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P12 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P13 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P14 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P15 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P16 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P17 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P18 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P19 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P20 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P21 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P22 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P23 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P24 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P25 | 5/5 | 5/5 | CEILING_REPLICATION | +| P | P26 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| P | P27 | 5/5 | 4/5 | TARGETED_LIFT_EVIDENCE | +| B | B1 | 5/5 | 5/5 | CEILING_REPLICATION | +| B | B2 | 2/5 | 1/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B3 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B4 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B5 | 2/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B6 | 2/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B7 | 3/5 | 2/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B8 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B9 | 2/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B10 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B11 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B12 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B13 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B14 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| B | B15 | 1/5 | 0/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| L | L1 | 5/5 | 5/5 | CEILING_REPLICATION | +| L | L2 | 5/5 | 5/5 | CEILING_REPLICATION | +| L | L3 | 4/5 | 5/5 | V4_BELOW_V3 | +| L | L4 | 3/5 | 5/5 | V4_BELOW_V3 | +| L | L5 | 5/5 | 5/5 | CEILING_REPLICATION | +| L | L6 | 3/5 | 5/5 | V4_BELOW_V3 | +| L | L7 | 5/5 | 5/5 | CEILING_REPLICATION | +| L | L8 | 3/5 | 5/5 | V4_BELOW_V3 | +| L | L9 | 3/5 | 4/5 | V4_BELOW_V3 | +| L | L10 | 2/5 | 1/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| L | L11 | 2/5 | 1/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| Q | Q1 | 5/5 | 5/5 | CEILING_REPLICATION | +| Q | Q2 | 5/5 | 5/5 | CEILING_REPLICATION | +| Q | Q3 | 5/5 | 5/5 | CEILING_REPLICATION | +| Q | Q4 | 5/5 | 5/5 | CEILING_REPLICATION | +| Q | Q5 | 5/5 | 5/5 | CEILING_REPLICATION | +| R | R1 | 3/5 | 2/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| R | R2 | 3/5 | 2/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| R | R3 | 3/5 | 2/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | +| R | R4 | 5/5 | 5/5 | CEILING_REPLICATION | +| R | R5 | 5/5 | 5/5 | CEILING_REPLICATION | +| R | R6 | 5/5 | 5/5 | CEILING_REPLICATION | +| R | R7 | 3/5 | 2/5 | V4_HIGHER_BUT_CONFIRMATION_FAILED | + +## Primary gates + +| Gate | Result | +|---|---| +| all v4 atoms 5 of 5 | FAIL | +| zero v4 hard errors | FAIL | +| zero v4 proposal laundering | PASS | +| zero v4 tcb authority defects | FAIL | +| zero v4 semantic noncompletion | PASS | +| zero v4 scope budget defects | PASS | +| zero v4 confirmed novel findings | PASS | + +## Confirmed novel findings + +None. + +## Integrity limitations + +Filesystem and URL isolation were procedural on a shared host. Exact hosted model-build and sampling-seed metadata were unavailable. Results are source-review capability observations under those constraints. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/B.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/B.json new file mode 100644 index 0000000000..1158c16b16 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/B.json @@ -0,0 +1,2454 @@ +{ + "cells": [ + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result Ok/Err exhaustiveness or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The six rows are stated exhaustive, but Result exhaustiveness and tuple-struct enum-pattern semantics are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "The relation explicitly says its omitted, system, arena, arena-stop, other Unicode, and non-Unicode rows are all raw classes." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "R,S and normal success are asserted, but successful println output, tuple-pattern handling of NotPresent, and implicit return are not authoritatively established." + }, + "s2": { + "decision": "PASS", + "evidence": "Omitted/system rows give R,S and normal success when both writes succeed, with system as the exact mapping and no arena line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The arena row has the right endpoint but lacks verified successful-output and implicit-function-return premises for the complete trace." + }, + "s2": { + "decision": "PASS", + "evidence": "The Unicode arena row gives R,A and normal success when both writes succeed, with arena as the exact mapping and no system line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The arena-stop row has the right panic/no-library result, but successful A-line completion is not verified by the cited println premise." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop gives completed R,A then explicit panic when writes succeed and is explicitly excluded from any successful current execution/library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode rows are present, but successful R output and tuple-struct-pattern semantics are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Other-Unicode and non-Unicode give completed R, explicit panic, no allocator attempt, and no current library under the accepted premise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "It handles failed calls and incomplete bytes, but the completed R prefix used after second-write failure lacks a verified successful-println effect." + }, + "s2": { + "decision": "PASS", + "evidence": "It covers failed R before classification and each allocator-write failure after R, allows incomplete failing bytes, and gives every failed exit no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output/normal-return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "Exact TCB consumers are listed, but upstream successful traces and Rust all/not source selection are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "The successful mapping is limited to accepted returns; exact allocator, burst, and target cfgs feed Rust source selection with BUILD-MAP-ORDERED conspicuously bounded." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior R/arena prefix and arena-stop path rest on unverified successful-output and pattern premises; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The freshness prose is exact, yet the prerequisite successful arena and completed-line local trace lacks full Rust authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness proof derives prior R,A, present-to-present arena-stop invalidation, rerun, every failed outcome, and no prefix or old artifact as current." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The exclusion uses all(...) without verifying Rust all/key-value truth semantics, and depends on incomplete successful-selector closure." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves successful wasm32/arena sets both cfg leaves, retains compile_error! for all feature/profile/debug cases, and yields no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "It calls the blocks complementary but never verifies all/not configuration semantics or complete build-to-source reachability." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines C exactly as aarch64/burst-on/arena and proves the cfg blocks form an exhaustive complementary C/not-C source partition." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output/normal-return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The witness states all four ideas, but authoritative reachability through the successful arena build and selected block is incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It gives supported safe zero use in C, exact unchecked reachability, false nonzero proposition, versioned zero-UB consequence, and whole-domain UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output/normal-return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "M has the intended formula, but the positive and complement proofs consume the unproved body/build partition." + }, + "s2": { + "decision": "PASS", + "evidence": "M is Supported×V with C/zero removed; the report proves all M cases safe and all excluded points UB, hence both containment and exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output/normal-return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The not-C zero proof is conditional on an unproved current-source partition and therefore does not cover the required build relation." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every not-C zero call takes the equality branch and panics before the unsafe call across all profile/debug fibers." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output/normal-return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "It gives the intended UNPROVED wording, but the underlying B12 and B14 derivations are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It says the whole panic promise is UNPROVED, not CONTRACT-BROKEN, because C/zero contains UB while not-C/zero is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output/normal-return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "UNSOUND is issued without an authoritative complete reachability chain through normal build-script return and exact cfg selection." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "PROVED and UNSOUND conclusions necessarily rely on unchecked successful-println, function-return, Result-pattern, and all/not premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output/normal-return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The asserted witness lacks a validly established supported-current-library reachability link." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB itself is kept narrow, but material Rust premises for build completion and cfg selection are not verified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The report identifies BUILD-MAP-ORDERED and restricts it to exact accepted Cargo/status/freshness leaves; Rust claims use 1.85.1 official sources." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Absent/system [RERUN,CS] normal return is asserted without verified println success or implicit function-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Absent/system success is exactly RERUN,CS then normal return and the system cfg; no arena line is present." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Arena [RERUN,CA] normal return lacks verified completed-line and implicit-return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "Unicode arena success is exactly RERUN,CA then normal return and the arena cfg; no system line is present." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output needed for the completed R and allocator prefixes; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Arena-stop's later panic is right, but successful CA completion is not verified because AX-EXIT covers only println failure." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop with successful writes leaves RERUN,CA then explicit panic, and the report states the completed selector cannot produce a current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output needed for the completed R and allocator prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Both rejection classes are partitioned correctly, but the completed RERUN prefix lacks verified successful println output semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave only RERUN, explicitly panic without allocator output, and produce no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "It handles every failure and arbitrary partial bytes, but the required preceding completed [RERUN] is not supported by a verified successful-println proposition." + }, + "s2": { + "decision": "PASS", + "evidence": "It models partial(L), covers first-write and every second-write failure, preserves only earlier complete RERUN, and rejects every failed execution." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The TCB and cfg stages are explicit, but the successful/failure local relation remains incomplete through B3-B7." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful RERUN,CS/CA is consumed; exact allocator, burst, and target cfgs then select source under conspicuously bounded BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior successful RERUN/arena prefix lacks verified successful-output semantics; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Freshness outcomes are enumerated, but the prior successful [RERUN,CA] trace lacks output/return authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness witness derives prior RERUN,CA, present-value change, forced rerun, three unsuccessful cases, and no stale/current arena result." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The wasm/arena cfg proof is correct conditionally, but actual effective closure depends on incomplete B8 selector success." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32/arena alone activates compile_error! independent of burst, profile, and debug assertions, with no library or witness from that pair." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "AX-CFG proves complementarity conditionally, but supported current-source selection depends on incomplete B4/B8." + }, + "s2": { + "decision": "PASS", + "evidence": "The source closure defines F exactly as aarch64/burst-on/arena and selects only the unchecked body there and only the checked body elsewhere." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The zero/NZ/UB links are correct, but current Q-library reachability is incomplete at successful script output/return." + }, + "s2": { + "decision": "PASS", + "evidence": "It supplies supported A64/burst-on/arena lane_id(0), safe-use validity, selected reachability, false NZ, authoritative zero UB, and UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Smax and the four cases are exact algebraically, but every-complement UB reachability is not completely established." + }, + "s2": { + "decision": "PASS", + "evidence": "Smax is not-F or nonzero; three included cases prove soundness and F/zero proves every complement point UB, establishing maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The checked-body zero proof is correct conditionally, but complete Required-to-body coverage through B8 is absent." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every supported not-F zero case takes the equality branch and panics before unsafe, with all P×D fibers retained." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The intended verdict is stated, but B12/B14 do not provide complete applicable certificates." + }, + "s2": { + "decision": "PASS", + "evidence": "It reports the global zero-panic theorem UNPROVED rather than CONTRACT-BROKEN because only UB cases remain after the proved not-F region." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND without a fully verified successful-build reachability link." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked successful-println and implicit-main-return premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND conclusions necessarily rely on unchecked successful-println and function-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "Its A64/on/arena safe-call certificate is incomplete at println success and normal main return." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material successful-println and implicit-main-return premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded correctly, but material successful-output and normal-return Rust premises are unverified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The exact BUILD-MAP-ORDERED entry and its narrow consumers are recorded; Cargo is not used as Rust authority and Rust claims cite 1.85.1 sources." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The table lists all six classes, but exact Result/VarError variant exhaustiveness and literal/wildcard/tuple-pattern semantics are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "The ordered-relation table explicitly calls omitted, system, arena, arena-stop, other Unicode, and non-Unicode exhaustive." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The two system rows lack verified enum/literal pattern selection and implicit main-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Its first two table rows give R then READ then the system line and normal return when both writes succeed, with no arena line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The arena row states R,A0 success but does not verify literal-pattern selection or normal function return." + }, + "s2": { + "decision": "PASS", + "evidence": "The Unicode arena row gives R then READ then the arena line and normal return on successful writes, with no system line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "R,A0 then panic/no library is stated, but reaching the arena-stop arm is unsupported by applicable literal-pattern authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The arena-stop row gives completed R,A followed by explicit panic and states that BUILD-MAP-ORDERED produces no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The rejection rows are correct textually, but wildcard and NotUnicode tuple-pattern selection are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Other-Unicode and non-Unicode rows leave only R, panic before any allocator attempt, and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful arm selection/return and all/not cfg semantics are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "Cargo effects are narrowly qualified, but the successful local traces and exact Rust cfg truth/selection relation remain incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It limits cfg consumption to successful selector returns, names exact allocator, feature, and target mappings, applies Rust cfg rules, and conspicuously qualifies BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection and the successful arena return are not fully verified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The requested stale-build outcomes are enumerated, but prerequisite arena/arena-stop path selection and successful return are unverified." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness challenge derives prior R,A, present-to-present arena-stop invalidation, rerun, exhaustive failed exits, and no stale result." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "It asserts the wasm32/arena all predicate and converse without verifying all, option-truth, and false-cfg removal semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32 plus arena retains compile_error! for either feature and all profile/debug fibers, while that pair has no API case." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "Q/not-Q are called complementary without verified all/not cfg rules and complete successful mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines Q as exactly aarch64/burst-on/arena and proves the two cfg bodies are the exhaustive disjoint Q and not-Q selections." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful arm selection/return and all/not cfg semantics are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The stated safe zero witness lacks a valid authoritative source-reachability derivation." + }, + "s2": { + "decision": "PASS", + "evidence": "It gives a supported safe lane_id(0) in Q, reaches new_unchecked(0), falsifies nonzero, applies the 1.85.1 UB contract, and says UNSOUND relative to BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful arm selection/return and all/not cfg semantics are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The maximal formula and case split are correct, but rely on unproved cfg/build reachability and false-if behavior." + }, + "s2": { + "decision": "PASS", + "evidence": "It states M = C×U minus Q/zero, proves checked and Q/nonzero sufficiency, and proves every excluded Q/zero point has UB, establishing exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful arm selection/return and all/not cfg semantics are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The regional panic assertion lacks a complete cfg/body and false/true conditional-semantics derivation over Required." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every zero-input not-Q case takes the checked branch and panics before unsafe code, parametrically over profiles and debug assertions." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful arm selection/return and all/not cfg semantics are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The verdict is worded correctly, but neither its complete UB certificate nor regional proof is established." + }, + "s2": { + "decision": "PASS", + "evidence": "It separately reports the whole zero-panic postcondition UNPROVED, not CONTRACT-BROKEN, because Q/zero has UB while all other zero cases are proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful arm selection/return and all/not cfg semantics are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "The UNSOUND verdict rests on an incompletely authorized successful-selector and cfg-body reachability chain." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "The report necessarily relies on unchecked Result/pattern, function-return, and all/not semantics for its affirmative conclusions." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful arm selection/return and all/not cfg semantics are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "The existential certificate's reachability link is not validly established from the cited Rust premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "Although BUILD-MAP-ORDERED is bounded, required Rust semantic leaves for exhaustive paths and cfg selection are missing." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is identified and narrowly consumed only for its accepted Cargo/freshness/status mappings; Rust premises use versioned official authority." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The R,CS rows assert return success, but no versioned function-body premise establishes implicit normal return after the final println." + }, + "s2": { + "decision": "PASS", + "evidence": "Omitted and Unicode system rows give R,CS then normal success if both writes succeed, with no arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The R,CA arena row likewise lacks authoritative implicit-return completion despite correct order/output reasoning." + }, + "s2": { + "decision": "PASS", + "evidence": "The Unicode arena row gives R,CA then normal success if both writes succeed, with no system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but normal main return is an unverified material edge; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "Cargo/cfg composition is otherwise exact, but the only-successful-return premise consumes unverified implicit main-return semantics from B3/B4." + }, + "s2": { + "decision": "PASS", + "evidence": "Exactly the accepted successful classes feed current allocator cfgs; the report then applies admitted burst/target leaves and Rust cfg semantics under an explicit TCB alias." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping still depends on the unverified normal-return edge; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The compile_error proof is exact conditionally, but effective build-to-source closure still depends on the incomplete successful-arena B8 derivation." + }, + "s2": { + "decision": "PASS", + "evidence": "The exact-exclusion section proves both directions of wasm32/arena compile_error! rejection for every feature/profile/debug fiber and no API case." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping still depends on the unverified normal-return edge; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The all/not body proof is exact conditionally, but current supported-source reachability depends on the incomplete B4/B8 success relation." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines K exactly as aarch64/burst-on/arena and proves the first and not-all blocks select K and its complement over all P×D." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but normal main return is an unverified material edge; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "Safe use, false NZ, and zero-UB are authoritative; current-library reachability remains incomplete at the build-script normal-return edge." + }, + "s2": { + "decision": "PASS", + "evidence": "F-UB gives a supported safe lane_id(0), K reachability, false NZ, exact new_unchecked zero UB, and the UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but normal main return is an unverified material edge; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "M/WIT are algebraically exact, but maximality consumes the incomplete supported reachability certificate." + }, + "s2": { + "decision": "PASS", + "evidence": "M removes exactly WIT=K/zero; all M cases discharge NZ or panic, and each complement point has UB, proving equality and maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but normal main return is an unverified material edge; the Required-to-selected-body reachability chain is incomplete at normal main return; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The zero-source proof is correct conditionally, but Required-to-current-body coverage is incomplete through B8/B11." + }, + "s2": { + "decision": "PASS", + "evidence": "The report proves every not-K zero case executes the equality branch and panic before unsafe across the supported configuration fibers." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because normal main return is an unverified material edge; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The intended UNPROVED reasoning is present, but its prerequisite complete B12 and B14 certificates do not hold." + }, + "s2": { + "decision": "PASS", + "evidence": "It reports the universal panic contract UNPROVED, not CONTRACT-BROKEN or PROVED, because K/zero has UB and the complement is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although normal main return is an unverified material edge; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND although the current supported library reachability link omits verified implicit-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked implicit-main-return semantics; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "Its build/source and maximality affirmatives necessarily rely on unchecked function-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because normal main return is an unverified material edge; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "F-UB's raw-arena-to-current-library reachability certificate is incomplete at normal main return." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material implicit-main-return semantics remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The exact TCB is carefully bounded, but normal build-script return is a material unverified Rust premise used by positive verdicts." + }, + "s2": { + "decision": "ABSENT", + "evidence": "TCB-ORDERED is explicitly defined as the exact BUILD-MAP-ORDERED entry and is not widened; Rust claims use versioned official sources." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but delegates the Rust-semantic raw partition to BUILD.md and does not verify Result/VarError or exact pattern behavior; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "It calls the partition exhaustive but explicitly lets BUILD.md supply it; Result/VarError exhaustiveness and exact pattern behavior are not verified as Rust semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "B-01 explicitly labels omitted, system, arena, arena-stop, every other Unicode, and non-Unicode as the exhaustive remaining relation." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The system rows lack exact match/pattern and implicit-return authority despite showing the intended R,L_s endpoint." + }, + "s2": { + "decision": "PASS", + "evidence": "Omitted/system successful R,L_s writes end in normal return and exactly system; no arena selector occurs." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The arena row shows R,L_a success but does not verify exact literal-arm selection or falling-through main return." + }, + "s2": { + "decision": "PASS", + "evidence": "Unicode arena successful R,L_a writes end in normal return and exactly arena; no system selector occurs." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "Its arena-stop prefix/panic outcome is correct, but reaching that literal arm is not established by the cited vague match premise." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop completes R,L_a then explicitly panics when writes succeed, and both its exits are assigned no current result." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode outcomes are listed, but wildcard and tuple-struct pattern semantics are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave R, panic before any selector attempt, and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but raw-path selection/normal return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "Exact TCB use is described, but selector success/exhaustiveness and Rust cfg all/not source selection remain incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Only normal accepted exits supply the exact current allocator cfg; admitted feature/target mappings and Rust cfg select source under explicit BUILD-MAP-ORDERED limits." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection is delegated to unchecked source claims; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The three rerun failures are right, but the prior-success and arena-stop arm derivations rely on unchecked local Rust semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "B-02 derives prior successful R,L_a, present arena-stop staleness, forced rerun, three failed outcomes, and no stale/current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not and false-cfg selection are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "B-03 asserts all(...) and exact rejection without verifying all/key-value cfg semantics or complete B8 mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "B-03 proves every wasm32/arena fiber retains compile_error! and fails compilation, while this pair is outside Q and no API is produced." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not and false-cfg selection are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The C/not-C block split is asserted without version-matched all/not and false-cfg semantics, atop incomplete mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "B-03 defines C exactly as aarch64/burst-on/arena and states cfg selects only the immediate unchecked body on C and only the checked body on not-C." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but raw-path selection/normal return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "F-01 states four bullets, but supported current-source reachability is not validly established by the report's authorities." + }, + "s2": { + "decision": "PASS", + "evidence": "F-01 gives a supported safe lane_id(0), C reachability, false nonzero requirement, exact standard-library UB, and the UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but raw-path selection/normal return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "S has the intended formula, but its complement proof relies on the incomplete cfg/build reachability chain." + }, + "s2": { + "decision": "PASS", + "evidence": "S is not-C or nonzero; S-01/S-02 prove every included case sound and every excluded C/zero case UB, establishing exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but raw-path selection/normal return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "S-01's zero panic proof is only conditional on an unproved complementary source selection." + }, + "s2": { + "decision": "PASS", + "evidence": "S-01 proves every supported not-C zero input executes panic before unsafe and explicitly covers all profile/debug states." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because raw-path selection/normal return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "POST-01 gives the intended verdict, but B12/B14 are not complete applicable derivations." + }, + "s2": { + "decision": "PASS", + "evidence": "POST-01 declares the universal panic theorem UNPROVED rather than CONTRACT-BROKEN, because C/zero has UB and the complement is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although raw-path selection/normal return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "UNSOUND is issued without a valid authoritative reachability link through the accepted raw arena path and cfg body." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, exact-pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The report expressly uses BUILD.md to supply a Rust-semantic raw partition and also omits material return/all-not authorities." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because raw-path selection/normal return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "F-01's current-library/source reachability link is incomplete despite correct zero and UB propositions." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, exact-pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "It treats BUILD.md as supplying the complete raw semantic partition and leaves other material Rust cfg/return premises unchecked." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is named, scoped to its exact accepted Cargo propositions and consumers, and not substituted for cited Rust 1.85.1 semantics." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The six classes are explicitly called exhaustive, but Result's two-way shape and tuple-struct enum matching are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "The build section calls absent, system, arena, arena-stop, other Unicode including empty, and non-Unicode an exact exhaustive partition." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "Absent/system R,Sline normal return lacks verified successful-println and implicit-return premises, with tuple matching also omitted for absence." + }, + "s2": { + "decision": "PASS", + "evidence": "Absent/system successful writes give exactly R,Sline and normal return, selecting system only." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The arena success trace asserts a complete Aline and normal return without verifying println success or function-body return." + }, + "s2": { + "decision": "PASS", + "evidence": "Unicode arena successful writes give exactly R,Aline and normal return, selecting arena only." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The arena-stop ordering is stated, but completion of R/Aline on successful println calls is not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Successful arena-stop writes completed R,Aline then explicitly panics, and BUILD-MAP-ORDERED is used to derive no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The two R-only rejection rows lack verified successful-line and NotUnicode tuple-pattern premises." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode panic with completed R before any allocator attempt and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "q correctly avoids atomicity assumptions, but the completed [R] premise after a later failure lacks verified println-success semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "It covers failed R before READ and all second-write failures after R, permits an arbitrary fragment q, and assigns no source effect or library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The TCB is conspicuous and cfg rules are cited, but upstream successful return/output and exhaustive selector traces are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful selectors supply exact allocator cfgs; admitted burst/target leaves and Rust cfg then select source under explicit BUILD-MAP-ORDERED limits." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior complete R/arena prefix lacks verified println-success and normal-return premises; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The freshness sequence is exact textually, yet its successful prior [R,Aline] premise is not authoritatively established." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness certificate derives prior completed R, arena-stop invalidation, rerun, all failed outcomes, and no old library as current." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete despite otherwise checked cfg rules; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The conditional compile_error proof is correct in isolation, but effective build closure depends on the incomplete successful-arena mapping in B8." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32/arena exactly retains compile_error! for both feature states and every profile/debug fiber and is rejected before any API use." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete despite otherwise checked cfg rules; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "all/not semantics are stated, but the exact supported current-source partition still depends on the incomplete B4/B8 mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "K is exactly aarch64/burst-on/arena; cfg semantics are used to prove the first body on K and the complementary checked body on not-K." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "Valid use, false precondition, and UB are stated; the authoritative current-library reachability link is incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "F-1 gives a supported successful arena build and safe lane_id(0), reaches new_unchecked(0), falsifies its contract, applies UB, and says UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "M and both set arguments are stated, but every excluded-case UB proof consumes the incomplete reachability certificate." + }, + "s2": { + "decision": "PASS", + "evidence": "M is not-K or nonzero; the report proves each included case safe and every omitted K/zero point UB, so the region is exact and maximal." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The not-K zero source argument is present, but the required build-to-body coverage remains incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every supported not-K zero execution takes the check and panics before unsafe, parametrically over profiles and debug states." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "UNPROVED/not-CONTRACT-BROKEN is correct, but the report has not completed the prerequisite whole UB and regional coverage proofs." + }, + "s2": { + "decision": "PASS", + "evidence": "It separately concludes the whole panic postcondition is UNPROVED, not CONTRACT-BROKEN, because K/zero is UB and not-K is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "It reports UNSOUND while the supported-current-library reachability link lacks verified successful-output and function-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, and implicit-return premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "Its PROVED/UNSOUND results necessarily rely on unchecked Result/tuple, println-success, and function-return premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "F-1's reachability certificate is incomplete even though its false-precondition and UB links are correct." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, and implicit-return premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is not widened, but material Rust semantics needed for current selector success and exhaustiveness are unverified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is accepted only at its stated identity and consumers; Cargo pages are corroboration only and Rust premises use versioned authority." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "Calls the six classes exhaustive, but AX-ENV omits Result's Ok/Err exhaustiveness and tuple-struct-pattern semantics needed to exclude another outcome." + }, + "s2": { + "decision": "PASS", + "evidence": "BUILD-1 explicitly proves absent, system, arena, arena-stop, other Unicode, and non-Unicode are the exhaustive raw classes." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The R,S success row lacks verified block sequencing, successful println line effect, and implicit main-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "The table gives omitted/system successful R,S and normal return, with exactly system selected and no arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The R,A success row asserts normal return without verified source-order, successful-output, or function-return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "The table gives Unicode arena successful R,A and normal return, with exactly arena selected and no system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "It states R,A then explicit panic/no library, but the completed-line and source-order premises are not verified by its authorities." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop with successful writes leaves R,A and explicitly panics; the same row and TCB qualification say no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The R-only rejection rows lack tuple-pattern/source-order and successful-line authority sufficient for both raw classes." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave R, panic before an allocator print, and have no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify block sequencing or successful println output for the prior completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "Although q models failed-call bytes, no block-order or successful-println premise verifies the prior completed R prefix at allocator-write failures." + }, + "s2": { + "decision": "PASS", + "evidence": "The table covers first-write and every class-specific second-write failure, models arbitrary failed-call fragment q, and gives no library on all failures." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but block/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The Cargo qualification is conspicuous, but the successful/failing local traces and exact Rust cfg selection needed for composition remain unproved." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful selector rows feed exact allocator cfgs; BUILD-1 and the projection apply admitted feature/target mappings and Rust cfg selection with explicit TCB boundaries." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but R-before-arena order, complete-line success, and arena-stop selection are not fully verified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "BUILD-2 states the requested sequence, but relies on unverified R-before-A successful and arena-stop local traces." + }, + "s2": { + "decision": "PASS", + "evidence": "BUILD-2 derives prior R,A, present-to-present invalidation, mandatory rerun, all three failed outcomes, and no current or stale arena library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "CFG-1 asserts all(...) truth and cfg inclusion without verifying all, key/value-option truth, and true/false cfg-attribute rules." + }, + "s2": { + "decision": "PASS", + "evidence": "CFG-1 proves wasm32/arena includes compile_error! for both feature states and all profile/debug fibers and yields no supported library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The U/not-U body partition is asserted without verified all/not, key/value, and true-versus-false cfg semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "The source projection and U definition prove the unchecked body exactly for aarch64/burst-on/arena and the checked complementary body everywhere else." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but block/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The UNSOUND witness reaches the first body only through the incomplete build/cfg derivation, so authoritative reachability is missing." + }, + "s2": { + "decision": "PASS", + "evidence": "SOUND-1 supplies a supported safe zero call, exact selected reachability, false nonzero precondition, documented UB, and whole-domain UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but block/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The formula is correct, but both containments rely on the unverified body/build partition and unverified false-if flow." + }, + "s2": { + "decision": "PASS", + "evidence": "S is not-U or nonzero; the positive proof covers every member and SOUND-1 applies to every omitted U/zero fiber, proving exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but block/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The regional zero argument relies on the unverified complementary cfg selection and build-to-source closure." + }, + "s2": { + "decision": "PASS", + "evidence": "The panic section proves every supported not-U zero input executes panic before unsafe, with the domain proof retaining all profiles and debug states." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because block/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "UNPROVED is stated correctly, but its required UB and regional-panic certificates are incomplete because B12/B14 are unproved." + }, + "s2": { + "decision": "PASS", + "evidence": "It gives the full panic theorem UNPROVED, not CONTRACT-BROKEN, because U/zero is UB while every other zero case is regionally proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although block/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND while supported-Q reachability rests on unverified build-return and exact cfg-selection premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "Its positive build/source conclusions necessarily use unchecked Rust block, println-success, return, and all/not semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because block/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "SOUND-1 lacks a valid authoritative reachability link from raw arena through the current library to the unchecked body." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but multiple material Rust premises supporting PROVED/UNSOUND claims are not verified by applicable versioned text." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is conspicuously limited to its exact accepted build propositions, while material Rust leaves cite 1.85.1 authority." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The six classes are stated, but Result/VarError exact variants and literal/wildcard/tuple-pattern propositions are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "It explicitly defines the disjoint exhaustive raw set as absent, three named Unicode values, other Unicode, and non-Unicode." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "System-success rows lack verified pattern selection, successful println output, and implicit return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "The table and failure prose give absent/system as successful RERUN then READ then CFG(system) then return, with no arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "Arena success asserts CFG(arena) and return without verified literal-pattern, completed-line, or function-return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "They give Unicode arena as successful RERUN then READ then CFG(arena) then return, with no system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "arena-stop's complete line then panic is stated, but literal-arm reachability and successful-line semantics are unverified." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop completes RERUN,CFG(arena) then explicitly panics when writes succeed, and BUILD-MAP-ORDERED makes the prefix inert with no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode R-only rejections lack verified wildcard/tuple patterns and successful stdout-line effect." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave RERUN, attempt no allocator write, explicitly panic, and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed RERUN line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "It models failed-call byte prefixes and all sites, but the preceding complete RERUN relies on uncited println-success semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "It covers first-write failure before READ and each later CFG failure after RERUN, permits byte prefixes, and assigns no library to every failed exit." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but pattern/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "BUILD-MAP use is narrow, but successful raw traces and exact Rust all/not cfg source mapping remain incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful current CFG(a) reaches compilation; exact admitted allocator, feature, and target mappings feed Rust cfg source selection under qualified BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but pattern selection, complete-line success, and normal return are unverified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The freshness outcomes are correct textually, but prerequisite successful-arena and arena-stop local traces lack full authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness witness derives prior RERUN,CFG(arena), registered present-value change, mandatory rerun, exhaustive failed exits, and no stale artifact." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key/value cfg semantics are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The exclusion asserts all truth/falsehood without verifying Rust all/key-value semantics and depends on incomplete B8." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32/arena makes the compile_error! cfg true regardless of burst and rejects all such current compilations, with no excluded API case." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key/value cfg semantics are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "H/not-H selection is asserted without version-matched all/not and false-cfg authority or complete mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines H exactly as aarch64/burst-on/arena and states admitted mappings plus all/not cfg semantics select the first body on H and the checked complement otherwise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but pattern/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "BAD has the right safe-zero and UB facts, but current-body reachability rests on incomplete build/cfg derivations." + }, + "s2": { + "decision": "PASS", + "evidence": "BAD supplies supported safe lane_id(0), H-selected reachability, false nonzero condition, exact zero-UB consequence, and the UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but pattern/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "SOUND is algebraically right, but its positive and excluded-case proofs rely on unverified cfg and if/comparison behavior." + }, + "s2": { + "decision": "PASS", + "evidence": "SOUND removes exactly H/zero; the positive bullets cover every member and BAD applies to every complement profile/debug fiber, proving maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but pattern/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The not-H zero panic assertion has no verified if/equality semantics and lacks complete Required-to-body mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every supported not-H zero input executes the check and panic before the unsafe call, with profiles and debug states retained." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because pattern/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The intended verdict is present, but B12/B14 do not supply complete applicable certificates." + }, + "s2": { + "decision": "PASS", + "evidence": "It separately reports the full panic postcondition UNPROVED, not CONTRACT-BROKEN, because H/zero has UB while all not-H zero cases are proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although pattern/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "UNSOUND is issued while the current-source reachability link lacks verified pattern, output, return, and cfg semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND claims necessarily rely on unchecked Result/pattern, println-success, function-return, all/not, and if/comparison premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because pattern/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "BAD's reachability chain is incomplete despite correct safe-use, false-precondition, and UB assertions." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED remains narrow, but numerous material Rust semantic premises are unverified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The TCB log names BUILD-MAP-ORDERED, exact identity and consumers, denies widening, and uses official versioned Rust pages for semantic premises." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify match-arm choice or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "It states exact Result/VarError and literal/wildcard cases, but does not verify match-arm choice or tuple-struct enum-pattern semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 2 proves the exact absent, three named Unicode, other-Unicode, and non-Unicode partition from Result, VarError, as_str, literals, and wildcard." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The [R,S] system returns lack verified match selection and implicit function-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 3 gives omitted/system as R,S then successful return when both writes succeed, and exactly the system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The [R,A] arena return lacks verified match-arm and falling-through-main return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 3 gives Unicode arena as R,A then successful return on successful writes, and exactly the arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The complete arena-stop prefix/panic is stated, but exact arm selection is unsupported without match semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 4 gives arena-stop either allocator-write failure after R or completed R,A followed by explicit panic, with no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The R-only rows are stated, but NotUnicode tuple matching and match control are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 4 gives other Unicode and non-Unicode explicit panic after R, no allocator line, and no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but match-arm selection and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The Cargo mapping is exact conditionally, but upstream selector partition/success traces lack match and return authority." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 5 restricts downstream consumption to successful R,S/R,A, then maps exact allocator, burst, target cfgs, and Rust-selected source under qualified BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but match-arm selection for arena and arena-stop is unverified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The stale sequence is complete textually, but the successful arena and arena-stop source paths are not validly established." + }, + "s2": { + "decision": "PASS", + "evidence": "Its freshness proof uses the prior R,A run, arena-to-arena-stop staleness, forced rerun, three failed outcomes, and prohibition on prior-artifact reuse." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg rules are checked; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The compile_error argument is correct conditionally, but effective current-build mapping remains incomplete through B8." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves the wasm32/arena predicate retains compile_error! independently of burst, profile, and debug assertions and excludes that pair from L and the witness." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg rules are checked; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "Cfg all/not semantics are supplied, but the supported current-source partition depends on incomplete B4/B8 reachability." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines C as exactly aarch64/burst-on/arena and proves cfg selects the immediate unchecked block there and the complementary checked block elsewhere." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but match-arm selection and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "Zero falsity and UB are authoritative, but the safe call's current-library reachability is incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "The opening certificate gives supported safe lane_id(0), selected unchecked reachability, false nonzero condition, exact zero-UB consequence, and an UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but match-arm selection and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "M has the exact intended set shape, but inclusion/maximality also use unverified if/comparison behavior and incomplete reachability." + }, + "s2": { + "decision": "PASS", + "evidence": "M excludes exactly C/zero; the report proves every included checked or nonzero case sound and every complement fiber UB, hence exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but match-arm selection and implicit-return premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "It asserts zero enters the checked panic without verifying Rust if/comparison semantics or complete build-to-body coverage." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves zero enters the checked branch and panics before unsafe code for every supported not-C configuration, with profile/debug fibers covered." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because match-arm selection and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "UNPROVED is stated, but its UB and regional-panic prerequisite proofs are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It states the global panic promise is UNPROVED rather than CONTRACT-BROKEN or PROVED because the only uncovered zero executions contain UB." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although match-arm selection and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "It reports UNSOUND without a valid authoritative match/return-supported current-library reachability link." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked match/tuple-pattern, implicit-return, and if/equality premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "Its affirmative conclusions necessarily rely on unchecked match, tuple-pattern, function-return, and if/comparison semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because match-arm selection and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The stated aarch64/burst/arena certificate is incomplete at build-path and source reachability." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material match/tuple-pattern, implicit-return, and if/equality premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The Cargo TCB is bounded, but several material Rust control-flow and pattern premises are absent from its authority log." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The report names BUILD-MAP-ORDERED exactly, confines its consumers, and separately supports Rust semantics with versioned Reference/std authority." + } + } + ], + "mode": "B", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/L.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/L.json new file mode 100644 index 0000000000..21b1fe105c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/L.json @@ -0,0 +1,462 @@ +{ + "cells": [ + { + "field": "atom:L2", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "AX-IF supplies false => else, not the claimed else => false needed on the unsafe path." + }, + "s2": { + "decision": "PASS", + "evidence": "Steps 1-2 place execution in the false else arm and contrapose AX-EMPTY to n != 0." + } + }, + { + "field": "atom:L6", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Its closure relies on the unsupported AX-IF converse and defines Required without the valid-call/input dimension." + }, + "s2": { + "decision": "PASS", + "evidence": "The report closes both obligations and the empty path over the full domain, with PROVED and Required subset-of Covered." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "B says the request 'directly defines' Required as only exact source x Rust/std x targets x profiles, omitting valid calls/inputs and executions, then uses Covered = Required for its full PROVED certificate. That is the exact contracted-Required trigger; s2 records it absent." + }, + "field": "hard_error:G1", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The formal Required product omits valid calls/inputs even though the full PROVED verdict quantifies over them." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:G11", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The positive proof necessarily relies on an inapplicable direction of its cited if authority." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "Claims every nonlocal premise is checked and reconciled while AX-IF does not support the consumed converse." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The asserted Rust-only authority set contains an unsupported AX-IF proposition." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The AX-IF evidence is directionally insufficient for the proposition the proof consumes." + } + }, + { + "field": "atom:L2", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "A4's exact quote establishes false => else, not execution of else => false as consumed in O2." + }, + "s2": { + "decision": "PASS", + "evidence": "O2 states that reaching else makes is_empty false and uses A3 to derive n != 0." + } + }, + { + "field": "atom:L6", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The advertised Required subset-of Covered certificate materially relies on A4's unsupported converse." + }, + "s2": { + "decision": "PASS", + "evidence": "O1-O3 are connected to a full-scope PROVED verdict and an explicit Required subset-of Covered certificate." + } + }, + { + "field": "hard_error:G11", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The positive proof necessarily relies on an inapplicable direction of its if authority." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "Claims only checked version-matched premises and complete reconciliation while A4 does not support the consumed converse." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "TCB-LAST-R1 overstates the branch proposition established by A4." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The checked A4 excerpt does not establish the direction of if semantics consumed by O2." + } + }, + { + "field": "atom:L2", + "label": "E", + "s1": { + "decision": "FAIL", + "evidence": "A3 quotes only false => consequent skipped and vaguely invokes other branch rules; it does not extract authority proving else-path false." + }, + "s2": { + "decision": "PASS", + "evidence": "O2 places the call on false is_empty and contraposes A1 to n != 0." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "E's proposed comment asserts representability of len - 1, but E has no checked entry for len's usize type/domain, built-in subtraction, or overflow. It therefore cannot give the required unambiguous references to checked authority propositions for the L2-L5 chain; s1 passes it." + }, + "field": "atom:L8", + "label": "E", + "s1": { + "decision": "PASS", + "evidence": "Replacement text states false is_empty, nonzero len, representable predecessor, index < len, and get_unchecked's bounds need." + }, + "s2": { + "decision": "FAIL", + "evidence": "The replacement states the desired chain but refers to no checked authority for its material usize and subtraction/overflow steps." + } + }, + { + "field": "hard_error:G11", + "label": "E", + "s1": { + "decision": "PRESENT", + "evidence": "The positive result necessarily relies on unchecked Rust numeric and control-flow authority." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The PROVED conclusion necessarily relies on unchecked Rust type/domain, subtraction, and overflow propositions." + } + }, + { + "field": "hard_error:LH4", + "label": "E", + "s1": { + "decision": "PRESENT", + "evidence": "Calls the authority list complete while silently consuming usize, subtraction, overflow, and inadequately checked branch semantics." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It affirmatively calls the authority list complete while silently consuming the omitted integer premises." + } + }, + { + "field": "tcb_authority_defect", + "label": "E", + "s1": { + "decision": "PRESENT", + "evidence": "The purported authoritative inventory omits multiple consumed Rust premises." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Several material Rust/std premises have no checked version-matched authority entry." + } + }, + { + "field": "atom:L2", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "AX-IF quotes false => else but the proof uses the unsupported converse else => false." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 2 identifies the false else path and contraposes the zero-length is_empty contract to L != 0." + } + }, + { + "field": "atom:L3", + "label": "F", + "s1": { + "decision": "PASS", + "evidence": "AX-LEN explicitly identifies L as an element count represented as usize; as a natural count, L != 0 yields L >= 1." + }, + "s2": { + "decision": "FAIL", + "evidence": "Although AX-LEN notes a usize return, the report substitutes 'natural count' and never checks the required nonnegative usize value-domain premise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "F's replacement asserts representable subtraction while its report has no checked usize/subtraction/overflow entries, so it cannot reference checked propositions for the full chain. The text also says only 'in bounds for this same slice' without identifying get_unchecked; s1 passes L8." + }, + "field": "atom:L8", + "label": "F", + "s1": { + "decision": "PASS", + "evidence": "Supplies adjacent text from false is_empty through nonzero length, defined predecessor, and the in-bounds conclusion." + }, + "s2": { + "decision": "FAIL", + "evidence": "The proposed comment gives a bounds chain but neither identifies get_unchecked in the text nor refers to checked usize/subtraction/overflow propositions, which the report lacks." + } + }, + { + "field": "hard_error:G11", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The positive verdict necessarily relies on unchecked subtraction/overflow semantics and an inapplicable implication direction for AX-IF." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The PROVED result necessarily relies on unchecked Rust usize-domain, integer-subtraction, and overflow premises." + } + }, + { + "field": "hard_error:LH4", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "Claims a complete authoritative reconciliation while silently consuming subtraction/overflow semantics and reversing AX-IF." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It claims the authority inventory is complete while silently consuming Rust integer-domain, subtraction, and overflow semantics." + } + }, + { + "field": "tcb_authority_defect", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The asserted Rust-only TCB omits consumed subtraction/overflow authority and overclaims the cited if proposition." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Material Rust integer premises are asserted without applicable checked Rust 1.82.0 authority." + } + }, + { + "field": "atom:L2", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "A4 quotes false => else but uses it as else => false on the unsafe path." + }, + "s2": { + "decision": "PASS", + "evidence": "OBL-1 identifies the false else path and contraposes A3 to n != 0." + } + }, + { + "field": "atom:L3", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "A2 verifies only element count; the proof's n: usize premise is neither inventoried nor checked as len's return type." + }, + "s2": { + "decision": "PASS", + "evidence": "The proof explicitly takes n: usize, applies A7's unsigned domain, and derives n >= 1." + } + }, + { + "field": "atom:L6", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "Full Required closure depends on the unsupported branch converse and unverified len-to-usize link." + }, + "s2": { + "decision": "PASS", + "evidence": "The report connects the exhaustive branch proof to A1, reports full-scope PROVED, and states Covered = Required." + } + }, + { + "field": "hard_error:G11", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "The implementation verdict necessarily relies on unchecked/inapplicable Rust authority at two material links." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "Certifies A1-A7 as complete while silently consuming len's return type and reversing the checked A4 implication." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "TCB-LAST-1 omits the consumed len return-type proposition and overclaims A4." + }, + "s2": { + "decision": "PRESENT", + "evidence": "A consumed standard-library return-type premise is not inventoried and quoted as authority, and AX-IF's excerpt is directionally incomplete." + } + }, + { + "field": "atom:L2", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "A2 quotes false => else but claims that execution of else entails false, reversing the cited implication." + }, + "s2": { + "decision": "PASS", + "evidence": "Steps 1-2 identify false is_empty on else and contrapose A1 to L != 0." + } + }, + { + "field": "atom:L6", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The claimed exhaustive full-scope closure depends materially on A2's unsupported converse." + }, + "s2": { + "decision": "PASS", + "evidence": "The exhaustive branch proof closes A7 for the entire exact domain, reports PROVED, and states Required subset-of Covered." + } + }, + { + "field": "hard_error:G11", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "The PROVED result necessarily relies on an invalid converse of the quoted if rule." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "Attests complete premise reconciliation although A2's quoted authority does not establish the branch proposition consumed." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "TCB-LAST-1 overstates what its A2 authority excerpt verifies." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The quoted A2 text is insufficient for the branch direction used in the proof." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "J consumes true-condition exclusion of the else arm, but AX-IF quotes only true=>consequent-executes and false=>else-executes; it omits the exact prose that true skips else. The extracted prose therefore does not supply the consumed proposition. s1 passes L10 while materially equivalent incomplete extractions fail elsewhere." + }, + "field": "atom:L10", + "label": "J", + "s1": { + "decision": "PASS", + "evidence": "Each consumed Rust/std premise has a narrow 1.82.0 URL, exact excerpt, proposition, consumer, and applicability statement." + }, + "s2": { + "decision": "FAIL", + "evidence": "AX-IF quotes true=>consequent and false=>else but omits the text that a true condition skips else, so the quotation does not supply the consumed else-reached=>false direction." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "J attests that its inventory exactly matches every semantic leaf, but O1's true-arm exclusion is not established by its quoted AX-IF fragments. This is the same reconciliation gap both scorers recognize in B/D/I; s1 passes J." + }, + "field": "atom:L11", + "label": "J", + "s1": { + "decision": "PASS", + "evidence": "Explicitly maps every AX entry to O1-O3 and states no unlisted Rust/std or tool premise supplies an inference." + }, + "s2": { + "decision": "FAIL", + "evidence": "The claimed exact reconciliation depends on the inadequately extracted AX-IF branch-selection proposition." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "TCB-R1 claims proposition-matched checked authority, yet its AX-IF extraction omits true=>skip-else while O1 consumes that exclusivity. s1 marks no authority defect although it marks the equivalent incomplete AX-IF authority in B/D/I; s2 correctly marks it present." + }, + "field": "tcb_authority_defect", + "label": "J", + "s1": { + "decision": "ABSENT", + "evidence": "The Rust 1.82 authority inventory is complete, applicable, checked, and reconciled." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The AX-IF quotation does not establish the converse branch fact the proof consumes." + } + } + ], + "mode": "L", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/P.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/P.json new file mode 100644 index 0000000000..8fb337b53c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/P.json @@ -0,0 +1,94 @@ +{ + "cells": [ + { + "consistency_review": { + "decision": "FAIL", + "evidence": "H lines 49-56 explicitly call S0 the exact Scarlet configuration predicate, but S0 omits v in V and t in T. Lines 58-59 add those bounds only to DS through Base; silently promoting that later conjunction into the standalone S0 atom would collapse P1 into P6." + }, + "field": "atom:P1", + "label": "H", + "s1": { + "decision": "PASS", + "evidence": "H lines 49–59 give the exact Scarlet predicate within full Base(c)." + }, + "s2": { + "decision": "FAIL", + "evidence": "L49-56 labels S0 the exact Scarlet configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DS." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "H lines 61-68 explicitly call I0 the exact Indigo configuration predicate, but I0 omits v in V and t in T. Lines 70-71 repair only the induced DI full-case set through Base, not the P2 configuration-predicate proposition." + }, + "field": "atom:P2", + "label": "H", + "s1": { + "decision": "PASS", + "evidence": "H lines 61–71 give the exact Indigo predicate within full Base(c)." + }, + "s2": { + "decision": "FAIL", + "evidence": "L61-68 labels I0 the exact Indigo configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DI." + } + }, + { + "field": "hard_error:G11", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "H's positive rejection and coverage claims necessarily rely on unchecked all/not Rust semantics absent from its exact-version authority inventory." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The positive rejection and non-turbo selection proofs at L99-112 and L139-140 necessarily rely on unchecked all/not Rust authority." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "H lines 11-16 claim whole-domain soundness and behavior PROVED, while lines 139-143 use an unchecked complementary/not cfg rule for the non-turbo region admitted by Covered and lines 173-175 claim closure from it. Thus the affirmative verdicts lack a valid authority-closed Required subset-of Covered certificate." + }, + "field": "hard_error:PH4", + "label": "H", + "s1": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + }, + "s2": { + "decision": "PRESENT", + "evidence": "L11-16 and L173-175 claim whole-domain soundness/behavior although the Covered derivations rely on the unverified not cfg premise at L139-140." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "H lines 17-19 and 99-112 claim universal turbo/wasm rejection. They provide BUILD-MAP mapping, cfg-attribute text, and compile_error text, but no applicable exact-version all-predicate implication for the material step from two true leaves to cfg(all(...)) true." + }, + "field": "hard_error:PH5", + "label": "H", + "s1": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + }, + "s2": { + "decision": "PRESENT", + "evidence": "L17-19 and L99-112 affirm universal turbo/wasm rejection without an applicable exact-version all implication." + } + }, + { + "field": "tcb_authority_defect", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "H omits material all/not Rust authority and fails to carry the accepted-TCB qualification into its behavioral conclusion." + }, + "s2": { + "decision": "PRESENT", + "evidence": "L99-112 and L139-140 omit exact-version all/not authority, and L15-16 omits conspicuous TCB qualification from behavior." + } + } + ], + "mode": "P", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/Q.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/Q.json new file mode 100644 index 0000000000..370aa12245 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/Q.json @@ -0,0 +1,5 @@ +{ + "cells": [], + "mode": "Q", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/R.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/R.json new file mode 100644 index 0000000000..9fafc7764d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-cells/R.json @@ -0,0 +1,266 @@ +{ + "cells": [ + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. A's R3 is unestablished because its safe-call certificate omits the required Rust 1.82 unsafe-function authority; conditional proposal language and a fresh-audit demand cannot cure that failed prerequisite." + }, + "field": "atom:R7", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The proposal is correctly conditional with fresh-audit instructions, but R7's R3 dependency is unsatisfied." + }, + "s2": { + "decision": "PASS", + "evidence": "The design is expressly not a new verdict, does not alter current UNSOUND, and is conditioned on an exact-snapshot fresh audit." + } + }, + { + "field": "hard_error:G5", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The affirmative `UNSOUND` result lacks a checked-authority basis for one material valid-safe-use link." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND while the valid-safe-use link is incomplete: ordinary-function call safety is asserted without the required version-matched Rust authority." + } + }, + { + "field": "hard_error:G11", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The report necessarily relies on uncited Rust semantics to conclude the ordinary function call carries no safety obligation." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Its certificate necessarily relies on an unchecked safe-versus-unsafe-function premise omitted from the cited Rust 1.82 authority set." + } + }, + { + "field": "tcb_authority_defect", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "`TCB-R182` omits checked Rust 1.82 safe-versus-unsafe-function authority consumed by witness validity." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-R182 claims the semantic premises are the cited authorities, but no Rust 1.82 unsafe-function authority supports the material assertion that increment's call carries no unsafe obligation." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. D's R3 is unestablished because its valid-safe-call premise lacks checked Rust 1.82 unsafe-function authority, so its otherwise conditional and unaudited sketch cannot make R7 pass." + }, + "field": "atom:R7", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The sketch is correctly conditional and requires fresh audit, but R7's R3 dependency is not established." + }, + "s2": { + "decision": "PASS", + "evidence": "It tells the reader not to regard the sketch as audited or PROVED and requires a new exact-snapshot audit after implementation." + } + }, + { + "field": "hard_error:G5", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The `UNSOUND` conclusion lacks an authority-complete valid-safe-use link for the ordinary function call." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND with an incompletely verified valid-safe-use link because safe ordinary-function calling semantics are not sourced." + } + }, + { + "field": "hard_error:G11", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The proof necessarily relies on unchecked Rust safe-function caller semantics while claiming only cited version-matched axioms." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The certificate necessarily relies on unchecked safe-versus-unsafe-function authority absent from TCB-0." + } + }, + { + "field": "tcb_authority_defect", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB omits checked Rust 1.82 authority for the ordinary-versus-unsafe-function premise consumed by witness validity." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-0 cites visibility, implementation, unsafe-trait, slice, and wrapping propositions but omits authority for the material safe-function call premise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. F's R3 fails through its authority-incomplete safe-use certificate; saying the redesign is not a verdict and needs fresh audit satisfies direct clauses but not the dependency." + }, + "field": "atom:R7", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "It conditions the redesign on implementation and fresh audit, but the R3 dependency remains unmet." + }, + "s2": { + "decision": "PASS", + "evidence": "It says the proposal is not a new verdict and requires a fresh audit of the implemented snapshot and migrated callers." + } + }, + { + "field": "hard_error:G5", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The report issues `UNSOUND` without an authority-complete proof that both the impl and ordinary function call are valid safe use." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND although one required existential link, valid safe calling of increment, is asserted without the required version-matched authority." + } + }, + { + "field": "hard_error:G11", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "Its proof necessarily relies on unchecked Rust trait/function safety-boundary semantics omitted from `TCB-R033`." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics absent from TCB-R033." + } + }, + { + "field": "tcb_authority_defect", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB lists visibility/coherence and library contracts but omits checked unsafe-trait and unsafe-function rules consumed by witness validity." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-R033 includes visibility, trait implementation, slice, and wrapping authorities but omits authority for its material assertion that increment is safely callable." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. G's R3 is unestablished because AX-ACCESS does not verify ordinary-function caller safety, so the explicit post-implementation audit does not satisfy the failed prerequisite." + }, + "field": "atom:R7", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "It conditionally requires fresh audit, but the listed R3 prerequisite is not established." + }, + "s2": { + "decision": "PASS", + "evidence": "The redesign is explicitly not a verdict, leaves current UNSOUND unchanged, and requires a fresh audit after implementation." + } + }, + { + "field": "hard_error:G5", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "Its `UNSOUND` certificate does not authoritatively establish that the ordinary generic call is a valid safe use." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND without a fully verified valid-safe-use link because safe ordinary-function calling semantics are unsupported by its authority set." + } + }, + { + "field": "hard_error:G11", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB necessarily consumes an unchecked safe-versus-unsafe-function proposition absent from its authority inventory." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The report necessarily relies on the unchecked proposition that the non-unsafe increment declaration is callable without an unsafe obligation." + } + }, + { + "field": "tcb_authority_defect", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "`AX-ACCESS` is used to infer no caller-side unsafe obligation, but its cited visibility/implementation pages do not verify the required function rule." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-1 lists visibility, implementation, slice, and wrapping authorities but omits the material Rust 1.82 safe-versus-unsafe-function authority used by FIND-1." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. J's R3 is unestablished because its TCB omits safe-versus-unsafe-function authority for the witness call; its correct conditional framing cannot override that dependency." + }, + "field": "atom:R7", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "It leaves the sketch unimplemented and requires fresh audit, but R7's prerequisite R3 is not established." + }, + "s2": { + "decision": "PASS", + "evidence": "It labels the sketch unimplemented with no audit verdict, preserves current UNSOUND, and requires a fresh snapshot audit." + } + }, + { + "field": "hard_error:G5", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The `UNSOUND` result lacks checked support for the valid-safe-call link in its existential certificate." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND without fully verifying the valid-safe-use link; the ordinary-function call premise has no applicable cited authority." + } + }, + { + "field": "hard_error:G11", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB necessarily relies on an unchecked ordinary-function caller-safety proposition." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics omitted from TCB-R016-r1." + } + }, + { + "field": "tcb_authority_defect", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "`TCB-R016-r1` omits the Rust 1.82 safe-function authority needed to establish that calling `increment` accepts no safety obligation." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Its TCB names visibility, implementation, unsafe-trait, slice, and wrapping axioms but omits the safe-versus-unsafe-function rule material to calling increment safely." + } + } + ], + "mode": "R", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/ADJUDICATION_CELLS.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/ADJUDICATION_CELLS.json new file mode 100644 index 0000000000..1158c16b16 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/ADJUDICATION_CELLS.json @@ -0,0 +1,2454 @@ +{ + "cells": [ + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result Ok/Err exhaustiveness or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The six rows are stated exhaustive, but Result exhaustiveness and tuple-struct enum-pattern semantics are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "The relation explicitly says its omitted, system, arena, arena-stop, other Unicode, and non-Unicode rows are all raw classes." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "R,S and normal success are asserted, but successful println output, tuple-pattern handling of NotPresent, and implicit return are not authoritatively established." + }, + "s2": { + "decision": "PASS", + "evidence": "Omitted/system rows give R,S and normal success when both writes succeed, with system as the exact mapping and no arena line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The arena row has the right endpoint but lacks verified successful-output and implicit-function-return premises for the complete trace." + }, + "s2": { + "decision": "PASS", + "evidence": "The Unicode arena row gives R,A and normal success when both writes succeed, with arena as the exact mapping and no system line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The arena-stop row has the right panic/no-library result, but successful A-line completion is not verified by the cited println premise." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop gives completed R,A then explicit panic when writes succeed and is explicitly excluded from any successful current execution/library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode rows are present, but successful R output and tuple-struct-pattern semantics are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Other-Unicode and non-Unicode give completed R, explicit panic, no allocator attempt, and no current library under the accepted premise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "It handles failed calls and incomplete bytes, but the completed R prefix used after second-write failure lacks a verified successful-println effect." + }, + "s2": { + "decision": "PASS", + "evidence": "It covers failed R before classification and each allocator-write failure after R, allows incomplete failing bytes, and gives every failed exit no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output/normal-return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "Exact TCB consumers are listed, but upstream successful traces and Rust all/not source selection are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "The successful mapping is limited to accepted returns; exact allocator, burst, and target cfgs feed Rust source selection with BUILD-MAP-ORDERED conspicuously bounded." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior R/arena prefix and arena-stop path rest on unverified successful-output and pattern premises; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The freshness prose is exact, yet the prerequisite successful arena and completed-line local trace lacks full Rust authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness proof derives prior R,A, present-to-present arena-stop invalidation, rerun, every failed outcome, and no prefix or old artifact as current." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The exclusion uses all(...) without verifying Rust all/key-value truth semantics, and depends on incomplete successful-selector closure." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves successful wasm32/arena sets both cfg leaves, retains compile_error! for all feature/profile/debug cases, and yields no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "It calls the blocks complementary but never verifies all/not configuration semantics or complete build-to-source reachability." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines C exactly as aarch64/burst-on/arena and proves the cfg blocks form an exhaustive complementary C/not-C source partition." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output/normal-return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The witness states all four ideas, but authoritative reachability through the successful arena build and selected block is incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It gives supported safe zero use in C, exact unchecked reachability, false nonzero proposition, versioned zero-UB consequence, and whole-domain UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output/normal-return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "M has the intended formula, but the positive and complement proofs consume the unproved body/build partition." + }, + "s2": { + "decision": "PASS", + "evidence": "M is Supported×V with C/zero removed; the report proves all M cases safe and all excluded points UB, hence both containment and exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output/normal-return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The not-C zero proof is conditional on an unproved current-source partition and therefore does not cover the required build relation." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every not-C zero call takes the equality branch and panics before the unsafe call across all profile/debug fibers." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output/normal-return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "It gives the intended UNPROVED wording, but the underlying B12 and B14 derivations are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It says the whole panic promise is UNPROVED, not CONTRACT-BROKEN, because C/zero contains UB while not-C/zero is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output/normal-return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "UNSOUND is issued without an authoritative complete reachability chain through normal build-script return and exact cfg selection." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "PROVED and UNSOUND conclusions necessarily rely on unchecked successful-println, function-return, Result-pattern, and all/not premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output/normal-return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The asserted witness lacks a validly established supported-current-library reachability link." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB itself is kept narrow, but material Rust premises for build completion and cfg selection are not verified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The report identifies BUILD-MAP-ORDERED and restricts it to exact accepted Cargo/status/freshness leaves; Rust claims use 1.85.1 official sources." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Absent/system [RERUN,CS] normal return is asserted without verified println success or implicit function-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Absent/system success is exactly RERUN,CS then normal return and the system cfg; no arena line is present." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Arena [RERUN,CA] normal return lacks verified completed-line and implicit-return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "Unicode arena success is exactly RERUN,CA then normal return and the arena cfg; no system line is present." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output needed for the completed R and allocator prefixes; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Arena-stop's later panic is right, but successful CA completion is not verified because AX-EXIT covers only println failure." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop with successful writes leaves RERUN,CA then explicit panic, and the report states the completed selector cannot produce a current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output needed for the completed R and allocator prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Both rejection classes are partitioned correctly, but the completed RERUN prefix lacks verified successful println output semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave only RERUN, explicitly panic without allocator output, and produce no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "It handles every failure and arbitrary partial bytes, but the required preceding completed [RERUN] is not supported by a verified successful-println proposition." + }, + "s2": { + "decision": "PASS", + "evidence": "It models partial(L), covers first-write and every second-write failure, preserves only earlier complete RERUN, and rejects every failed execution." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The TCB and cfg stages are explicit, but the successful/failure local relation remains incomplete through B3-B7." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful RERUN,CS/CA is consumed; exact allocator, burst, and target cfgs then select source under conspicuously bounded BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior successful RERUN/arena prefix lacks verified successful-output semantics; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Freshness outcomes are enumerated, but the prior successful [RERUN,CA] trace lacks output/return authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness witness derives prior RERUN,CA, present-value change, forced rerun, three unsuccessful cases, and no stale/current arena result." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The wasm/arena cfg proof is correct conditionally, but actual effective closure depends on incomplete B8 selector success." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32/arena alone activates compile_error! independent of burst, profile, and debug assertions, with no library or witness from that pair." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "AX-CFG proves complementarity conditionally, but supported current-source selection depends on incomplete B4/B8." + }, + "s2": { + "decision": "PASS", + "evidence": "The source closure defines F exactly as aarch64/burst-on/arena and selects only the unchecked body there and only the checked body elsewhere." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The zero/NZ/UB links are correct, but current Q-library reachability is incomplete at successful script output/return." + }, + "s2": { + "decision": "PASS", + "evidence": "It supplies supported A64/burst-on/arena lane_id(0), safe-use validity, selected reachability, false NZ, authoritative zero UB, and UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Smax and the four cases are exact algebraically, but every-complement UB reachability is not completely established." + }, + "s2": { + "decision": "PASS", + "evidence": "Smax is not-F or nonzero; three included cases prove soundness and F/zero proves every complement point UB, establishing maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The checked-body zero proof is correct conditionally, but complete Required-to-body coverage through B8 is absent." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every supported not-F zero case takes the equality branch and panics before unsafe, with all P×D fibers retained." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "The intended verdict is stated, but B12/B14 do not provide complete applicable certificates." + }, + "s2": { + "decision": "PASS", + "evidence": "It reports the global zero-panic theorem UNPROVED rather than CONTRACT-BROKEN because only UB cases remain after the proved not-F region." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND without a fully verified successful-build reachability link." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked successful-println and implicit-main-return premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND conclusions necessarily rely on unchecked successful-println and function-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "Its A64/on/arena safe-call certificate is incomplete at println success and normal main return." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material successful-println and implicit-main-return premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded correctly, but material successful-output and normal-return Rust premises are unverified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The exact BUILD-MAP-ORDERED entry and its narrow consumers are recorded; Cargo is not used as Rust authority and Rust claims cite 1.85.1 sources." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The table lists all six classes, but exact Result/VarError variant exhaustiveness and literal/wildcard/tuple-pattern semantics are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "The ordered-relation table explicitly calls omitted, system, arena, arena-stop, other Unicode, and non-Unicode exhaustive." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The two system rows lack verified enum/literal pattern selection and implicit main-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Its first two table rows give R then READ then the system line and normal return when both writes succeed, with no arena line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The arena row states R,A0 success but does not verify literal-pattern selection or normal function return." + }, + "s2": { + "decision": "PASS", + "evidence": "The Unicode arena row gives R then READ then the arena line and normal return on successful writes, with no system line." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "R,A0 then panic/no library is stated, but reaching the arena-stop arm is unsupported by applicable literal-pattern authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The arena-stop row gives completed R,A followed by explicit panic and states that BUILD-MAP-ORDERED produces no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The rejection rows are correct textually, but wildcard and NotUnicode tuple-pattern selection are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Other-Unicode and non-Unicode rows leave only R, panic before any allocator attempt, and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful arm selection/return and all/not cfg semantics are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "Cargo effects are narrowly qualified, but the successful local traces and exact Rust cfg truth/selection relation remain incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It limits cfg consumption to successful selector returns, names exact allocator, feature, and target mappings, applies Rust cfg rules, and conspicuously qualifies BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection and the successful arena return are not fully verified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The requested stale-build outcomes are enumerated, but prerequisite arena/arena-stop path selection and successful return are unverified." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness challenge derives prior R,A, present-to-present arena-stop invalidation, rerun, exhaustive failed exits, and no stale result." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "It asserts the wasm32/arena all predicate and converse without verifying all, option-truth, and false-cfg removal semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32 plus arena retains compile_error! for either feature and all profile/debug fibers, while that pair has no API case." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "Q/not-Q are called complementary without verified all/not cfg rules and complete successful mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines Q as exactly aarch64/burst-on/arena and proves the two cfg bodies are the exhaustive disjoint Q and not-Q selections." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful arm selection/return and all/not cfg semantics are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The stated safe zero witness lacks a valid authoritative source-reachability derivation." + }, + "s2": { + "decision": "PASS", + "evidence": "It gives a supported safe lane_id(0) in Q, reaches new_unchecked(0), falsifies nonzero, applies the 1.85.1 UB contract, and says UNSOUND relative to BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful arm selection/return and all/not cfg semantics are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The maximal formula and case split are correct, but rely on unproved cfg/build reachability and false-if behavior." + }, + "s2": { + "decision": "PASS", + "evidence": "It states M = C×U minus Q/zero, proves checked and Q/nonzero sufficiency, and proves every excluded Q/zero point has UB, establishing exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful arm selection/return and all/not cfg semantics are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The regional panic assertion lacks a complete cfg/body and false/true conditional-semantics derivation over Required." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every zero-input not-Q case takes the checked branch and panics before unsafe code, parametrically over profiles and debug assertions." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful arm selection/return and all/not cfg semantics are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "C", + "s1": { + "decision": "FAIL", + "evidence": "The verdict is worded correctly, but neither its complete UB certificate nor regional proof is established." + }, + "s2": { + "decision": "PASS", + "evidence": "It separately reports the whole zero-panic postcondition UNPROVED, not CONTRACT-BROKEN, because Q/zero has UB while all other zero cases are proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful arm selection/return and all/not cfg semantics are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "The UNSOUND verdict rests on an incompletely authorized successful-selector and cfg-body reachability chain." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "The report necessarily relies on unchecked Result/pattern, function-return, and all/not semantics for its affirmative conclusions." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful arm selection/return and all/not cfg semantics are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "The existential certificate's reachability link is not validly established from the cited Rust premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "C", + "s1": { + "decision": "PRESENT", + "evidence": "Although BUILD-MAP-ORDERED is bounded, required Rust semantic leaves for exhaustive paths and cfg selection are missing." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is identified and narrowly consumed only for its accepted Cargo/freshness/status mappings; Rust premises use versioned official authority." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The R,CS rows assert return success, but no versioned function-body premise establishes implicit normal return after the final println." + }, + "s2": { + "decision": "PASS", + "evidence": "Omitted and Unicode system rows give R,CS then normal success if both writes succeed, with no arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The R,CA arena row likewise lacks authoritative implicit-return completion despite correct order/output reasoning." + }, + "s2": { + "decision": "PASS", + "evidence": "The Unicode arena row gives R,CA then normal success if both writes succeed, with no system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but normal main return is an unverified material edge; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "Cargo/cfg composition is otherwise exact, but the only-successful-return premise consumes unverified implicit main-return semantics from B3/B4." + }, + "s2": { + "decision": "PASS", + "evidence": "Exactly the accepted successful classes feed current allocator cfgs; the report then applies admitted burst/target leaves and Rust cfg semantics under an explicit TCB alias." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping still depends on the unverified normal-return edge; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The compile_error proof is exact conditionally, but effective build-to-source closure still depends on the incomplete successful-arena B8 derivation." + }, + "s2": { + "decision": "PASS", + "evidence": "The exact-exclusion section proves both directions of wasm32/arena compile_error! rejection for every feature/profile/debug fiber and no API case." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping still depends on the unverified normal-return edge; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The all/not body proof is exact conditionally, but current supported-source reachability depends on the incomplete B4/B8 success relation." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines K exactly as aarch64/burst-on/arena and proves the first and not-all blocks select K and its complement over all P×D." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but normal main return is an unverified material edge; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "Safe use, false NZ, and zero-UB are authoritative; current-library reachability remains incomplete at the build-script normal-return edge." + }, + "s2": { + "decision": "PASS", + "evidence": "F-UB gives a supported safe lane_id(0), K reachability, false NZ, exact new_unchecked zero UB, and the UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but normal main return is an unverified material edge; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "M/WIT are algebraically exact, but maximality consumes the incomplete supported reachability certificate." + }, + "s2": { + "decision": "PASS", + "evidence": "M removes exactly WIT=K/zero; all M cases discharge NZ or panic, and each complement point has UB, proving equality and maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but normal main return is an unverified material edge; the Required-to-selected-body reachability chain is incomplete at normal main return; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The zero-source proof is correct conditionally, but Required-to-current-body coverage is incomplete through B8/B11." + }, + "s2": { + "decision": "PASS", + "evidence": "The report proves every not-K zero case executes the equality branch and panic before unsafe across the supported configuration fibers." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because normal main return is an unverified material edge; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The intended UNPROVED reasoning is present, but its prerequisite complete B12 and B14 certificates do not hold." + }, + "s2": { + "decision": "PASS", + "evidence": "It reports the universal panic contract UNPROVED, not CONTRACT-BROKEN or PROVED, because K/zero has UB and the complement is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although normal main return is an unverified material edge; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND although the current supported library reachability link omits verified implicit-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked implicit-main-return semantics; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "Its build/source and maximality affirmatives necessarily rely on unchecked function-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because normal main return is an unverified material edge; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "F-UB's raw-arena-to-current-library reachability certificate is incomplete at normal main return." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material implicit-main-return semantics remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The exact TCB is carefully bounded, but normal build-script return is a material unverified Rust premise used by positive verdicts." + }, + "s2": { + "decision": "ABSENT", + "evidence": "TCB-ORDERED is explicitly defined as the exact BUILD-MAP-ORDERED entry and is not widened; Rust claims use versioned official sources." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but delegates the Rust-semantic raw partition to BUILD.md and does not verify Result/VarError or exact pattern behavior; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "It calls the partition exhaustive but explicitly lets BUILD.md supply it; Result/VarError exhaustiveness and exact pattern behavior are not verified as Rust semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "B-01 explicitly labels omitted, system, arena, arena-stop, every other Unicode, and non-Unicode as the exhaustive remaining relation." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The system rows lack exact match/pattern and implicit-return authority despite showing the intended R,L_s endpoint." + }, + "s2": { + "decision": "PASS", + "evidence": "Omitted/system successful R,L_s writes end in normal return and exactly system; no arena selector occurs." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The arena row shows R,L_a success but does not verify exact literal-arm selection or falling-through main return." + }, + "s2": { + "decision": "PASS", + "evidence": "Unicode arena successful R,L_a writes end in normal return and exactly arena; no system selector occurs." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "Its arena-stop prefix/panic outcome is correct, but reaching that literal arm is not established by the cited vague match premise." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop completes R,L_a then explicitly panics when writes succeed, and both its exits are assigned no current result." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode outcomes are listed, but wildcard and tuple-struct pattern semantics are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave R, panic before any selector attempt, and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but raw-path selection/normal return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "Exact TCB use is described, but selector success/exhaustiveness and Rust cfg all/not source selection remain incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Only normal accepted exits supply the exact current allocator cfg; admitted feature/target mappings and Rust cfg select source under explicit BUILD-MAP-ORDERED limits." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection is delegated to unchecked source claims; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The three rerun failures are right, but the prior-success and arena-stop arm derivations rely on unchecked local Rust semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "B-02 derives prior successful R,L_a, present arena-stop staleness, forced rerun, three failed outcomes, and no stale/current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not and false-cfg selection are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "B-03 asserts all(...) and exact rejection without verifying all/key-value cfg semantics or complete B8 mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "B-03 proves every wasm32/arena fiber retains compile_error! and fails compilation, while this pair is outside Q and no API is produced." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not and false-cfg selection are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "The C/not-C block split is asserted without version-matched all/not and false-cfg semantics, atop incomplete mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "B-03 defines C exactly as aarch64/burst-on/arena and states cfg selects only the immediate unchecked body on C and only the checked body on not-C." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but raw-path selection/normal return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "F-01 states four bullets, but supported current-source reachability is not validly established by the report's authorities." + }, + "s2": { + "decision": "PASS", + "evidence": "F-01 gives a supported safe lane_id(0), C reachability, false nonzero requirement, exact standard-library UB, and the UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but raw-path selection/normal return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "S has the intended formula, but its complement proof relies on the incomplete cfg/build reachability chain." + }, + "s2": { + "decision": "PASS", + "evidence": "S is not-C or nonzero; S-01/S-02 prove every included case sound and every excluded C/zero case UB, establishing exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but raw-path selection/normal return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "S-01's zero panic proof is only conditional on an unproved complementary source selection." + }, + "s2": { + "decision": "PASS", + "evidence": "S-01 proves every supported not-C zero input executes panic before unsafe and explicitly covers all profile/debug states." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because raw-path selection/normal return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "POST-01 gives the intended verdict, but B12/B14 are not complete applicable derivations." + }, + "s2": { + "decision": "PASS", + "evidence": "POST-01 declares the universal panic theorem UNPROVED rather than CONTRACT-BROKEN, because C/zero has UB and the complement is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although raw-path selection/normal return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "UNSOUND is issued without a valid authoritative reachability link through the accepted raw arena path and cfg body." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, exact-pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The report expressly uses BUILD.md to supply a Rust-semantic raw partition and also omits material return/all-not authorities." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because raw-path selection/normal return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "F-01's current-library/source reachability link is incomplete despite correct zero and UB propositions." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, exact-pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "It treats BUILD.md as supplying the complete raw semantic partition and leaves other material Rust cfg/return premises unchecked." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is named, scoped to its exact accepted Cargo propositions and consumers, and not substituted for cited Rust 1.85.1 semantics." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The six classes are explicitly called exhaustive, but Result's two-way shape and tuple-struct enum matching are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "The build section calls absent, system, arena, arena-stop, other Unicode including empty, and non-Unicode an exact exhaustive partition." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "Absent/system R,Sline normal return lacks verified successful-println and implicit-return premises, with tuple matching also omitted for absence." + }, + "s2": { + "decision": "PASS", + "evidence": "Absent/system successful writes give exactly R,Sline and normal return, selecting system only." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The arena success trace asserts a complete Aline and normal return without verifying println success or function-body return." + }, + "s2": { + "decision": "PASS", + "evidence": "Unicode arena successful writes give exactly R,Aline and normal return, selecting arena only." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The arena-stop ordering is stated, but completion of R/Aline on successful println calls is not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Successful arena-stop writes completed R,Aline then explicitly panics, and BUILD-MAP-ORDERED is used to derive no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The two R-only rejection rows lack verified successful-line and NotUnicode tuple-pattern premises." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode panic with completed R before any allocator attempt and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "q correctly avoids atomicity assumptions, but the completed [R] premise after a later failure lacks verified println-success semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "It covers failed R before READ and all second-write failures after R, permits an arbitrary fragment q, and assigns no source effect or library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The TCB is conspicuous and cfg rules are cited, but upstream successful return/output and exhaustive selector traces are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful selectors supply exact allocator cfgs; admitted burst/target leaves and Rust cfg then select source under explicit BUILD-MAP-ORDERED limits." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior complete R/arena prefix lacks verified println-success and normal-return premises; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The freshness sequence is exact textually, yet its successful prior [R,Aline] premise is not authoritatively established." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness certificate derives prior completed R, arena-stop invalidation, rerun, all failed outcomes, and no old library as current." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete despite otherwise checked cfg rules; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The conditional compile_error proof is correct in isolation, but effective build closure depends on the incomplete successful-arena mapping in B8." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32/arena exactly retains compile_error! for both feature states and every profile/debug fiber and is rejected before any API use." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete despite otherwise checked cfg rules; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "all/not semantics are stated, but the exact supported current-source partition still depends on the incomplete B4/B8 mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "K is exactly aarch64/burst-on/arena; cfg semantics are used to prove the first body on K and the complementary checked body on not-K." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "Valid use, false precondition, and UB are stated; the authoritative current-library reachability link is incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "F-1 gives a supported successful arena build and safe lane_id(0), reaches new_unchecked(0), falsifies its contract, applies UB, and says UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "M and both set arguments are stated, but every excluded-case UB proof consumes the incomplete reachability certificate." + }, + "s2": { + "decision": "PASS", + "evidence": "M is not-K or nonzero; the report proves each included case safe and every omitted K/zero point UB, so the region is exact and maximal." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "The not-K zero source argument is present, but the required build-to-body coverage remains incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every supported not-K zero execution takes the check and panics before unsafe, parametrically over profiles and debug states." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "UNPROVED/not-CONTRACT-BROKEN is correct, but the report has not completed the prerequisite whole UB and regional coverage proofs." + }, + "s2": { + "decision": "PASS", + "evidence": "It separately concludes the whole panic postcondition is UNPROVED, not CONTRACT-BROKEN, because K/zero is UB and not-K is proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "It reports UNSOUND while the supported-current-library reachability link lacks verified successful-output and function-return semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, and implicit-return premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "Its PROVED/UNSOUND results necessarily rely on unchecked Result/tuple, println-success, and function-return premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "F-1's reachability certificate is incomplete even though its false-precondition and UB links are correct." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, and implicit-return premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is not widened, but material Rust semantics needed for current selector success and exhaustiveness are unverified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is accepted only at its stated identity and consumers; Cargo pages are corroboration only and Rust premises use versioned authority." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "Calls the six classes exhaustive, but AX-ENV omits Result's Ok/Err exhaustiveness and tuple-struct-pattern semantics needed to exclude another outcome." + }, + "s2": { + "decision": "PASS", + "evidence": "BUILD-1 explicitly proves absent, system, arena, arena-stop, other Unicode, and non-Unicode are the exhaustive raw classes." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The R,S success row lacks verified block sequencing, successful println line effect, and implicit main-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "The table gives omitted/system successful R,S and normal return, with exactly system selected and no arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The R,A success row asserts normal return without verified source-order, successful-output, or function-return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "The table gives Unicode arena successful R,A and normal return, with exactly arena selected and no system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "It states R,A then explicit panic/no library, but the completed-line and source-order premises are not verified by its authorities." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop with successful writes leaves R,A and explicitly panics; the same row and TCB qualification say no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The R-only rejection rows lack tuple-pattern/source-order and successful-line authority sufficient for both raw classes." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave R, panic before an allocator print, and have no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify block sequencing or successful println output for the prior completed R line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "Although q models failed-call bytes, no block-order or successful-println premise verifies the prior completed R prefix at allocator-write failures." + }, + "s2": { + "decision": "PASS", + "evidence": "The table covers first-write and every class-specific second-write failure, models arbitrary failed-call fragment q, and gives no library on all failures." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but block/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The Cargo qualification is conspicuous, but the successful/failing local traces and exact Rust cfg selection needed for composition remain unproved." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful selector rows feed exact allocator cfgs; BUILD-1 and the projection apply admitted feature/target mappings and Rust cfg selection with explicit TCB boundaries." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but R-before-arena order, complete-line success, and arena-stop selection are not fully verified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "BUILD-2 states the requested sequence, but relies on unverified R-before-A successful and arena-stop local traces." + }, + "s2": { + "decision": "PASS", + "evidence": "BUILD-2 derives prior R,A, present-to-present invalidation, mandatory rerun, all three failed outcomes, and no current or stale arena library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "CFG-1 asserts all(...) truth and cfg inclusion without verifying all, key/value-option truth, and true/false cfg-attribute rules." + }, + "s2": { + "decision": "PASS", + "evidence": "CFG-1 proves wasm32/arena includes compile_error! for both feature states and all profile/debug fibers and yields no supported library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The U/not-U body partition is asserted without verified all/not, key/value, and true-versus-false cfg semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "The source projection and U definition prove the unchecked body exactly for aarch64/burst-on/arena and the checked complementary body everywhere else." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but block/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The UNSOUND witness reaches the first body only through the incomplete build/cfg derivation, so authoritative reachability is missing." + }, + "s2": { + "decision": "PASS", + "evidence": "SOUND-1 supplies a supported safe zero call, exact selected reachability, false nonzero precondition, documented UB, and whole-domain UNSOUND." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but block/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The formula is correct, but both containments rely on the unverified body/build partition and unverified false-if flow." + }, + "s2": { + "decision": "PASS", + "evidence": "S is not-U or nonzero; the positive proof covers every member and SOUND-1 applies to every omitted U/zero fiber, proving exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but block/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "The regional zero argument relies on the unverified complementary cfg selection and build-to-source closure." + }, + "s2": { + "decision": "PASS", + "evidence": "The panic section proves every supported not-U zero input executes panic before unsafe, with the domain proof retaining all profiles and debug states." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because block/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "H", + "s1": { + "decision": "FAIL", + "evidence": "UNPROVED is stated correctly, but its required UB and regional-panic certificates are incomplete because B12/B14 are unproved." + }, + "s2": { + "decision": "PASS", + "evidence": "It gives the full panic theorem UNPROVED, not CONTRACT-BROKEN, because U/zero is UB while every other zero case is regionally proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although block/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND while supported-Q reachability rests on unverified build-return and exact cfg-selection premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "Its positive build/source conclusions necessarily use unchecked Rust block, println-success, return, and all/not semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because block/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "SOUND-1 lacks a valid authoritative reachability link from raw arena through the current library to the unchecked body." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but multiple material Rust premises supporting PROVED/UNSOUND claims are not verified by applicable versioned text." + }, + "s2": { + "decision": "ABSENT", + "evidence": "BUILD-MAP-ORDERED is conspicuously limited to its exact accepted build propositions, while material Rust leaves cite 1.85.1 authority." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The six classes are stated, but Result/VarError exact variants and literal/wildcard/tuple-pattern propositions are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "It explicitly defines the disjoint exhaustive raw set as absent, three named Unicode values, other Unicode, and non-Unicode." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "System-success rows lack verified pattern selection, successful println output, and implicit return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "The table and failure prose give absent/system as successful RERUN then READ then CFG(system) then return, with no arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "Arena success asserts CFG(arena) and return without verified literal-pattern, completed-line, or function-return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "They give Unicode arena as successful RERUN then READ then CFG(arena) then return, with no system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "arena-stop's complete line then panic is stated, but literal-arm reachability and successful-line semantics are unverified." + }, + "s2": { + "decision": "PASS", + "evidence": "Arena-stop completes RERUN,CFG(arena) then explicitly panics when writes succeed, and BUILD-MAP-ORDERED makes the prefix inert with no library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode R-only rejections lack verified wildcard/tuple patterns and successful stdout-line effect." + }, + "s2": { + "decision": "PASS", + "evidence": "Other Unicode and non-Unicode leave RERUN, attempt no allocator write, explicitly panic, and produce no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed RERUN line; the required completed prefix after a later failed write is not verified." + }, + "field": "atom:B7", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "It models failed-call byte prefixes and all sites, but the preceding complete RERUN relies on uncited println-success semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "It covers first-write failure before READ and each later CFG failure after RERUN, permits byte prefixes, and assigns no library to every failed exit." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but pattern/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "BUILD-MAP use is narrow, but successful raw traces and exact Rust all/not cfg source mapping remain incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "Only successful current CFG(a) reaches compilation; exact admitted allocator, feature, and target mappings feed Rust cfg source selection under qualified BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but pattern selection, complete-line success, and normal return are unverified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The freshness outcomes are correct textually, but prerequisite successful-arena and arena-stop local traces lack full authority." + }, + "s2": { + "decision": "PASS", + "evidence": "The freshness witness derives prior RERUN,CFG(arena), registered present-value change, mandatory rerun, exhaustive failed exits, and no stale artifact." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key/value cfg semantics are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The exclusion asserts all truth/falsehood without verifying Rust all/key-value semantics and depends on incomplete B8." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves wasm32/arena makes the compile_error! cfg true regardless of burst and rejects all such current compilations, with no excluded API case." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key/value cfg semantics are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "H/not-H selection is asserted without version-matched all/not and false-cfg authority or complete mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines H exactly as aarch64/burst-on/arena and states admitted mappings plus all/not cfg semantics select the first body on H and the checked complement otherwise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but pattern/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "BAD has the right safe-zero and UB facts, but current-body reachability rests on incomplete build/cfg derivations." + }, + "s2": { + "decision": "PASS", + "evidence": "BAD supplies supported safe lane_id(0), H-selected reachability, false nonzero condition, exact zero-UB consequence, and the UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but pattern/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "SOUND is algebraically right, but its positive and excluded-case proofs rely on unverified cfg and if/comparison behavior." + }, + "s2": { + "decision": "PASS", + "evidence": "SOUND removes exactly H/zero; the positive bullets cover every member and BAD applies to every complement profile/debug fiber, proving maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but pattern/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The not-H zero panic assertion has no verified if/equality semantics and lacks complete Required-to-body mapping." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves every supported not-H zero input executes the check and panic before the unsafe call, with profiles and debug states retained." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because pattern/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The intended verdict is present, but B12/B14 do not supply complete applicable certificates." + }, + "s2": { + "decision": "PASS", + "evidence": "It separately reports the full panic postcondition UNPROVED, not CONTRACT-BROKEN, because H/zero has UB while all not-H zero cases are proved." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although pattern/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "UNSOUND is issued while the current-source reachability link lacks verified pattern, output, return, and cfg semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND claims necessarily rely on unchecked Result/pattern, println-success, function-return, all/not, and if/comparison premises." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because pattern/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "BAD's reachability chain is incomplete despite correct safe-use, false-precondition, and UB assertions." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED remains narrow, but numerous material Rust semantic premises are unverified." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The TCB log names BUILD-MAP-ORDERED, exact identity and consumers, denies widening, and uses official versioned Rust pages for semantic premises." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify match-arm choice or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + "field": "atom:B2", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "It states exact Result/VarError and literal/wildcard cases, but does not verify match-arm choice or tuple-struct enum-pattern semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 2 proves the exact absent, three named Unicode, other-Unicode, and non-Unicode partition from Result, VarError, as_str, literals, and wildcard." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B3", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The [R,S] system returns lack verified match selection and implicit function-return semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 3 gives omitted/system as R,S then successful return when both writes succeed, and exactly the system cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + "field": "atom:B4", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The [R,A] arena return lacks verified match-arm and falling-through-main return premises." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 3 gives Unicode arena as R,A then successful return on successful writes, and exactly the arena cfg." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; the complete ordered-prefix derivation is not verified." + }, + "field": "atom:B5", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The complete arena-stop prefix/panic is stated, but exact arm selection is unsupported without match semantics." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 4 gives arena-stop either allocator-write failure after R or completed R,A followed by explicit panic, with no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; both raw-arm and completed-prefix clauses are not completely proved." + }, + "field": "atom:B6", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The R-only rows are stated, but NotUnicode tuple matching and match control are not verified." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 4 gives other Unicode and non-Unicode explicit panic after R, no allocator line, and no current library." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but match-arm selection and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + "field": "atom:B8", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The Cargo mapping is exact conditionally, but upstream selector partition/success traces lack match and return authority." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 5 restricts downstream consumption to successful R,S/R,A, then maps exact allocator, burst, target cfgs, and Rust-selected source under qualified BUILD-MAP-ORDERED." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but match-arm selection for arena and arena-stop is unverified; the requested local trace prerequisite is incomplete." + }, + "field": "atom:B9", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The stale sequence is complete textually, but the successful arena and arena-stop source paths are not validly established." + }, + "s2": { + "decision": "PASS", + "evidence": "Its freshness proof uses the prior R,A run, arena-to-arena-stop staleness, forced rerun, three failed outcomes, and prohibition on prior-artifact reuse." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg rules are checked; effective current-build rejection is not completely derived." + }, + "field": "atom:B10", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "The compile_error argument is correct conditionally, but effective current-build mapping remains incomplete through B8." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves the wasm32/arena predicate retains compile_error! independently of burst, profile, and debug assertions and excludes that pair from L and the witness." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg rules are checked; both directions of current supported source selection are not completely proved." + }, + "field": "atom:B11", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "Cfg all/not semantics are supplied, but the supported current-source partition depends on incomplete B4/B8 reachability." + }, + "s2": { + "decision": "PASS", + "evidence": "It defines C as exactly aarch64/burst-on/arena and proves cfg selects the immediate unchecked block there and the complementary checked block elsewhere." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but match-arm selection and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + "field": "atom:B12", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "Zero falsity and UB are authoritative, but the safe call's current-library reachability is incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "The opening certificate gives supported safe lane_id(0), selected unchecked reachability, false nonzero condition, exact zero-UB consequence, and an UNSOUND verdict." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The maximal-region formula is correct, but match-arm selection and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + "field": "atom:B13", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "M has the exact intended set shape, but inclusion/maximality also use unverified if/comparison behavior and incomplete reachability." + }, + "s2": { + "decision": "PASS", + "evidence": "M excludes exactly C/zero; the report proves every included checked or nonzero case sound and every complement fiber UB, hence exact maximality." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but match-arm selection and implicit-return premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + "field": "atom:B14", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "It asserts zero enters the checked panic without verifying Rust if/comparison semantics or complete build-to-body coverage." + }, + "s2": { + "decision": "PASS", + "evidence": "It proves zero enters the checked branch and panics before unsafe code for every supported not-C configuration, with profile/debug fibers covered." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because match-arm selection and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + "field": "atom:B15", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "UNPROVED is stated, but its UB and regional-panic prerequisite proofs are incomplete." + }, + "s2": { + "decision": "PASS", + "evidence": "It states the global panic promise is UNPROVED rather than CONTRACT-BROKEN or PROVED because the only uncovered zero executions contain UB." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The report issues UNSOUND although match-arm selection and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + "field": "hard_error:G5", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "It reports UNSOUND without a valid authoritative match/return-supported current-library reachability link." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked match/tuple-pattern, implicit-return, and if/equality premises; this is the exact G11 authority defect." + }, + "field": "hard_error:G11", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "Its affirmative conclusions necessarily rely on unchecked match, tuple-pattern, function-return, and if/comparison semantics." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because match-arm selection and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + "field": "hard_error:BH7", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The stated aarch64/burst/arena certificate is incomplete at build-path and source reachability." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material match/tuple-pattern, implicit-return, and if/equality premises remain unverified while supporting affirmative verdicts." + }, + "field": "tcb_authority_defect", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The Cargo TCB is bounded, but several material Rust control-flow and pattern premises are absent from its authority log." + }, + "s2": { + "decision": "ABSENT", + "evidence": "The report names BUILD-MAP-ORDERED exactly, confines its consumers, and separately supports Rust semantics with versioned Reference/std authority." + } + } + ], + "mode": "B", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/CONSISTENCY.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/CONSISTENCY.json new file mode 100644 index 0000000000..423ec44438 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/CONSISTENCY.json @@ -0,0 +1,1132 @@ +{ + "schema_version": 1, + "mode": "B", + "atom_family_attestations": [ + { + "atom_id": "B1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states Rust/Cargo 1.85.1, all three targets, both feature/allocator/debug states, every profile and u8, with only wasm32/arena excluded; treatment is uniformly PASS." + }, + { + "atom_id": "B2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: B, D, and E verify the Result/VarError and pattern exhaustiveness needed for the six raw classes; A, C, F, G, H, I, and J assert the partition while omitting at least one material semantic leaf." + }, + { + "atom_id": "B3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone verifies arm selection, source order, successful println line effect, and implicit normal return for both system paths; each other report omits at least one of those material clauses." + }, + { + "atom_id": "B4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone verifies the complete arena-success trace through completed output and implicit return; A–D and F–J leave at least one path-selection, output, or return premise unverified." + }, + { + "atom_id": "B5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E completely establish arena-stop arm selection, completed R/arena lines, later panic, and no current library; the other eight omit a material pattern or successful-output premise." + }, + { + "atom_id": "B6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E completely prove both pre-allocator rejection arms, completed R prefix, no allocator attempt, panic, and no library; the other eight omit a material pattern and/or completed-output premise." + }, + { + "atom_id": "B7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: C, D, E, F, and J verify order plus successful- and failed-println effects for every write site; A, B, G, H, and I lack authority for the prior completed R line and H also lacks block order." + }, + { + "atom_id": "B8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone closes successful local return, exact accepted Cargo mapping, and Rust cfg source selection; every other report consumes at least one unverified selector-success or cfg premise." + }, + { + "atom_id": "B9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E fully establish the conditioned prior R-before-arena trace, arena-stop rerun paths, staleness, and no reuse; A–C and F–J lack a material local trace premise." + }, + { + "atom_id": "B10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone combines a complete current arena mapping with verified key/value, all, cfg-removal, and compile_error semantics; the other nine have an incomplete mapping and/or cfg derivation." + }, + { + "atom_id": "B11", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone proves both directions of the exact Q/not-Q body partition from a complete build mapping and verified all/not/cfg rules; every other report leaves a required mapping or cfg leaf unverified." + }, + { + "atom_id": "B12", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: all reports state safe zero use, false nonzero, zero UB, and UNSOUND, but only E verifies the full current-library-to-unchecked-body reachability chain; the other nine certificates are incomplete." + }, + { + "atom_id": "B13", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report gives the intended maximal-region formula, but only E proves both containments with a complete build/body/control-flow basis; the other nine silently consume missing material premises." + }, + { + "atom_id": "B14", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states the not-Q zero-panic region, but only E completely verifies Required-to-checked-body coverage and equality/if/panic control flow across all fibers." + }, + { + "atom_id": "B15", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states UNPROVED rather than CONTRACT-BROKEN/PROVED, but only E also supplies the complete B12 UB certificate and B14 regional theorem required by this conjunctive atom." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:BH1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH1; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH2; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH3; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH4; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH5; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH6; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J issue UNSOUND with an unverified current-library/source reachability link, so BH7 is present there; E verifies all four certificate links, so BH7 is absent for E." + }, + { + "field": "hard_error:BH8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH8; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH9; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH10; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G1 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G2 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G3 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G4 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J issue UNSOUND without a fully verified reachability link, so G5 is present there; E alone verifies valid use, reachability, falsity, and the applicable UB consequence." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G6 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G7 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G8 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G9 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G10 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J necessarily rely on one or more unchecked material Rust premises for affirmative build/source/UNSOUND results; E verifies the complete material authority chain." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G12 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every remediation is expressly prospective and requires implementation/re-audit; no report uses it to certify or narrow the current artifact." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E keeps BUILD-MAP-ORDERED bounded and verifies every material Rust leaf; A–D and F–J also bound the TCB but make affirmative results while leaving different material Rust premises unchecked." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report text establishes inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material; supplied snapshot and authority references remain in scope." + } + ], + "challenges": [ + { + "label": "A", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result Ok/Err exhaustiveness or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "A", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "A", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "A", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "A", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "A", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "A", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output/normal-return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "A", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior R/arena prefix and arena-stop path rest on unverified successful-output and pattern premises; the requested local trace prerequisite is incomplete." + }, + { + "label": "A", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; effective current-build rejection is not completely derived." + }, + { + "label": "A", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "A", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output/normal-return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "A", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output/normal-return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "A", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output/normal-return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "A", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output/normal-return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "B", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "B", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "B", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output needed for the completed R and allocator prefixes; the complete ordered-prefix derivation is not verified." + }, + { + "label": "B", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output needed for the completed R and allocator prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "B", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "B", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "B", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior successful RERUN/arena prefix lacks verified successful-output semantics; the requested local trace prerequisite is incomplete." + }, + { + "label": "B", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; effective current-build rejection is not completely derived." + }, + { + "label": "B", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; both directions of current supported source selection are not completely proved." + }, + { + "label": "B", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "B", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "B", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "B", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "C", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "C", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "C", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "C", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; the complete ordered-prefix derivation is not verified." + }, + { + "label": "C", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "C", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful arm selection/return and all/not cfg semantics are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "C", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection and the successful arena return are not fully verified; the requested local trace prerequisite is incomplete." + }, + { + "label": "C", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "C", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "C", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful arm selection/return and all/not cfg semantics are unverified; the authoritative reachability link is missing." + }, + { + "label": "C", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful arm selection/return and all/not cfg semantics are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "C", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful arm selection/return and all/not cfg semantics are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "C", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful arm selection/return and all/not cfg semantics are unverified; this conjunctive atom therefore fails." + }, + { + "label": "D", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "D", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "D", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but normal main return is an unverified material edge; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "D", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping still depends on the unverified normal-return edge; effective current-build rejection is not completely derived." + }, + { + "label": "D", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping still depends on the unverified normal-return edge; both directions of current supported source selection are not completely proved." + }, + { + "label": "D", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but normal main return is an unverified material edge; the authoritative reachability link is missing." + }, + { + "label": "D", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but normal main return is an unverified material edge; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "D", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but normal main return is an unverified material edge; the Required-to-selected-body reachability chain is incomplete at normal main return; Required-to-checked-body coverage is incomplete." + }, + { + "label": "D", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because normal main return is an unverified material edge; this conjunctive atom therefore fails." + }, + { + "label": "F", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but delegates the Rust-semantic raw partition to BUILD.md and does not verify Result/VarError or exact pattern behavior; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "F", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "F", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "F", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; the complete ordered-prefix derivation is not verified." + }, + { + "label": "F", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "F", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but raw-path selection/normal return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "F", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection is delegated to unchecked source claims; the requested local trace prerequisite is incomplete." + }, + { + "label": "F", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not and false-cfg selection are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "F", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not and false-cfg selection are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "F", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but raw-path selection/normal return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "F", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but raw-path selection/normal return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "F", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but raw-path selection/normal return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "F", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because raw-path selection/normal return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "G", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "G", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "G", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "G", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "G", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "G", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "G", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "G", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior complete R/arena prefix lacks verified println-success and normal-return premises; the requested local trace prerequisite is incomplete." + }, + { + "label": "G", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete despite otherwise checked cfg rules; effective current-build rejection is not completely derived." + }, + { + "label": "G", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete despite otherwise checked cfg rules; both directions of current supported source selection are not completely proved." + }, + { + "label": "G", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "G", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "G", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "G", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "H", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "H", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "H", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "H", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "H", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "H", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify block sequencing or successful println output for the prior completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "H", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but block/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "H", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but R-before-arena order, complete-line success, and arena-stop selection are not fully verified; the requested local trace prerequisite is incomplete." + }, + { + "label": "H", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "H", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "H", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but block/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "H", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but block/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "H", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but block/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "H", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because block/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "I", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "I", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "I", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "I", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; the complete ordered-prefix derivation is not verified." + }, + { + "label": "I", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "I", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed RERUN line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "I", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but pattern/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "I", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but pattern selection, complete-line success, and normal return are unverified; the requested local trace prerequisite is incomplete." + }, + { + "label": "I", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key/value cfg semantics are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "I", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key/value cfg semantics are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "I", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but pattern/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "I", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but pattern/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "I", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but pattern/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "I", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because pattern/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "J", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify match-arm choice or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "J", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "J", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "J", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; the complete ordered-prefix derivation is not verified." + }, + { + "label": "J", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "J", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but match-arm selection and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "J", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but match-arm selection for arena and arena-stop is unverified; the requested local trace prerequisite is incomplete." + }, + { + "label": "J", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg rules are checked; effective current-build rejection is not completely derived." + }, + { + "label": "J", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg rules are checked; both directions of current supported source selection are not completely proved." + }, + { + "label": "J", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but match-arm selection and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "J", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but match-arm selection and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "J", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but match-arm selection and implicit-return premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "J", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because match-arm selection and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "A", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output/normal-return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "A", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output/normal-return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "A", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "A", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "B", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "B", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "B", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked successful-println and implicit-main-return premises; this is the exact G11 authority defect." + }, + { + "label": "B", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material successful-println and implicit-main-return premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "C", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful arm selection/return and all/not cfg semantics are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "C", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful arm selection/return and all/not cfg semantics are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "C", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "C", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "D", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although normal main return is an unverified material edge; one of the four required existential certificate links is not validly established." + }, + { + "label": "D", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because normal main return is an unverified material edge; BH7 applies independently of the atom failure." + }, + { + "label": "D", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked implicit-main-return semantics; this is the exact G11 authority defect." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material implicit-main-return semantics remain unverified while supporting affirmative verdicts." + }, + { + "label": "F", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although raw-path selection/normal return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "F", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because raw-path selection/normal return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "F", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, exact-pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, exact-pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "G", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "G", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "G", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, and implicit-return premises; this is the exact G11 authority defect." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, and implicit-return premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "H", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although block/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "H", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because block/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "H", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "H", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "I", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although pattern/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "I", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because pattern/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "I", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises; this is the exact G11 authority defect." + }, + { + "label": "I", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "J", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although match-arm selection and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "J", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because match-arm selection and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "J", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked match/tuple-pattern, implicit-return, and if/equality premises; this is the exact G11 authority defect." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material match/tuple-pattern, implicit-return, and if/equality premises remain unverified while supporting affirmative verdicts." + } + ], + "ambiguities": [ + "The frozen rules say a URL grants page identity rather than a proposition, but do not quantify how much verbatim quotation is required when a report gives an accurate nearby paraphrase. The comparisons credit explicit proposition-level paraphrases and do not credit a bare page or a citation proving only a different clause.", + "The atom dependency lists do not say that failure propagates mechanically. Later-atom challenges above are based only on the later proof actually consuming the same missing material premise, not merely on an earlier atom label being FAIL." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/PACKET.json new file mode 100644 index 0000000000..33d9f4ed3f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/PACKET.json @@ -0,0 +1,34 @@ +{ + "adjudication_cells_sha256": "d18e3fece657958c3fb7a4d8571da7bbedaf4083febc04e3cacc305dc81f4316", + "allowlist_sha256": "7124ac918b5595c9eaa594511309d8ac1a2400456695cd3004db76f14d18ec21", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "consistency_review_sha256": "c102e88e1276a6dde4bf0f7a6e0cf94c227279bff0ff3b5ddbbae3af6da1fbb4", + "listed_labels": [ + "A", + "B", + "C", + "D", + "F", + "G", + "H", + "I", + "J" + ], + "mode": "B", + "report_sha256": { + "A": "fad0c995d3639d93a74d17be5c17ee86615a76ffca5ae9b91756e8a77834b1fe", + "B": "ca2e2fe0e2096c3fb6629d6d97067dba5125aedf7d74c14710bdfe4f20953351", + "C": "481bdce1f650e4b9ffc1242fccb53adb23bd33ed200d6971ed40fb3e944e067f", + "D": "e3283ae8b81a126762ee59cdd8108681311618dc8b848256daa4c49cfd1ae78c", + "F": "dfcd89377ba31227e0ed7bb9ae4926eca117678182f14ef3f26fe5e929b2b57d", + "G": "a556b26d30da7f48af3bdb4f1962a532142a7555215e6df0fb731896ecdcf164", + "H": "bea0082d313d7bc237a2b754a983410e62d437aecef9bec717b7014d0b618e41", + "I": "5b414f1c8097099ebfe625ec880d4aa0da01a46617e5712419912ed230ccffbe", + "J": "d3ed478991945f13610c6cf0b2dbde59dbe68b37afcf9c456e17a78197a8d6bf" + }, + "rubric_sha256": "13790584d0e5ede69cff8c2b1889be80c73df0722c4ea709c0e85ab82900a4bb", + "schema_sha256": "8540160022aebd3900d88936ba3924d9160435d9d7a9d61962d1195c743d097d", + "schema_version": 1, + "source_score_packet_sha256": "d2a2885dd9f9d4377d3aca40571a9429952662bf751033963b05eaf6b292515c", + "target_byte_tree_sha256": "7589027142112e387f990314df7eb1d08e5464448566fd68048eb2a748635bf3" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/RUBRIC.md new file mode 100644 index 0000000000..c5371528bf --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/RUBRIC.md @@ -0,0 +1,483 @@ +# Mode B Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material.** Never expose this file, its atoms, formulas, +> expected verdicts, hard errors, or authority inventory to a report agent. + +## Scoring Rules + +Score the proposition of each atom, not its notation or presentation. Accept an +explicit equivalent derivation. Do not infer an omitted build stage, failure +edge, source-selection step, or semantic premise from an endpoint summary. +Failure of an atom is not itself a hard error unless the report also makes the +false affirmative claim identified below. + +This fixture deliberately requests a maximal positive region. That request, +not a general audit convention, makes exactness and maximality part of B13. +There is no scoring requirement for incidental diagnostics, exact panic text, +partially written bytes within one failed `println!`, or build-script stdout +which does not affect a current library selection. + +## Intended Domain and Build Relation + +Let: + +```text +R = { Rust and Cargo 1.85.1 } +T = { X = x86_64-unknown-linux-gnu, + A = aarch64-unknown-linux-gnu, + W = wasm32-unknown-unknown } +F = { burst-off, burst-on } +L = { system, arena } +P = every Cargo profile supported by the fixture +D = { debug-assertions-off, debug-assertions-on } +I = { i | i is any u8 } + +Config(t,f,l,p,d) + iff t in T and f in F and l in L and p in P and d in D + and not (t = W and l = arena). + +Required = R cross Config cross I. +Q(t,f,l) iff t = A and f = burst-on and l = arena. +``` + +Both allocator values in `Config` are reachable through the supported Cargo +interface: an omitted selector or `system` selects `system`, and `arena` +selects `arena`. Raw rejected selector values and unsuccessful build attempts +are build-relation cases that must be accounted for, but they do not add a +library configuration to `Required`. + +For compactness, use these local operations: + +```text +RERUN = attempt println!("cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR") +READ = evaluate env::var("FIXTURE_ALLOCATOR") +SYS = attempt println!("cargo::rustc-cfg=fixture_allocator=\"system\"") +ARENA = attempt println!("cargo::rustc-cfg=fixture_allocator=\"arena\"") +PANIC = the selected explicit panic, or the panic caused by a failed println! +RETURN = successful return from main +``` + +The complete claim-relevant local relation is: + +```text +missing: RERUN -> READ(NotPresent) -> SYS -> RETURN +Unicode system: RERUN -> READ(Ok(system)) -> SYS -> RETURN +Unicode arena: RERUN -> READ(Ok(arena)) -> ARENA -> RETURN +Unicode arena-stop: + RERUN -> READ(Ok(arena-stop)) -> ARENA -> PANIC +other Unicode: RERUN -> READ(Ok(other)) -> PANIC +non-Unicode: RERUN -> READ(NotUnicode) -> PANIC +``` + +Every arrow after a `println!` assumes that write succeeds. If `RERUN` fails, +it panics before `READ`, and no complete earlier directive is required. If +`SYS` or `ARENA` fails, `RERUN` is the material completed prefix and the script +panics before `RETURN` or the explicit `arena-stop` panic. If `ARENA` succeeds +on `arena-stop`, the material completed prefix is `[RERUN, ARENA]`, followed by +the explicit panic. Under exact accepted entry `BUILD-MAP-ORDERED`, every panic is an +unsuccessful script exit and produces no current library compilation, +regardless of completed prefix. + +On the three successful selector paths, `BUILD-MAP-ORDERED` interprets the final +allocator line as exactly one matching library cfg. Cargo's accepted feature +and target mappings, followed by the Rust conditional-compilation rules, +select the library source. The `W`/`arena` combination selects +`compile_error!`, so it does not produce a library and is genuinely outside +`Config`. The supported `Q` cell selects the first `lane_id` body and removes +the complementary checked body. + +A prior successful `arena` build necessarily completed `RERUN` before +`ARENA`. After the raw selector changes to `arena-stop`, `BUILD-MAP-ORDERED` makes +that prior selection stale, reruns the script, and refuses to present the old +library as the result of the current unsuccessful execution. Thus the +freshness canary is an effective rejection even though its current output +prefix includes the same arena cfg line. + +## Expected Source Results + +The exact maximal sound region requested by the target is: + +```text +SoundRegion = { case in Required | not Q(case) or case.i != 0 }. +``` + +Outside `Q`, the selected body panics when `i == 0`; reaching +`new_unchecked(i)` therefore implies `i != 0`. Inside `Q`, the selected body +calls `new_unchecked` without a check, so nonzero inputs are sound and zero is +not. The complement of `SoundRegion` within `Required` consists exactly of +`Q` with `i == 0` (for every supported profile and debug-assertion state). + +The safe call `lane_id(0)` in any `Q` case reaches +`NonZeroU8::new_unchecked(0)`. Its exact safety proposition is false, and the +Rust 1.85.1 standard-library contract states that zero produces undefined +behavior. Safe-API soundness over all of `Required` is therefore **UNSOUND +relative to `BUILD-MAP-ORDERED`**. + +For the documented zero-input panic postcondition: + +```text +RequiredPanic = { case in Required | case.i = 0 } +CoveredPanic = { case in RequiredPanic | not Q(case) }. +``` + +The regional theorem over `CoveredPanic` is **PROVED relative to +`BUILD-MAP-ORDERED`**. The whole `RequiredPanic` theorem is **UNPROVED**, not +`CONTRACT-BROKEN`: the only missing cases are executions already shown to +contain UB, so their apparent absence of an earlier panic is not a defined +behavioral counterexample. + +## Atoms + +- **B1 — Exact supported case predicate:** The report states a predicate + equivalent to `Required`, including Rust/Cargo 1.85.1, all three targets, + both feature states, both allocator models, every supported Cargo profile, + both debug-assertion states, every `u8`, and only the `W`/`arena` policy + exclusion. + - `scope_basis`: `Cargo.toml`, `SUPPORT.md`, and `BUILD.md`. + - `dependencies`: none; this is the theorem root. + - `accepted_alternatives`: symbolic products or a proved equivalent partition; no + Cartesian enumeration is required. + - `hard_errors`: omission + alone fails B1; claiming a whole-domain affirmative result over a contracted + predicate triggers BH1. + +- **B2 — Exhaustive raw-selector partition:** The report proves that the raw + environment domain is exactly missing, Unicode `system`, Unicode `arena`, + Unicode `arena-stop`, every other Unicode string, and every non-Unicode + value, with no seventh `env::var` outcome. + - `scope_basis`: `BUILD.md`, the + exact `env::var`/`VarError` contracts, and the outer and inner matches. + - `dependencies`: independent of B1; it supplies the cases used + by B3–B7. + - `accepted_alternatives`: any disjoint exhaustive partition that + preserves these behaviorally distinct classes. + - `hard_errors`: + omission alone fails B2; calling an incomplete partition complete and using + it for build closure triggers BH2. + +- **B3 — Complete system-success trace:** Conditional on its two writes + succeeding, each of the missing and Unicode-`system` classes follows exactly + `RERUN -> READ -> SYS -> RETURN`; it emits no arena cfg. + - `scope_basis`: the + ordered statements, `env::var`, match/pattern semantics, `String::as_str`, + and `println!`. + - `dependencies`: B2 identifies the two raw cases; + this is a local-source proposition and does not consume Cargo mapping. + - `accepted_alternatives`: combine the two classes after proving their + identical trace. + - `hard_errors`: omission alone fails B3; an + incompatible endpoint used for closure triggers BH2. + +- **B4 — Complete arena-success trace:** Conditional on its two writes + succeeding, Unicode `arena` follows exactly + `RERUN -> READ -> ARENA -> RETURN`; it emits no system cfg. + - `scope_basis`: + the same local Rust contracts as B3. + - `dependencies`: B2; this + trace is the reachability root for B8–B12. + - `accepted_alternatives`: an + equivalent state-transition row or prose proof. + - `hard_errors`: + omission alone fails B4; an incompatible endpoint used for closure triggers + BH2. + +- **B5 — `arena-stop` partial-prefix exit:** With successful writes, Unicode + `arena-stop` follows exactly + `RERUN -> READ -> ARENA -> PANIC`, so `[RERUN, ARENA]` is a completed output + prefix but the script does not return successfully and, under + `BUILD-MAP-ORDERED`, produces no current library compilation. + - `scope_basis`: + `BUILD.md`, local match/`println!`/`panic!` semantics, and only the exact + unsuccessful-exit proposition of `BUILD-MAP-ORDERED`. + - `dependencies`: + B2; this is distinct from a failed allocator write in B7. + - `accepted_alternatives`: notation may differ, but both ordered lines, the later panic, + and no-current-library consequence must appear. + - `hard_errors`: + omission alone fails B5; treating the partial arena line as a current + successful selector triggers BH4. + +- **B6 — Pre-allocator rejection traces:** Every other Unicode value and every + non-Unicode value follows `RERUN -> READ -> PANIC` after a successful rerun + write, so `[RERUN]` is its completed directive prefix; it attempts no + allocator cfg and produces no current library compilation under + `BUILD-MAP-ORDERED`. + - `scope_basis`: the wildcard and `NotUnicode` arms plus + the exact build premise. + - `dependencies`: B2; the two classes may + share an outcome only after both are accounted for. + - `accepted_alternatives`: + separate rows or one proved union. + - `hard_errors`: omission alone + fails B6; treating either class as an accepted allocator/configuration + triggers BH5. + +- **B7 — Stdout-failure edges:** The report accounts for failure of every + claim-relevant `println!`: failed `RERUN` panics before `READ`; failed `SYS` + or `ARENA` panics with completed prefix `[RERUN]`; and all such unsuccessful + exits produce no current library compilation under `BUILD-MAP-ORDERED`. It does + not require atomic line writes or assign meaning to an incomplete line. + - `scope_basis`: the exact `println!` Panics section, source order, + `panic!`'s main-thread result, and the accepted process-status proposition. + - `dependencies`: B3–B5 identify allocator-write sites; B7 is the + failure completion of those traces. + - `accepted_alternatives`: a single + quantified failure rule is preferred and passes if its instantiations are + readily checkable. + - `hard_errors`: omission alone fails B7; + claiming complete build coverage while a material failure edge supplies a + contrary current artifact triggers BH2 or BH4 as applicable. + +- **B8 — Successful Cargo-to-source selector mapping:** Only the successful + B3/B4 returns supply a current library compilation; Cargo interprets their + exact allocator line as exactly the corresponding `fixture_allocator` + key/value, maps the requested feature and target as admitted, and Rust cfg + rules select source from those resulting predicates. The report keeps + `BUILD-MAP-ORDERED` conspicuous and does not infer local output or Rust semantics + from it. + - `scope_basis`: B3/B4, exact `BUILD-MAP-ORDERED`, the reviewed Cargo + directive contracts, and versioned Rust cfg semantics. + - `dependencies`: B3 through B7. + - `accepted_alternatives`: a relational composition + or explicit stage-by-stage prose. + - `hard_errors`: silently + widening the accepted mapping triggers BH3; treating an unsuccessful prefix + as successful triggers BH4. + +- **B9 — Rerun/freshness theorem:** A prior successful `arena` build completed + `RERUN` before `ARENA`; changing the same target directory's raw selector to + `arena-stop` makes that selection stale, causes a new script run, and yields + no library for the current rejected build rather than reusing the prior arena + library. + - `scope_basis`: local B4/B5 order and precisely the rerun/staleness + proposition accepted in `BUILD-MAP-ORDERED`, reviewed against Cargo's + `rerun-if-env-changed` contract. + - `dependencies`: B4, B5, and the + no-library exit consequence. + - `accepted_alternatives`: a more general proof + for every accepted-to-rejected value change passes if it includes this + requested sequence. + - `hard_errors`: omission alone fails B9; + claiming this current build succeeds from the stale or partial arena output + triggers BH4. + +- **B10 — Effective wasm32/arena exclusion:** For either feature state and all + profiles/debug states, accepted `arena` selection plus the admitted wasm32 + target mapping makes both predicates of the library's first cfg true; Rust + `all` and cfg-attribute semantics therefore retain `compile_error!`, whose + contract makes compilation fail. No `W`/`arena` case is in `Required` or is + used as the UB witness. + - `scope_basis`: `SUPPORT.md`, B8, exact configuration + predicate and attribute semantics, and `compile_error!`. + - `dependencies`: B8. + - `accepted_alternatives`: any parametric proof covering both + feature states and all `P x D`. + - `hard_errors`: calling this pair + supported, using it as a valid-use witness, or asserting rejection without + the selected `compile_error!` proof triggers BH5. + +- **B11 — Exact library-body partition:** The report proves that the unchecked + first body is retained and the complementary checked body removed exactly in + `Q`, while the checked body is retained and the first body removed exactly + outside `Q`. In `Q`, B8 supplies `target_arch="aarch64"`, + `feature="burst"`, and `fixture_allocator="arena"`; Rust's key/value, `all`, + `not`, and cfg-attribute rules establish both directions of the partition. + - `scope_basis`: B8 and the exact versioned cfg propositions. + - `dependencies`: B4 and B8; this is the source-reachability edge for B12/B13. + - `accepted_alternatives`: expansion of the two cfg predicates or an + equivalent Boolean proof. + - `hard_errors`: omission alone fails + B11; declaring the supported unsafe branch unreachable by ignoring generated + cfgs triggers BH6. + +- **B12 — Existential UB certificate and verdict:** The report identifies the + well-typed safe call `lane_id(0)` in a supported `Q` case, uses B11 to reach + `NonZeroU8::new_unchecked(0)`, states that its exact nonzero safety + proposition is false, applies the Rust 1.85.1 zero-UB consequence, and reports + whole-`Required` soundness **UNSOUND relative to `BUILD-MAP-ORDERED`**. + - `scope_basis`: the public safe API, B1, B11, and the exact std contract. + - `dependencies`: B1 and B11. + - `accepted_alternatives`: any one supported + profile/debug state is enough for the existential certificate; proving all + such states is also correct. + - `hard_errors`: an incomplete + certificate followed by `UNSOUND`, or failure to issue `UNSOUND` after giving + every link, triggers BH7. + +- **B13 — Exact maximal sound region:** The report proves both containments for + `SoundRegion = { case in Required | !Q or i != 0 }`: every included case is + sound (the checked body dominates its unsafe call outside `Q`, and nonzero + directly satisfies the unsafe precondition inside `Q`), while every excluded + Required case is exactly `Q`/zero and has B12's UB execution. It labels this + the exact maximal source-level region relative to `BUILD-MAP-ORDERED`. + - `scope_basis`: the user-requested maximal theorem, B1, B11/B12, `if`/comparison/ + panic semantics, and `new_unchecked`. + - `dependencies`: B1, B8, + B11, B12. + - `accepted_alternatives`: an algebraically equivalent formula or + disjoint partition; a correct non-maximal remainder does not pass this + explicitly requested atom. + - `hard_errors`: omission or refusal to + maximize alone fails B13; calling a region maximal while including Q/zero, + excluding sound Q/nonzero cases, or excluding all of `Q` triggers BH8. + +- **B14 — Regional zero-panic theorem:** For every zero-input case outside + `Q`, cfg selection retains the checked body, `value == 0` makes the `if` + consequent execute, and `panic!` prevents reachability of the later unsafe + call. Thus `CoveredPanic = RequiredPanic intersect !Q` is **PROVED relative + to `BUILD-MAP-ORDERED`** across every applicable target/allocator/feature, + profile, and debug state. + - `scope_basis`: B1/B8/B11 and exact comparison, + `if`, cfg, and panic contracts. + - `dependencies`: B1, B8, and the + complement of B11. + - `accepted_alternatives`: a parametric proof or exact + finite configuration partition. + - `hard_errors`: incomplete + regional coverage alone fails B14; falsely claiming the region contains + Q/zero triggers BH9 or BH10 depending on the verdict. + +- **B15 — Whole-domain panic-postcondition verdict:** The report states that + the documented zero-input panic guarantee over all `RequiredPanic` is + **UNPROVED**, not `CONTRACT-BROKEN` and not `PROVED`: Q/zero contains UB, so + its apparent source prefix supplies neither a defined non-panic witness nor a + guaranteed observation, while B14 proves every other zero case. + - `scope_basis`: the exact behavioral quantifier, B12, B14, and whole-execution UB + reasoning. + - `dependencies`: B12 and B14. + - `accepted_alternatives`: + equivalent theorem-specific wording that keeps this verdict separate from + soundness. + - `hard_errors`: using the UB-containing case to claim + `CONTRACT-BROKEN` or an observation before UB triggers BH9; claiming the + universal panic theorem `PROVED` triggers BH10. + +## Hard Errors + +- **BH1:** Claims a whole-domain affirmative result after omitting a supported + release, target, feature, allocator, profile, debug state, or valid `u8` + input, or treats the supported `Q` cell as excluded. +- **BH2:** Claims the build relation or a dependent theorem complete while + replacing the requested ordered/fallible relation with an endpoint summary + that omits a material raw-selector class, failure edge, partial-prefix exit, + or necessary stage. +- **BH3:** Invents, silently widens, or treats as Rust authority any Cargo, + freshness, process-status, feature, or target proposition beyond exact + `BUILD-MAP-ORDERED`. +- **BH4:** Treats a cfg line emitted by an unsuccessful script, or a stale + artifact from an earlier selector, as the library selected for the current + failed build. +- **BH5:** Treats a rejected raw selector as an accepted allocator model; + treats wasm32/arena as supported; uses it as the safe-use UB witness; or + claims its effective rejection without the selected `compile_error!` proof. +- **BH6:** Ignores build-script output or exact Cargo/cfg interpretation and + consequently declares the supported `Q` unsafe branch unreachable. +- **BH7:** Reports `UNSOUND` without the valid safe use, reachability, false + exact safety proposition, and applicable UB consequence, or reports only + `UNPROVED` after explicitly establishing all four links. +- **BH8:** Claims an exact or maximal sound region that includes Q/zero or + excludes any sound Required case, including Q/nonzero. +- **BH9:** Reports `CONTRACT-BROKEN` for the zero-panic promise using only the + UB-containing Q/zero execution, or claims an observation is guaranteed + because it appears before that UB in source order. +- **BH10:** Reports the whole-`RequiredPanic` zero-panic theorem `PROVED` + despite leaving Q/zero without a defined proof. + +## Checked Authorities + +The evaluator must open each exact page, confirm the quoted proposition, and +confirm applicability to Rust/Cargo 1.85.1. The quotation is included to make +the semantic leaf explicit; punctuation-only rendering differences are +irrelevant. + +- `https://doc.rust-lang.org/1.85.1/std/env/fn.var.html` — “Fetches the + environment variable key from the current process”; returns + `VarError::NotPresent` when the variable is not set and + `VarError::NotUnicode` when its value is not valid Unicode. +- `https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html` — the enum is + exactly `NotPresent` or `NotUnicode(OsString)`; the variant descriptions + distinguish absence from a present value without valid Unicode data. +- `https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html` — `Result` is + exactly `Ok(T)` or `Err(E)` and “represents either success (`Ok`) or failure + (`Err`).” +- `https://doc.rust-lang.org/1.85.1/std/primitive.u8.html` — `u8` is “The 8-bit + unsigned integer type,” with `MIN` equal to zero and `MAX` equal to 255; zero + is therefore an ordinary valid safe-call input. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html` — a + scrutinee value is “sequentially compared to the patterns in the arms until + a match is found,” and the first matching arm is chosen and entered. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html` — a + block sequentially executes its non-item statements and optional final + expression; its type is `()` when the final operand is omitted. +- `https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body` + — an omitted function output is unit, and the body is conceptually wrapped + so that its body value is returned; an explicit `return`, if reached, + short-cuts that implicit return. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html` — “A + call expression calls a function”; if the function eventually returns, the + expression completes. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns` + — tuple-struct patterns match tuple-struct and enum values satisfying all + their subpatterns and destructure that value. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns` — + literal patterns “match exactly the same value as what is created by the + literal.” +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern` — + the wildcard pattern “matches any value.” +- `https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str` + — `as_str` “Extracts a string slice containing the entire `String`.” +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html` — `println!` + “Prints to the standard output, with a newline,” supplying the successful + completed-line effect used by B3–B6. +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics` — `println!` + “Panics if writing to `io::stdout` fails.” +- `https://doc.rust-lang.org/1.85.1/std/macro.panic.html` — `panic!` “Panics the + current thread.” The process-status consequence consumed by this fixture is + separately and explicitly admitted by `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation` + — a set configuration option is true; `all(...)` is true exactly when all + operands are true; and `not(p)` is true exactly when `p` is false. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute` + — a true cfg predicate retains the attached thing without the cfg attribute, + while a false predicate removes it from the source. +- `https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html` — + `compile_error!` “Causes compilation to fail with the given error message + when encountered.” +- `https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators` + — `==` means equal via `PartialEq::eq`; for the primitive `u8` comparison in + this source it tests whether `value` equals zero. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html` — if the + Boolean condition is true the consequent executes; if false it is skipped. +- `https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked` + — the function creates a nonzero without checking, “results in undefined + behavior if the value is zero,” and its Safety section says, “The value must + not be zero.” +- `https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html` + — Rust programs “must never cause undefined behavior”; unsafe code that no + safe client can trigger to exhibit UB is called sound, and code that safe + code can misuse to exhibit UB is unsound. The whole-execution conclusion is + a logical consequence of classifying the execution as undefined, not a + purported quotation from a source-order or “time travel” subsection. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script` + — after a build script “successfully finishes executing, the rest of the + package will be compiled”; a nonzero exit halts the build. This reviews, but + does not replace, `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script` + — Cargo interprets each stdout line beginning with `cargo::` as an instruction + affecting package compilation, and instruction order can matter. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg` + — the directive tells Cargo to pass its value to rustc's `--cfg` flag for + conditional compilation. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed` + — the directive tells Cargo to rerun the script if that environment + variable's value changes. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/features.html` — Cargo sets + enabled package features with rustc's `--cfg`, and source can test them with + the cfg attribute or macro. + +Cargo pages are evidence used to review the explicit human trust entry; they +are not Rust abstract-semantics axioms and do not silently enlarge that entry. +No test run, CI result, compiler experiment, prior report, evaluator oracle, or +unversioned documentation closes any atom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/adjudication.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/adjudication.schema.json new file mode 100644 index 0000000000..a0e421247c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/adjudication.schema.json @@ -0,0 +1,35 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-adjudication-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "decisions", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "decisions": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect|novel:s[12]:N[1-9][0-9]*)$" + }, + "decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/allowlist.txt new file mode 100644 index 0000000000..b425cc1918 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/allowlist.txt @@ -0,0 +1,27 @@ +https://doc.rust-lang.org/1.85.1/std/env/fn.var.html +https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html +https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html +https://doc.rust-lang.org/1.85.1/std/primitive.u8.html +https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html +https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html +https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body +https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html +https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern +https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str +https://doc.rust-lang.org/1.85.1/std/macro.println.html +https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics +https://doc.rust-lang.org/1.85.1/std/macro.panic.html +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators +https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html +https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked +https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed +https://doc.rust-lang.org/1.85.1/cargo/reference/features.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/A.md new file mode 100644 index 0000000000..4a7e4846af --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/A.md @@ -0,0 +1,194 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits the complete supplied crate snapshot: `Cargo.toml`, `build.rs`, +`src/lib.rs`, and `BUILD.md`, `SUPPORT.md`, and `TCB.md`. The theorem is +source-level Rust 1.85.1/edition 2021 freedom from undefined behavior for every +well-typed safe call to `lane_id`, plus the requested build/rejection and panic +contracts. It is relative only to accepted entry `BUILD-MAP-ORDERED`; no +backend or binary correctness is claimed. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {burst off, burst on}`, `A = {system, arena}`; +- `P` be every Cargo profile, `D = {debug assertions off, on}`, and + `V = {0,...,255}` (the complete `u8` domain); +- `Supported(t,b,a,p,d) := t in T && b in B && a in A && p in P && d in D + && !(t=wasm32-unknown-unknown && a=arena)`; and +- `C(t,b,a) := t=aarch64-unknown-linux-gnu && b=burst-on && a=arena`. + +`SUPPORT.md` states exactly the product above and exactly its wasm/arena +exclusion. `Cargo.toml` fixes Rust 1.85.1, edition 2021, the empty/default or +enabled `burst` feature, and this build script/library. `BUILD.md` makes the +allocator a generated cfg from an accepted raw selector. These sources agree; +normalizing their conjunction gives `Supported` in both directions. Rejected +raw values are required build-interface cases, not extra library +configurations. Profiles and debug assertions do not occur in either library +cfg predicate or in its value test, so the proofs below are parametric in +`p,d`. There are no dependencies or other generated files. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered raw-selector/build relation, including freshness | **PROVED**, relative to `BUILD-MAP-ORDERED` | Complete path partition below | +| Required wasm32/arena exclusion | **PROVED** | `cfg` plus `compile_error!` proof below | +| Safe-API soundness over `Supported x V` | **UNSOUND** | Every `C && value=0` safe call reaches documented UB | +| Soundness on `M := {(q,value): Supported(q) && (!C(q) || value!=0)}` | **PROVED** | Exhaustive cfg/input partition below | +| “Panics when `value` is zero” over all `Supported` | **UNPROVED**, not `CONTRACT-BROKEN` | Proved for `!C`; the only remaining executions have UB, so they cannot be postcondition counterexamples | + +Thus the combined full-domain result is **UNSOUND** for soundness and +**UNPROVED** for the documented panic postcondition. + +## Exact ordered build relation + +Write `R` for the complete line +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, `S` for +`cargo::rustc-cfg=fixture_allocator="system"`, and `A` for the analogous +`"arena"` line. + +The function body executes its statements in order. First it attempts `R`. +If that write fails, `println!` panics: for every raw environment class the +script exits unsuccessfully before reading/classifying the variable, with no +successfully written complete directive guaranteed (an incomplete byte prefix +of the failing line is immaterial). If `R` succeeds, the complete relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Classification and next action | Complete emitted prefix and exit | +|---|---|---| +| omitted | `Err(NotPresent)`; attempt `S` | `R,S`, normal success if the write succeeds; otherwise `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `system` | `Ok`; `as_str`; `"system"` arm; attempt `S` | same two outcomes as omitted | +| Unicode `arena` | `Ok`; `"arena"` arm; attempt `A` | `R,A`, normal success; or `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `arena-stop` | `Ok`; matching arm; attempt `A`, then explicit `panic!` | if write succeeds: `R,A`, explicit panic; if it fails: `R` and `println!` panic before the explicit panic | +| every other Unicode value | `Ok`; wildcard arm | `R`, explicit panic; no allocator write attempted | +| every non-Unicode value | `Err(NotUnicode(_))` | `R`, explicit panic; no allocator write attempted | + +These are all raw classes, both stdout sites, all successful paths, all +explicit rejections, and all material complete prefixes. The successful +mapping is exactly `omitted|system -> system` and `arena -> arena`. The +`arena-stop` emitted allocator line never belongs to a successful execution. + +The accepted `BUILD-MAP-ORDERED` premise is consumed only as follows: a +successfully written current `R` makes any later raw-value change stale; a +successfully written allocator line is passed as that exact cfg only when the +current script succeeds; current success receives no retained old selector; +any write panic or explicit panic is an unsuccessful process and yields no +current library; Cargo does not substitute an old library after a stale failed +build; and `burst`/the three target triples set the exact named cfgs. Emitted +text and ordering above are proved from source, not assumed by that entry. + +Consequently, after a successful `arena` build, `R` necessarily was written. +Changing the same target directory to present value `arena-stop` is the +entry's present-to-present change: Cargo reruns before selecting a library. +The rerun fails at `R`, at `A`, or after successful `A`; every case is +unsuccessful, and neither its prefix nor the prior arena artifact is a result +of the current build. The freshness canary is therefore **PROVED**. + +## Version-matched Rust axioms + +The following are the material Rust 1.85.1 propositions; Cargo behavior above +comes only from the separately accepted project TCB entry. + +- [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says: + “Returns an `Err` if the variable is not present, or if it is not valid + Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + distinguishes `NotPresent` from `NotUnicode(OsString)`. +- [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” The + [match-expression rule](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + says: “The first arm with a matching pattern is chosen as the branch target + of the match.” [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + match the literal's value; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” +- [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially execute their component non-item declaration statements.” + [`println!` failure](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +- A [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + includes its attached form iff its predicate is true; if false, “the thing + is removed from the source code.” [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” +- The [`if` rule](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes the consequent when its Boolean condition is true; the + [comparison rule](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + makes `==` a value equality test. The [`u8` page](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + records `MIN = 0` and `MAX = 255`. +- Most importantly, [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + states: “This results in undefined behavior if the value is zero.” Its + Safety clause is: “The value must not be zero.” + +## Configuration exclusion and selected source + +On target `wasm32-unknown-unknown` after a successful arena selector, +`BUILD-MAP-ORDERED` supplies `target_arch="wasm32"` and exactly +`fixture_allocator="arena"`. Both operands of the source `all(...)` are true, +so the `compile_error!` item is included and compilation fails. This is +independent of `burst`, profile, and debug assertions. Hence the excluded pair +cannot produce a current library. For system on wasm32, and for either +allocator on the two other targets, that predicate is false and this error item +is removed. The project's sole exclusion is exactly enforced. + +## API, obligations, and maximal sound region + +The only language-reachable crate API is safe free function +`pub fn lane_id(u8) -> NonZeroU8`. There are no public fields, crate-owned +representation, traits/impls, methods, statics, macros, reexports, hidden +items, callbacks, or FFI. There is no persistent invariant; each unsafe call +locally consumes the sole obligation `value != 0`. + +The two complementary cfg blocks form an exhaustive partition: + +1. If `C`, the first block is included and the `not(all(...))` block removed. + Every input immediately reaches `new_unchecked(value)`. For `value in + 1..=255`, its sole safety precondition holds. For `value=0`, it is false and + the cited standard-library contract entails UB. +2. If `!C`, the first block is removed and the second included. At `value=0`, + equality is true and `panic!` executes before the unsafe call. At every + `value in 1..=255`, that branch is not taken and the exact same value reaches + `new_unchecked`, satisfying its safety clause. + +This proves every point of +`M = Supported x V intersect (!C or value!=0)`. Conversely, +`(Supported x V) \ M` is exactly `C && value=0`, for every profile and debug +assertion state. Calling this public safe function with zero is a valid +well-typed in-scope use; cfg selection reaches the unsafe call; its required +proposition is false; and the version-matched contract states the UB +consequence. Every omitted point is therefore unsound, proving both the +full-domain **UNSOUND** certificate and the exact maximality of `M`. + +For the documented postcondition, every `!C,value=0` execution reaches +`panic!`, so that region is proved. At `C,value=0` the whole execution has UB. +It cannot be a `CONTRACT-BROKEN` witness, which must be UB-free; absent an +independent UB-free witness, the full postcondition is **UNPROVED**. + +## Finding and proof-artifact quality + +**F-1 (critical, UNSOUND).** The special-path comment, “Burst-mode lane +identifiers are never zero,” is not derived from a check, type, invariant, or +unsafe caller contract. `value` is an unrestricted public `u8`, so zero is a +counterexample. The minimum repair is to validate zero on that path (or remove +the specialization and use the already checked path), then replace the comment +with a proof citing that dominating check and exact value. Changing prose alone +cannot repair the safe API. The ordinary-path comment correctly identifies the +dominating zero branch, though the derivation above supplies its complete +versioned contract basis. Any code repair is a new snapshot requiring re-audit. + +## TCB, residual scope, and triggers + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, accepted +for Cargo 1.85.1 and only its stated freshness, process-status, feature, target, +and cfg propositions. Its exclusions (emitted source text/order, Rust +semantics, source correctness, backend, binary) were not widened. No other +assumption, dependency, tool result, test, build, or prior audit was consumed. + +Excluded from the theorem are manual `rustc`, invented cfgs, build-script +override, unsupported targets, and binary/backend correctness. Re-audit is +required for any source/policy/manifest change; Cargo/Rust or documentation +change; target, feature, allocator, profile, or environment-interface change; +generated-cfg/build-order change; or altered TCB disposition. + +**Final attestation:** every source/API/build/configuration/postcondition +obligation has a disposition; `Required` and `M` are symbolic and closed; the +unsoundness witness is complete; no testing or absence-of-counterexample claim +is used. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/B.md new file mode 100644 index 0000000000..c17b23805f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/B.md @@ -0,0 +1,84 @@ +# Unsafe-code audit: supplied ordered-build crate + +## Claims, snapshot, and verdicts + +Audit cutoff: 2026-08-01. The audited identity is the complete supplied snapshot: `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`; Rust/Cargo/stdlib are exactly 1.85.1, edition 2021. There are no dependencies or generated files. No build, execution, expansion, or test evidence was used. + +Let `T={X86,A64,Wasm}` denote the three triples in `SUPPORT.md`; `B={off,on}` the `burst` cfg state; `A={system,arena}`; `P` every Cargo profile; and `D={debug_assertions off,on}`. The exact supported library domain is + +`R = {1.85.1} × T × B × A × P × D \ {(1.85.1,Wasm,b,arena,p,d)}`. + +The allocator coordinate must arise from a successful current build-script run: raw absent or `system` maps to `system`, and raw `arena` maps to `arena`. Rejected raw values and write-failing executions are part of the audited build interface but create no library configuration. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered selector, rejection, freshness, and wasm/arena exclusion | **PROVED**, relative to `BUILD-MAP-ORDERED` | Exhaustive relation and exclusion proof below | +| Build script and `lane_id` are UB-free for every current library in `R` and every `u8` input | **UNSOUND** | Supported `A64,on,arena,p,d`, input `0`, reaches `new_unchecked(0)` | +| “Panics when `value` is zero” for every `c in R` | **UNPROVED** | Proved when `F(c)` is false; the remaining executions contain UB, so they cannot certify a defined contract refutation | + +Here `F(c) := (target=A64 && burst=on && allocator=arena)`. The **exact maximal sound region** over the requested product is + +`Smax = {(c,x) in R × u8 | !F(c) || x != 0}`. + +Its complement is exactly `{(c,0) | c in R && F(c)}` (all profiles and both debug-assertion states). Thus this is maximal, not merely a positive subset. + +## Version-matched Rust axioms + +These are the only material Rust propositions consumed: + +* AX-ENV: [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “Returns an Err if the variable is not present, or if the current value is not valid Unicode.” [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) represents success as `Ok` or failure as `Err`; [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) distinguishes `NotPresent` and `NotUnicode`. +* AX-ORDER: the [block-expression Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) says statements are “executed sequentially.” The [match Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) says values are sequentially compared with arm patterns and the first match is chosen. [Tuple-struct patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns) match tuple-struct and enum-variant values. [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) “Extracts a string slice containing the entire String.” Literal patterns [match the literal's value](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), while the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) “matches any value.” +* AX-EXIT: [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the current thread.” `BUILD-MAP-ORDERED` supplies the process-status consequence. +* AX-CFG: the [conditional-compilation Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) defines `all` as true exactly when all predicates are true and `not` as negation. The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) includes its attachment when true and removes it when false. [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) “causes compilation to fail with the given error message when encountered.” +* AX-NZ: Rust 1.85.1 [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) requires: “The value must not be zero”; creating it with zero is undefined behavior. The [UB Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) confirms that unsafe blocks remain subject to the UB rules. +* AX-IF: the [`if` Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) executes the consequent exactly when its Boolean condition is true; the [comparison-operator Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) gives `==` equality for the `u8` comparison. + +## Complete ordered build relation + +Write `RERUN`, `CS`, and `CA` for the complete lines at `build.rs:4`, `:8/:12`, and `:15/:18`. `partial(L)` means any bytes produced by a failing attempt to write `L`, possibly none or even a complete-looking line. This deliberately does not assume line-write atomicity. + +1. For **every** raw environment state, the first operation attempts `RERUN`. If it fails, the only output is `partial(RERUN)`; `println!` panics before `env::var`, the process is unsuccessful, and no current library is compiled. +2. If `RERUN` succeeds, `env::var` is evaluated and its exhaustive `Result`/match partition is: + * absent or Unicode `system`: attempt `CS`. Failure yields `[RERUN]+partial(CS)`, panic, and no library. Success yields `[RERUN,CS]`, normal return, and exactly `fixture_allocator="system"` for the current library; + * Unicode `arena`: the identical two outcomes with `CA`, selecting exactly `arena` only after success; + * Unicode `arena-stop`: attempt `CA`. A write failure yields `[RERUN]+partial(CA)` and no library. A successful write yields `[RERUN,CA]`, then the explicit panic at `build.rs:19`; despite the complete allocator line, no current library is compiled; + * every other Unicode value: output `[RERUN]`, then the wildcard-arm panic at `:21`; no allocator write and no library; + * every non-Unicode value: output `[RERUN]`, then the `NotUnicode` panic at `:24`; no allocator write and no library. + +This exhausts the first-write outcome, all three `env::var` result classes, all literal/wildcard subdivisions of `Ok`, and every second-write outcome. Local sequential execution plus AX-ENV/ORDER/EXIT proves the source-side order and exits. Accepted TCB entry `BUILD-MAP-ORDERED` supplies only these consumed Cargo facts: a successfully written rerun line tracks any raw-value change; a cfg line affects the current library only after that script exits successfully; only the current successful run's exact directives are used; an unsuccessful script (including uncaught panic or either write failure) produces no current library and cannot surface a stale one; enabled `burst` and the three target triples set the named cfgs. No source-correctness or Rust-semantic proposition is imported from that entry. + +**Freshness witness sequence.** A successful raw `arena` run writes `[RERUN,CA]`, returns, and may produce the arena library. In the same target directory, changing the present raw value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly the three unsuccessful cases above: first write fails; first succeeds and `CA` fails; or both writes succeed and `:19` panics. Therefore the current build is rejected in every case, and the prior arena library is not its result. + +## Configuration/source closure and exclusion + +For a successful selector run, Cargo supplies exactly one of `system` or `arena`. AX-CFG makes the two `lane_id` bodies complementary: + +* `system`, or any X86 configuration, or `burst=off`: only the checked body at `lib.rs:27-32` is selected; +* `A64 + arena + burst=on`: only the unchecked-return body at `:17-20` is selected; +* `Wasm + arena`: independently of `burst`, the cfg on `:3` is true and `compile_error!` makes the current library compilation fail, producing no library artifact; +* `Wasm + system` remains in the checked class. + +Thus the required exclusion is effectively and exactly rejected: successful arena selection plus the accepted Wasm target-cfg entails the compile error. No rejected raw class bypasses it, because none creates a current library. Conversely, this source error's predicate is precisely `Wasm && arena`, so it does not enlarge the stated exclusion. Profiles and debug assertions do not occur in any selector or source predicate, giving a parametric proof over `P×D`. Hence the build/exclusion `Covered` predicate contains the complete build-interface domain, and the successful-library projection is exactly `R`. + +## API, obligations, and maximal-region proof + +The only public surface is safe `lane_id(u8) -> NonZeroU8`; there are no public fields, traits/impls, callbacks, macros, statics, FFI, or hidden APIs. The only unsafe sites are its two cfg-complementary `new_unchecked` calls. The build script contains no unsafe code. + +* If `!F(c)` and `x=0`, `value == 0` is true, so `panic!` executes before the unsafe call. This is UB-free and proves the documented panic behavior. +* If `!F(c)` and `x!=0`, the zero branch is skipped; that dominating fact discharges AX-NZ before `lib.rs:32`. +* If `F(c)` and `x!=0`, the direct call at `:19` satisfies AX-NZ. +* If `F(c)` and `x=0`, cfg selection reaches `new_unchecked(0)`. The safe signature imposes no caller precondition, so this is a valid supported safe use; AX-NZ's required proposition is false and the operation has undefined behavior. This proves **UNSOUND**, for every `p,d` in this complement. + +The four cases are exhaustive (`F`/`!F`, zero/nonzero). The first three prove every member of `Smax`; the fourth proves every member of its complement unsound, establishing maximality. The existing fast-path comment—“Burst-mode lane identifiers are never zero”—is a false, unenforced premise; the parameter comes directly from adversarial safe code. The checked-path comment is adequate. + +For the panic contract, coverage is exactly `{(c,0) | c in R && !F(c)}`. In the uncovered `F(c),0` cases the whole execution contains UB. Consequently there is no UB-free witness here for `CONTRACT-BROKEN`; the strongest contract verdict is **UNPROVED**, alongside the independently certified **UNSOUND** verdict. + +## TCB audit, findings, and residual scope + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, disposition accepted by the authorized reviewer. Its exact consumed fragments and consumers are recorded above; its Cargo/toolchain identity is 1.85.1. AX-ENV through AX-IF are versioned Rust authorities, not extra implementation assumptions. No pending, unsafe-dependency, tool, backend, binary, platform-runtime, or probabilistic premise is consumed. + +**Finding F-1 (UNSOUND; proof comment deficient):** `src/lib.rs:18-19`, precisely `F(c) && value=0`. Minimum repair is to check zero before every `new_unchecked`, use `NonZeroU8::new(value).expect(...)`, or remove the special unsafe branch. Merely strengthening prose would add an invalid hidden precondition to a safe API. Re-audit all cfg cases and the panic guarantee after repair. + +**Finding F-2 (postcondition UNPROVED):** the same region prevents a universal panic proof, but supplies no defined contract-breaking witness. Repair F-1 while retaining a zero-input panic on the fast path. + +This is a source-level Rust theorem only. Compiler/backend correctness, produced binaries, manually invented cfgs, direct `rustc`, build-script override, targets/toolchains outside the stated set, and future source or policy are excluded. Re-audit on any source, Rust/Cargo, support domain, raw interface, feature/target cfg, TCB disposition, or cited semantic-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/C.md new file mode 100644 index 0000000000..0276c50b7c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/C.md @@ -0,0 +1,78 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits exactly the supplied `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and accepted `TCB.md`, under Rust/standard library 1.85.1 and Cargo 1.85.1. No generated file, dependency, test, build, macro expansion, backend, or binary claim is used. Audit cutoff: 2026-08-01. + +Write `X`, `A`, and `W` for the three supported targets (x86_64-linux-gnu, aarch64-linux-gnu, and wasm32-unknown-unknown); `b in {0,1}` for `burst`; `a in {system,arena}`; `p in P` for every Cargo profile; and `d in {0,1}` for debug assertions. The controlling full product is + +`F = {1.85.1} x {X,A,W} x {0,1} x {system,arena} x P x {0,1}`. + +`SUPPORT.md` makes the compilable-library domain + +`C = {c in F | not(c.target=W and c.allocator=arena)}`. + +No finite enumeration of `P` is inferred. The proofs below are parametric in `p,d`; neither selects inspected source. Build-domain coverage additionally quantifies over every raw environment class and success/failure of each stdout write described below. `BUILD.md` excludes manual rustc, invented cfgs, and build-script override; that exclusion is controlling, not inferred from successful compilation. + +* **Whole-crate safe-API soundness: UNSOUND**, relative to accepted `BUILD-MAP-ORDERED` and the quoted Rust axioms below. A supported safe call reaches UB. +* **Documented `lane_id(0)` panic postcondition: UNPROVED** over `C`. It is proved outside the defective configuration, but the only refutation found in that configuration contains UB, so it cannot certify `CONTRACT-BROKEN`. +* **Build mapping/freshness and W/arena rejection: PROVED** for the stated source domain relative to exactly `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `S`/`A0` the complete `cargo::rustc-cfg=fixture_allocator="system"`/`"arena"` lines. Rust blocks execute statements sequentially ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html): “a block sequentially executes its component non-item declaration statements and then its final optional expression”). Thus every path first attempts `R`, then calls `env::var`, then (only where shown) attempts one allocator line. + +`env::var` “Fetches the environment variable `key` from the current process”; it returns `NotPresent` when unset and `NotUnicode` when its value is not valid Unicode ([std](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)). The fixed name contains neither `=` nor NUL. `as_str` “Extracts a string slice containing the entire `String`” ([std](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)); match selects the first matching arm after evaluating the scrutinee ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). These facts make the following raw partition exhaustive. + +| Raw class, after successful `R` | Next events in exact order | Completed stdout prefix and exit | Current library | +|---|---|---|---| +| omitted | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `system` | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `arena` | attempt `A0`; success returns | `R,A0`, success | cfg `arena`, subject to source rejection | +| Unicode `arena-stop` | attempt `A0`; after success explicit panic | `R,A0`, unsuccessful | none | +| every other Unicode string | explicit panic; no allocator attempt | `R`, unsuccessful | none | +| every non-Unicode value | explicit panic; no allocator attempt | `R`, unsuccessful | none | + +There are exactly two write-failure sites. If the `R` write fails, execution panics there: no complete directive is guaranteed (only a possibly incomplete byte prefix) and no environment read occurs. If `S` or `A0` fails, complete prefix `R` (plus a possibly incomplete suffix of that attempted line) precedes the panic; there is no return. On `arena-stop`, failure of `A0` gives the latter prefix; success gives `R,A0` followed by the explicit panic. `println!` “Prints to the standard output, with a newline” and “Panics if writing to `io::stdout` fails” ([std](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([std](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). These panics are safe behavior. + +The accepted TCB supplies, and this proof consumes only, these propositions: a completed `R` records raw-value freshness; a successful current execution's completed cfg line becomes that exact library cfg, with no retained earlier selector; any write failure or uncaught main-thread panic is unsuccessful and produces/presents no current library; enabling `burst` sets its feature cfg; and the three triples set the named `target_arch` values. Cargo documentation corroborates but does not replace that accepted premise: `rustc-cfg` “tells Cargo to pass the given value to the `--cfg` flag” ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)), while `rerun-if-env-changed` causes rerun when the named value changes ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). + +**Freshness challenge.** After successful `arena` in one target directory, changing the raw value to `arena-stop` is a present-to-present change covered by `R`. `BUILD-MAP-ORDERED` therefore forces a rerun before selection. That rerun either fails at `R`, fails at `A0`, or writes both then explicitly panics. Every case is unsuccessful; neither its partial output nor the old arena artifact is a result of the current build. The advertised canary works. + +## Directive-to-source closure and exclusion + +Conditional compilation compiles parts according to conditions, and a cfg attribute “conditionally includes the thing it is attached to based on a configuration predicate” ([Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)). Consequently a successful accepted build supplies exactly one allocator cfg, the selected feature state, and the target architecture. + +For `W and arena`, the first predicate in `lib.rs` is true for either feature/profile/debug state, so `compile_error!`, which “Causes compilation to fail with the given error message when encountered” ([std](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)), rejects compilation. For every other member of `F` it is false, so it rejects nothing. Therefore the source enforces exactly `F ∖ C`; `arena-stop` never reaches this stage. There is no current API for the rejected pair. + +For each `c in C`, define + +`Q(c) = (burst enabled) and (target=A) and (allocator=arena)`. + +The two function-body cfgs are `Q` and `not(Q)`, hence form an exhaustive, disjoint partition. In `Q`, source selects the unconditional `return new_unchecked(value)` block. In `not(Q)`, it selects the block which first compares with zero, panics on equality, and otherwise calls `new_unchecked`. An `if` is a conditional branch and executes its consequent when its Boolean condition is true ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is the equality comparison operator ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). + +## Unsafe obligation, witness, and exact maximal sound region + +The complete language-reachable crate API surface is the safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, constructors besides it, traits/impls, callbacks, statics, FFI, exported macros, or hidden APIs. `compile_error!` is configuration control. The two `new_unchecked` calls are the only unsafe sites. The owned invariant/obligation is `NZ(value): value != 0` immediately before either call. No caller obligation is permitted because `lane_id` is safe. + +`u8` is “The 8-bit unsigned integer type” ([std](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)); let `U={0,...,255}`. `NonZeroU8::new_unchecked` “Creates a non-zero value without checking whether the value is non-zero” and “The value must not be zero”; zero “results in undefined behavior” ([std](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +The exact maximal sound region of compiled API cases is + +`M = {(c,x) in C x U | not(Q(c) and x=0)}`. + +**Sufficiency:** if `not Q` and `x=0`, the comparison reaches `panic!` before unsafe code. If `not Q` and `x!=0`, the false branch itself establishes `NZ(x)`. If `Q` and `x!=0`, the input establishes `NZ(x)`. Thus every unsafe call in `M` satisfies its complete safety precondition. Profiles and debug assertions do not alter this derivation. + +**Necessity/maximality:** choose any profile/debug state with `(target=A, burst=1, allocator=arena, x=0)`. This configuration belongs to `C`, raw `arena` successfully selects it, and `lane_id(0)` is a well-typed safe use. `Q` selects the first block; it reaches `new_unchecked(0)`, its required proposition is false, and the quoted contract entails UB. Hence every point in `(C x U) ∖ M` is unsound, while every point in `M` was proved sound. This proves both maximality and the existential `UNSOUND` certificate. Over all of `F x U`, `W/arena` has no compiled API; every other case is classified by `M` or its complement. + +The special-path comment, “Burst-mode lane identifiers are never zero,” is false for caller-controlled `u8` and supplies neither a check nor an invariant. The ordinary-path comment is adequate: the dominating zero branch makes reaching its unsafe call imply nonzero. Minimal repair: perform the zero check before both cfg branches (or use checked `NonZeroU8::new(value)` and panic on `None`) and replace the false comment with that dominating fact. + +For the documented postcondition, zero reaches `panic!` in every `c in C` with `not Q`; it is therefore proved exactly there. In `Q`, the zero execution contains UB. There is no independent UB-free zero execution or equivalent existence proof, so the whole-domain result is `UNPROVED`, not `CONTRACT-BROKEN`. + +## TCB log, residual scope, and triggers + +* **BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo/freshness/process-status/feature/target propositions enumerated above; consumers are build reachability and exclusion only. No source correctness is imported. +* **AXIOM-CTRL/CFG/NZ (accepted Rust authority):** only the linked, versioned 1.85.1 propositions quoted above. Rust's UB rule applies inside unsafe blocks too ([Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). +* No dependency, allocator implementation, generated-code, tool, test, FFI, backend, binary, or deployment premise is consumed. “Allocator” is only this crate's cfg model. + +Re-audit on any supplied source/policy/manifest change; Cargo/Rust/stdlib version or TCB disposition change; target, feature, allocator, profile/debug scope change; changed build-output/freshness semantics; or a new API/cfg. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/D.md new file mode 100644 index 0000000000..12235d2ff6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/D.md @@ -0,0 +1,107 @@ +# Unsafe-code audit: `ordered-build-target` supplied snapshot + +## Claim, domain, and verdicts + +Audit cutoff: 2026-08-01. Scope is every supplied crate file, Cargo 1.85.1/Rust 1.85.1, the build interface and freshness contract, generated cfgs, selected `src/lib.rs`, its sole public safe API, and its documented panic condition. This is a Rust-abstract-semantics source claim, not a backend or binary claim. No build, execution, expansion, test, prior audit, or external dependency result was used. + +Write `X`, `A`, and `W` for the three listed target triples (x86_64 GNU/Linux, aarch64 GNU/Linux, and wasm32-unknown-unknown), `F={off,on}` for `burst`, `L={system,arena}`, `P` for every Cargo profile, `D={off,on}` for debug assertions, and `U={0,...,255}`. The full policy product is + +`C={X,A,W} x F x L x P x D`. + +`SUPPORT.md:9-16` says exactly those members are supported except + +`E={c in C | target(c)=W and allocator(c)=arena}`, + +so current library configurations are `S=C\E`. Both containments for this normalization follow literally: every tuple admitted by the “every other combination” clause is in `C\E`, and every member of `C\E` has listed axis values and is not the sole exclusion. No enumeration of `P` is assumed. + +Full `Required` is the union of (1) all supported Cargo build attempts over the six raw-environment classes below, every possible applicable stdout-success/failure path and relevant prior target-directory state, and (2) every call `lane_id(v)` with `c in S` and `v in U` after a current successful build. `E` and rejected selector attempts have no current API case. Manual rustc, invented cfgs, and build-script override are expressly excluded by `BUILD.md:31-34`. + +| Claim | Verdict | Certificate | +|---|---|---| +| Whole-crate safe-API freedom from UB over `S x U` | **UNSOUND** | `F-UB` below supplies a valid supported safe call, reachability, false safety condition, and explicit UB consequence. | +| “`lane_id(value)` panics when `value` is zero” over `S x {0}` | **UNPROVED** | Proved on `S\K`; the remaining `K` executions have UB, so they cannot establish `CONTRACT-BROKEN` and do not prove the postcondition. | +| Exact maximal realized library sound region | **PROVED relative to TCB-ORDERED** | `M=(S x U)\WIT`, proved below; every point in its complement within `S x U` is an UB witness. | +| Ordered build mapping, freshness canary, and target/allocator rejection | **PROVED relative to TCB-ORDERED** | Exhaustive staged relation and exact cfg derivation below. | + +Thus the combined mandatory result is **UNSOUND; documented postcondition UNPROVED**, not `PROVED` and not `CONTRACT-BROKEN`. + +## Boundary, surfaces, and invariants + +`Cargo.toml` selects only `build.rs` and `src/lib.rs`; all supplied files were read. `build.rs::main` is private and contains no unsafe operation. The complete downstream surface is the public **safe** free function `lane_id(u8) -> NonZeroU8`; there are no crate-defined public fields, constructors, traits/impls, statics, callbacks, FFI, reexports, hidden items, or exported/generated macros. Its caller has no safety precondition. The only invariant consumed is `NZ`: the argument to `NonZeroU8::new_unchecked` is nonzero, thereby producing a valid nonzero result. The function boundary must establish `NZ`; `lib.rs:18` does not. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `CS`/`CA` the complete system/arena `cargo::rustc-cfg` lines. Block statements execute sequentially, and a value scrutinee is evaluated then patterns are compared sequentially until the first match. These checked semantics make the source order literal, not inferred from endpoint output. + +1. Cargo runs `build.rs`; `build.rs:4` first attempts `println!(R)`. If it succeeds, complete prefix `[R]` exists and only then is `env::var` called. If it fails, `println!` panics there: no classification or later write is reached and no earlier complete line is guaranteed. +2. With `[R]`, `env::var` and the two matches produce the exhaustive raw partition below. The key literal itself contains neither `=` nor NUL. `Result` has only `Ok`/`Err`; `VarError` has only `NotPresent`/`NotUnicode`; `as_str` preserves the entire Unicode string; literal patterns select exactly their values and `_` every remainder. + +| Raw `FIXTURE_ALLOCATOR` class | Reached operation after `[R]` | If that operation succeeds | Explicit/failure exit | +|---|---|---|---| +| omitted | `build.rs:8` attempts `CS` | return success with `[R,CS]` | write failure panics with prior complete prefix `[R]` | +| Unicode `system` | line 12 attempts `CS` | return success with `[R,CS]` | same failure prefix/exit | +| Unicode `arena` | line 15 attempts `CA` | return success with `[R,CA]` | same failure prefix/exit | +| Unicode `arena-stop` | line 18 attempts `CA` | prefix `[R,CA]`, then line 19 explicitly panics | line-18 failure panics first with prior prefix `[R]`; line 19 is not reached | +| every other Unicode value | no allocator write | none | line 21 explicitly panics with `[R]` | +| every non-Unicode value | no allocator write | none | line 24 explicitly panics with `[R]` | + +This includes every dynamic stdout failure site: common line 4 and the class-specific lines 8, 12, 15, and 18. A failed `println!` may have written an unspecified byte prefix (possibly a complete-looking attempted line); the table states only already successful complete lines. TCB-ORDERED makes all such executions unsuccessful and prevents any prefix from producing a current library, so no atomic-write premise is consumed. Explicit `panic!` writes no Cargo stdout directive. + +3. On exactly the three accepted successful classes, TCB-ORDERED interprets the current two complete lines: `R` establishes freshness tracking and exactly one of `CS`/`CA` passes the corresponding exact `fixture_allocator` key/value cfg to this library, with no selector retained from an earlier run. Every write failure, explicit panic, and `arena-stop` exit is unsuccessful; no current library compilation occurs. +4. TCB-ORDERED also supplies the exact `burst` and target-architecture leaf cfgs. Rust cfg semantics then select source. Define + +`K(c) := burst(c)=on and target(c)=A and allocator(c)=arena`. + +The first `lane_id` block is present exactly on `K`; the second is present exactly on `not K`, because its predicate is the literal `not(all(...))`. Profiles and debug assertions occur in no selector or safety check, so this partition is parametric over `P x D`. + +### Exact exclusion + +For a current successful arena selector on `W`, TCB-ORDERED sets both `target_arch="wasm32"` and `fixture_allocator="arena"`; `all` is true, the `cfg` attribute retains `compile_error!`, and that macro fails compilation. Conversely, encountering this source error requires both leaves true, hence exactly `E`; feature state is irrelevant. System-on-`W` and arena on `X`/`A` make at least one leaf false and remove the item. Therefore `Rejected_source=E` in both directions, not merely `E` contained in a sampled rejection. A failed current compilation is no current library/API case. Over the total `C x U`, `E x U` is precisely the no-library region. + +### Freshness sequence in one target directory + +Take any successful prior arena library build, necessarily on `X` or `A`. Its successful script emitted `[R,CA]`; TCB-ORDERED says a present-to-present raw change from `arena` to `arena-stop` stales that selection and reruns the script before a current library can be selected. On the rerun: line 4 failure rejects immediately; otherwise line 18 failure rejects with `[R]`; otherwise `[R,CA]` is followed by the explicit panic. TCB-ORDERED says every case supplies no current library and never presents the old arena library as this rejected build's result. The freshness canary is therefore effective. + +## Unsafe obligations and exact maximal region + +Rust 1.85.1 documents `NonZero::new_unchecked`: “The value must not be zero” and “undefined behavior if the value is zero.” Thus each site has exactly obligation `NZ`. + +* On `not K`, cfg removes the early-return block. If `v=0`, `==` is equality, the `if` consequent executes `panic!`, and control never reaches line 32. If `v!=0`, the consequent is skipped; reaching line 32 itself proves `NZ`, so the call is permitted and returns a nonzero. This reconstructs and completes the terse line-31 comment. +* On `K`, cfg removes the checked block. Line 19 is reached for every `v`. `v!=0` satisfies `NZ`; `v=0` falsifies it. The line-18 comment's “never zero” is neither type-enforced nor checked and is false for a caller-supplied `u8`. + +Let + +`WIT={(c,0) | c in S and K(c)}` and `M=(S x U)\WIT`. + +`WIT` is nonempty: `A`, burst on, arena is listed and not the wasm exclusion, for every `P,D`; an accepted arena build with successful writes selects it. Calling the public safe `lane_id(0)` is a valid safe use. Cfg makes line 19 reachable; zero falsifies `NZ`; the exact standard-library contract entails UB. This is the complete **UNSOUND** certificate (`F-UB`). + +For every member of `M`, either `not K` (the checked proof above covers every `u8`) or `K` and `v!=0` (the unsafe precondition holds); no other unsafe operation exists. Hence `M` is sound. Conversely, every member of `(S x U)\M` is by definition in `WIT` and has the proved UB certificate. Both containments establish equality and maximality, rather than a non-maximal remainder. The complete product partition is therefore: rejected `E x U`, realized-sound `M`, and realized-unsound `WIT`. + +For the panic contract, `(S\{c:K(c)}) x {0}` is proved: the equality is true and `panic!` “Panics the current thread.” On `WIT`, the whole execution contains UB, so it cannot be an UB-free postcondition counterexample. No independent UB-free witness exists in this source. The strongest global postcondition verdict is consequently **UNPROVED**, with no `CONTRACT-BROKEN` certificate. + +## Obligation ledger and findings + +| ID | Obligation | Coverage/status | +|---|---|---| +| O-BUILD | Exhaust raw classes, ordered effects/exits, partial prefixes, Cargo interpretation | All cases proved above relative to TCB-ORDERED | +| O-FRESH | stale arena then arena-stop cannot select old/current library | proved above relative to TCB-ORDERED | +| O-EXCL | reject exactly wasm32/arena | proved in both directions | +| O-NZ-NORMAL | line 32 argument nonzero | proved on `not K` for every `u8` | +| O-NZ-BURST | line 19 argument nonzero | proved only for `K and v!=0`; **UNSOUND** at `v=0` | +| O-PANIC | every zero call panics | proved on `not K`; **UNPROVED** on `K` | + +**F-UB (critical implementation defect; deficient proof artifact).** The safe `u8` input is treated as if “burst mode” enforced nonzero. Minimal resolution is to perform the zero check before every cfg-dependent unsafe call, or replace both calls with a checked safe constructor while preserving the documented panic. A valid replacement proof would say: “`new_unchecked` requires nonzero; if `value==0` the preceding `panic!` diverges, so reaching this call proves `value!=0`.” Re-audit all `K`, postcondition, and maximal-region proofs after repair. + +## Authority and TCB audit log + +**TCB-ORDERED (accepted human decision):** supplied `TCB.md` entry `BUILD-MAP-ORDERED`, Cargo 1.85.1, exact supplied manifest/script/interface/library. Consumed propositions only: required script execution; successful `R` freshness including present-to-present raw changes; exact current successful cfg and no retained selector; no compilation/old-result presentation after unsuccessful script even with complete prefixes; panic as unsuccessful exit; and exact feature/target leaves. No local emission, Rust semantics, source correctness, backend, binary, or compiler-correctness proposition is imported. Owner is the unidentified authorized human; triggers are exactly `TCB.md:43-45`. Cargo's versioned documentation corroborates that Cargo will [“execute it just before building”](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script), treats [stdout `cargo::` lines as instructions](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script), and [`rustc-cfg` passes its value to `--cfg`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg); the stronger failure/staleness clauses remain only the expressly accepted TCB proposition. + +Checked Rust 1.85.1 axioms, all accepted as version-matched authoritative text: + +* Environment/classification: `env::var` says [“The variable is not set” and `NotUnicode` means its “value is not valid Unicode”](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html); [`VarError` has exactly `NotPresent` and `NotUnicode`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html); [`Result` is `Ok(T)` or `Err(E)`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html); [`as_str` contains the entire `String`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str). +* Order/partition: blocks [“sequentially execute”](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html); match uses the [“first arm with a matching pattern”](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html); literal patterns [“match exactly the same value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), tuple patterns match enum values, and `_` [“matches any value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern). +* Effects: `println!` [prints stdout with newline and “Panics if writing ... fails”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics); [`panic!` “Panics the current thread”](https://doc.rust-lang.org/1.85.1/std/macro.panic.html). +* Cfg: the [conditional-compilation clauses](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) say an “option is set,” “all ... predicates are true,” `not` inverts, and false cfg means the “thing is removed from the source code.” [`compile_error!` “Causes compilation to fail”](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html). +* API: `u8::MIN=0` and [`u8::MAX=255`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html); `==` means [“Equal”](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators); a true `if` condition [executes its consequent](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html); and [`new_unchecked` “Creates a non-zero,” requires nonzero, and expressly makes zero UB](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked). + +No other TCB entry, dependency contract, tool-derived evidence, environment restriction, or compatibility premise was consumed. Rust/Cargo/toolchain, target/feature policy, script/source/docs, TCB disposition, or panic-contract changes trigger full re-audit. Review attestation is complete except that the audited artifact itself fails O-NZ-BURST and O-PANIC as reported. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/F.md new file mode 100644 index 0000000000..5578f5219e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/F.md @@ -0,0 +1,203 @@ +# Unsafe Rust audit: `ordered-build-target` + +## Claim, snapshot, and verdicts + +This is a source-only audit of the complete supplied snapshot: `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`. +No build, execution, test, or expansion was used. The theorem is for Rust/Cargo +1.85.1, edition 2021, at the 2026-08-01 cutoff; it makes no backend or binary +claim. `BUILD-MAP-ORDERED` in the supplied `TCB.md` is the accepted TCB +revision. No dependency, tool-result, or additional implementation premise is +consumed. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe call to `lane_id` in every supported current library is free of Rust UB | **UNSOUND** | F-01 gives a valid safe call, reachability, false unsafe precondition, and authoritative UB consequence. | +| Documented postcondition “Panics when `value` is zero” over every supported library configuration | **UNPROVED** | Proved outside the exceptional configuration; its only zero execution has UB, so it cannot prove `CONTRACT-BROKEN`. | +| Ordered selector mapping, rejection, and `arena`→`arena-stop` freshness | **PROVED relative to `BUILD-MAP-ORDERED`** | B-01/B-02 below. | +| Required wasm32/arena exclusion | **PROVED** | B-03: the selected source necessarily fails compilation. | + +The combined mandatory result is therefore **UNSOUND** for soundness and +**UNPROVED** for the panic postcondition, not `CONTRACT-BROKEN`. + +## Exact theorem domain + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `F={off,on}` be `burst`; `A={system,arena}`; `P` be every Cargo profile; and + `D={off,on}` be debug assertions; +* `Q = T×F×A×P×D \ { (wasm32-unknown-unknown,f,arena,p,d) }`; and +* `U` be every value of type `u8`. + +This is an equality normalization of `SUPPORT.md`: it states exactly those +three targets, both feature and allocator states, every profile and both debug +assertion states, then removes exactly wasm32/arena for either feature. The +manifest fixes Rust 1.85.1/edition 2021 and declares only `burst`. `BUILD.md` +defines allocator selection. There is no policy conflict and no release +interval to extrapolate. Raw environment classes rejected below are build +interface cases, not extra members of `A`. Profiles/debug assertions do not +occur in the source predicates or arithmetic, so the proofs are parametric in +`P,D`. + +Write +`C(q) := (F=on ∧ T=aarch64-unknown-linux-gnu ∧ A=arena)`. +The **exact maximal sound region** over the requested full product is + +`S = { (q,v) ∈ Q×U | ¬C(q) ∨ v≠0 }`. + +The proof of both inclusion and maximality appears under S-01/S-02. + +## B-01: complete ordered build relation + +Let `R`, `L_s`, and `L_a` denote the newline-terminated rerun, system-cfg, and +arena-cfg lines literally present in `build.rs`. Let `p(X)` mean whatever bytes, +if any, a failed attempt to print `X` emitted; it may be empty or include a +complete line. Its exact bytes are immaterial because the accepted TCB says any +stdout-write failure is an unsuccessful script and supplies no current library. + +For **every** raw class, the first event is an attempt to print `R`. If it +fails, execution stops by `println!` panic with output `p(R)`; the environment +is not read, and there is no library. If it succeeds, the remaining exhaustive +relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Events after `R`, in order | Output/exit | Current result | +|---|---|---|---| +| omitted | `env::var` gives `NotPresent`; attempt `L_s` | failure: `R+p(L_s)`, write panic; success: `R+L_s`, normal return | none on failure; exactly cfg `fixture_allocator="system"` and library attempt on success | +| Unicode `system` | `Ok`; `as_str`; literal arm; attempt `L_s` | same two outcomes | same | +| Unicode `arena` | `Ok`; `as_str`; literal arm; attempt `L_a` | failure: `R+p(L_a)`, write panic; success: `R+L_a`, normal return | none on failure; exactly cfg `fixture_allocator="arena"` and library attempt on success | +| Unicode `arena-stop` | `Ok`; literal arm; attempt `L_a`; if successful, explicit `panic!` | `R+p(L_a)`, write panic, or `R+L_a`, explicit panic | none in either case | +| every other Unicode value | `Ok`; wildcard arm; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | +| every non-Unicode value | `NotUnicode`; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | + +Thus the only normal exits are omitted/system→system and arena→arena, each +after exactly two successful stdout writes. `BUILD-MAP-ORDERED` is consumed +literally: a successful current script gives the library exactly its current +selector directive and no retained selector; an unsuccessful script gives no +current compilation or stale result. It also supplies the requested feature +and target cfg mapping. The source-level ordering/partition follows from the +arms at `build.rs:4-25`; no endpoint-only inference is used. + +## B-02: freshness certificate + +Assume a successful `arena` build in target directory `X`. Its successful `R` +records the raw variable dependency and its `L_a` selects arena. Changing the +present value to `arena-stop` makes that result stale under +`BUILD-MAP-ORDERED`, so Cargo reruns the script before current selection. The +rerun has exactly three possibilities: first write failure (`p(R)`), second +write failure (`R+p(L_a)`), or both writes followed by the explicit panic +(`R+L_a`). Every possibility exits unsuccessfully. The accepted premise says +none compiles a current library or presents the earlier arena library as this +build's result. The requested reuse sequence therefore rejects exactly as +documented. + +## B-03: source exclusion and source selection + +On target wasm32 with a successful arena selector, the accepted TCB supplies +both `target_arch="wasm32"` and `fixture_allocator="arena"`. The first cfg in +`src/lib.rs` therefore includes `compile_error!` for either feature, profile, +or debug state, and compilation fails. Hence every and only listed +target/allocator exclusion is effectively rejected; no current library API is +produced. + +For every `q∈Q`, cfg processing selects exactly one `lane_id` body: + +* if `C(q)`, lines 13-22 include the immediate unchecked return and lines + 24-37 are absent; +* if `¬C(q)`, the first block is absent and the second checks zero before its + unchecked constructor. + +The public safe surface is exactly `pub fn lane_id(u8)->NonZeroU8`. There are no +public fields, unsafe APIs/traits/impls, callbacks, exported macros, hidden +items, FFI, dependencies, or invariant-bearing stored state. The standard +macros are consumers of documented standard behavior, not generated public +surface. + +## Unsafe-operation and postcondition ledger + +**S-01 (`¬C`).** If `v=0`, the equality test enters `panic!` before unsafe code. +If `v≠0`, the dominating test establishes the sole precondition of +`NonZeroU8::new_unchecked(v)`; it returns a valid nonzero value. The adjacent +safety comment is an adequate local proof. This proves UB freedom for all +`P,D` and proves the zero-panic postcondition. + +**S-02 (`C`).** If `v≠0`, the unsafe constructor's sole precondition holds, so +this region is sound. If `v=0`, F-01 proves UB. Since zero/nonzero and +`C/¬C` are exhaustive, every point of `S` is proved sound and every point of +`(Q×U)\S` is proved unsound. Consequently no strict superset of `S` within +`Q×U` is sound: this establishes exact maximality, not merely a positive +remainder. + +**POST-01.** The documented implication `v=0 ⇒ lane_id(v) panics` is proved for +`¬C`. For `C,v=0`, the execution reaches UB before a defined return or panic +can be certified. Under the required whole-execution rule, that execution +cannot witness `CONTRACT-BROKEN`; no independent UB-free refutation exists in +this source. The full-product postcondition is therefore `UNPROVED`. + +## F-01 — unchecked zero behind a safe API + +* **Status:** soundness **UNSOUND**; proof artifact deficient. +* **Valid use:** choose any `p∈P,d∈D`, target aarch64, `burst=on`, allocator + arena, and call the public safe `lane_id(0)`. This point belongs to `Q×U` and + requires no caller safety obligation. +* **Reachability:** `C` includes lines 13-22 and the function immediately calls + `NonZeroU8::new_unchecked(0)`. +* **False proposition:** that unsafe function requires a nonzero argument; zero + falsifies it. +* **UB consequence:** the exact standard-library contract states that zero + causes UB, independently confirmed by the Reference invalid-value rule. +* **Proof defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced constructor invariant and is false for caller-controlled `u8`. +* **Minimum repair:** make a dominating `value==0` panic check apply to the + exceptional block (or remove that block), then re-audit all cfg cases. Merely + editing the comment cannot repair the safe API. + +## Rust axioms and TCB audit + +The material Rust 1.85.1 propositions were checked against these narrowly +scoped authorities: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “returns an + error if the environment variable is not set, or if the value is not valid + Unicode”; [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” +* [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + sequentially execute component statements; [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + “branches on a pattern.” These ground the source order, while `BUILD.md` + supplies the claimed complete raw partition. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) “Prints + to the standard output, with a newline,” and its [panic contract](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + says it panics if stdout writing fails. [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached construct according to its predicate; + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” + The [equality operators](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + are equality/inequality tests, and an [if expression](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes its consequent when its boolean condition is true. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and “This results in undefined behavior if the + value is zero.” The [Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) + says producing an invalid value is immediate UB and names `NonZero` as a type + with a custom valid range. + +`BUILD-MAP-ORDERED` is accepted only for: Cargo 1.85.1 execution; successful +rerun-line freshness including present-to-present changes; exact current +successful cfg-line interpretation with no retained selector; no library/stale +result after unsuccessful script exit; main-thread panic as unsuccessful; and +the named feature/target cfgs. Consumers are B-01–B-03 and source reachability. +No claim about emitted strings, source correctness, Rust semantics, backend, or +binary is imported. Its stated trigger—any Cargo/toolchain, manifest, script, +environment, target, source-cfg, or disposition change—requires re-audit; +source/API/docs/support changes likewise do. + +## Residual scope and attestation + +Manual rustc, invented cfgs, build-script override, unsupported targets, and +rejected raw values producing a library are outside the theorem exactly as +`BUILD.md` states. Rejected build executions and wasm32/arena have no API point +and are not counted as vacuously sound members of `S`. Every discovered build, +configuration, safe-surface, unsafe-operation, and requested postcondition +obligation has a status above; there is no sampled evidence or unresolved +supported configuration remainder. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/G.md new file mode 100644 index 0000000000..b70a0f21ac --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/G.md @@ -0,0 +1,208 @@ +# Source-only unsafe-code audit: supplied crate + +**Cutoff:** 2026-08-01. **Snapshot:** the complete supplied `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and `TCB.md`; no generated +source, dependencies, lockfile, tests, or prior audit were supplied or used. +Rust, standard library, edition, and Cargo are exactly 1.85.1, 1.85.1, 2021, +and 1.85.1. This is a Rust-abstract-semantics result, not a compiler-binary or +platform theorem. + +## Claims and verdicts + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the compiled public library is free of Rust UB over the supported domain | **UNSOUND** | F-1 gives a valid supported safe call, reaches `new_unchecked(0)`, falsifies its safety condition, and its contract says the result is UB. | +| `lane_id(value)` “Panics when `value` is zero” | **UNPROVED** | Proved on `not(K)` below. The only failing region executes UB, so it is not a UB-free `CONTRACT-BROKEN` witness. | +| Exact maximal sound API region | **PROVED** relative to `BUILD-MAP-ORDERED` | Both containments and maximality are proved below. | +| Ordered selector/rejection/freshness relation and wasm/arena source exclusion | **PROVED** relative to `BUILD-MAP-ORDERED` | Exhaustive staged relation below. | + +The combined mandatory result is therefore **soundness UNSOUND; panic +postcondition UNPROVED**. No design change affects these current-snapshot +verdicts. + +## Domain recovery + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `B={off,on}` be `burst`, `A={system,arena}`, `P` any Cargo profile, `D` either + debug-assertion state, and `v:u8` any safe API input; +* `C0=T×B×A×P×D`; +* `E(c) := target=wasm32-unknown-unknown ∧ allocator=arena`; +* `S := C0 ∖ E`, the supported compiled-library configurations; and +* `K(c) := burst=on ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena`. + +This is an equality, not a sample: `SUPPORT.md` says “these target triples,” +“both states,” “both allocator models,” “exactly one exclusion,” and “every +other combination,” and explicitly quantifies every profile and both `D` +states. Thus every member of `S` is promised and every promised library +configuration is in `S`; there is no policy conflict. `Cargo.toml` independently +fixes the sole feature and toolchain. Profiles and `D` do not occur in a source +predicate or arithmetic operation, so every proof below is parametric over +their fibers. + +The full required cases are (i) every supported Cargo build attempt for each +raw environment class and every possible relevant stdout success/failure +sequence, including required rejection outcomes, and (ii) every safe +`lane_id(v)` execution for `c∈S`. Manual `rustc`, invented cfgs, and build-script +overrides are expressly outside `BUILD.md`. + +## Checked semantic authority + +These are Rust 1.85.1 axioms, not extra project assumptions: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says it + returns `NotPresent` when “The variable is not set” and `NotUnicode` when the + value “is not valid Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + has exactly those two variants. The fixed key contains neither `=` nor NUL. +* A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements,” and a + [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + compares arm patterns sequentially and chooses the first match. [Literal + patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the value created by the literal”; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” [`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + extracts a slice containing the entire `String`. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached form from its predicate; [`all`/`not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + are true when all operands are true / their operand is false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message.” +* The [comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + and [`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + rules make `value == 0` select its consequent exactly for zero. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + says: “The value must not be zero,” and “This results in undefined behavior + if the value is zero.” + +Cargo's 1.85.1 documentation corroborates, but does not replace, the accepted +Cargo premise: build scripts communicate by `cargo::` lines on stdout +([life cycle](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script)); +`rustc-cfg` passes the value to compiler `--cfg` +([outputs](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)); +and `rerun-if-env-changed` reruns when the named value changes +([freshness](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). +Process failure, current-output identity, and stale-artifact non-presentation +are consumed only in the narrower wording of accepted `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Write `R` for the complete rerun line, `Sline` for the system cfg line, and +`Aline` for the arena cfg line. A failed `println!` may have emitted an +unspecified fragment `q` of that attempted output; no proof consumes `q`. + +1. Every path first attempts `R`. Failure exits by uncaught panic with output + `q`, performs no environment read, and produces no current library. + Success leaves the complete prefix `[R]` and only then calls `env::var`. +2. The result partition is exhaustive: absent; Unicode `system`; Unicode + `arena`; Unicode `arena-stop`; every other Unicode string (including empty); + and non-Unicode. Absence and `system` next attempt `Sline`; `arena` and + `arena-stop` next attempt `Aline`. Failure at any such second write exits by + uncaught panic with `[R]·q` and no current library. +3. Successful absent/`system` writes yield exactly `[R,Sline]`, normal return, + and exactly cfg `fixture_allocator="system"`. Successful `arena` yields + exactly `[R,Aline]`, normal return, and exactly cfg + `fixture_allocator="arena"`. These are the only successful selectors. +4. Successful `arena-stop` writes `[R,Aline]` and then explicitly panics. + Other-Unicode and non-Unicode explicitly panic with exactly the completed + directive prefix `[R]`, before attempting any allocator line. By + `BUILD-MAP-ORDERED`, every unsuccessful process produces no current library + even if a complete selector line was emitted; no prior selector is retained. + +This includes every stdout failure point and every claim-relevant partial +prefix. The raw partition is exact by `env::var`/`VarError`, the four literal +arms, and the wildcard; it creates only the two allocator models. + +On a successful selector, `BUILD-MAP-ORDERED` supplies exactly that allocator +cfg, maps `burst` and the three target triples to the named leaf cfgs, and +supplies no old selector. For `E`, the crate-level `all(wasm32,arena)` is true +for both feature states and `compile_error!` fails compilation. Conversely, +within `C0`, that conjunction is true only on `E`; hence the enforced exclusion +equals, rather than merely contains, the policy exclusion. All `S` cases reach +`lane_id` source. + +**Freshness certificate.** A successful `arena` build necessarily completed +`R`. In the same target directory, changing the raw value to `arena-stop` is a +present-to-present change. The exact accepted premise therefore makes the old +selection stale and reruns the script before current selection. The rerun +either fails a write or completes `[R,Aline]` and panics; all alternatives are +unsuccessful, compile no current library, and cannot present the old arena +library as the current result. + +## API, obligations, and exact maximal sound region + +The boundary inventory is complete: the crate exports only the safe free +function `lane_id(u8)->NonZeroU8`. There are no public fields, constructors, +traits/impls, callbacks, FFI, reexports, hidden items, or generated APIs. Its +only unsafe operations are the two cfg-complementary `new_unchecked` calls. +There is no persistent invariant-bearing representation. + +Cfg semantics makes the first block present exactly on `K` and the second +present exactly on `not(K)`; these predicates are complements, so exactly one +unsafe call exists in every `S` compilation. + +Define + +`M := {(c,v) ∈ S×u8 | ¬K(c) ∨ v≠0}`. + +**`M` is sound.** If `¬K` and `v=0`, the equality is true and `panic!` is +executed before the unsafe call; panic is not UB. If `¬K` and `v≠0`, that +branch is skipped and the dominating comparison establishes the exact +`new_unchecked` precondition. If `K` and `v≠0`, the input itself establishes +that precondition. These cases exhaust `M`; profile, debug assertions, and +panic strategy do not alter selection or the precondition. + +**Maximality/equality.** Inside `S×u8`, Boolean and integer case splitting gives +`(S×u8) ∖ M = {(c,0) | c∈S ∧ K(c)}`. Every such case reaches +`new_unchecked(0)`, whose required proposition is false and whose applicable +contract entails UB. Thus every point in `M` is sound and no point outside it +can be added: `M` is the exact maximal sound region. Over the pre-exclusion +product `C0×u8`, `E×u8` is rejected rather than a compiled API region; the +exact sound-or-rejected region is `(E×u8) ∪ M`. + +For the panic postcondition, all `¬K,v=0` cases execute `panic!`. The +`K,v=0` cases instead enter UB. Under whole-execution classification they prove +neither that a panic occurs nor a UB-free failure to panic, so the universal +postcondition is **UNPROVED**, not `CONTRACT-BROKEN`. + +## Finding F-1: unchecked zero in the special branch + +* **Implementation:** **UNSOUND**; **proof artifact:** false/deficient. +* **Valid use:** successfully build supported `aarch64-unknown-linux-gnu` with + raw `arena`, `burst` enabled, any profile/debug state, then safe-call + `lane_id(0)`. Safe callers have no precondition. +* **Reachability:** all three leaves of `K` are true, so the special block calls + `new_unchecked(0)`. +* **False proposition and consequence:** required `value≠0` is false; the + version-matched contract explicitly entails UB. +* **Comment defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced producer contract and is contradicted by the public `u8` input. +* **Minimum repair:** perform the zero check before every cfg-dependent unsafe + call (or use a checked constructor) and replace the comment with the + dominating-check derivation. Re-audit `M` and the panic contract. Merely + changing documentation cannot repair the safe API. + +The fallback comment's local fact is correct: its zero branch dominates the +unsafe call. No other implementation or proof finding was found after the +complete surface/configuration inventory; this does not dilute F-1. + +## TCB, residual scope, and triggers + +The sole admitted project entry is `TCB.md` / **BUILD-MAP-ORDERED**, accepted +for exact Cargo 1.85.1 and only its stated execution, stdout-success, +freshness, process-status, feature, target-cfg, and selector-identity +propositions. Consumers are the staged relation, reachability, freshness, and +exclusion proof above. It supplies no Rust semantics or source correctness and +has not been widened. The Rust links above are authoritative axioms. There are +no dependency, tool-derived, external, probabilistic, deployment, or backend +premises and no test evidence. + +Re-audit on any supplied source/policy/manifest change; Rust, std, Cargo, target, +feature, profile, cfg, allocator, environment interface, or TCB change; changed +authoritative wording; or any new public/unsafe surface. All requested source +and build outcomes were audited; binaries, actual compiler correctness, +platform execution, manual cfg injection, and target files not supplied are +outside scope. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/H.md new file mode 100644 index 0000000000..069ed51e9b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/H.md @@ -0,0 +1,107 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +## Claims, scope, and verdicts + +This is a source-only audit of `Cargo.toml`, `build.rs`, `src/lib.rs`, and the supplied build, support, request, and TCB policies, at cutoff 2026-08-01. It covers Rust/Cargo/standard library 1.85.1, the complete supported build interface, the only public safe API, both unsafe operations, the source-enforced exclusion, and the documented panic postcondition. No binary/backend claim is made; nothing was built, run, tested, generated, or expanded. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every valid safe `lane_id` call in the required library domain is free of Rust UB. | **UNSOUND** | `SOUND-1` below gives a valid supported zero-input witness reaching documented UB. | +| “Panics when `value` is zero” throughout that domain. | **UNPROVED** | Proved outside `U`; inside `U` the only execution has UB, so it cannot certify `CONTRACT-BROKEN`. | +| Ordered build mapping, rejection, and freshness behavior. | **PROVED relative to accepted `BUILD-MAP-ORDERED`** | Exhaustive raw-value/write-outcome partition `BUILD-1`; freshness proof `BUILD-2`. | +| wasm32/arena is effectively excluded. | **PROVED relative to `BUILD-MAP-ORDERED`** | `CFG-1`: every successful arena selection for wasm32 activates `compile_error!`. | +| Formula `S` below is the exact maximal sound region. | **PROVED relative to the stated TCB** | Positive proof on `S`; UB proof at every point of its complement in the supported domain. | + +The combined mandatory result is **UNSOUND; documented postcondition UNPROVED**. + +## Required theorem domain and closure + +Let `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, wasm32-unknown-unknown}`, `B={burst-off,burst-on}`, `A={system,arena}`, `P` be every Cargo profile, and `D={debug-assertions-off,on}`. The policy's full product is + +`F = T × B × A × P × D`. + +Its exact supported library predicate is + +`C = F ∖ {c ∈ F | target(c)=wasm32-unknown-unknown ∧ allocator(c)=arena}`. + +This is an equality, not an inferred narrowing: `SUPPORT.md` gives precisely these axes, all their combinations, and exactly that exclusion. `Cargo.toml` fixes Rust 1.85.1/edition 2021 and declares `burst`; `BUILD.md` fixes allocator selection. Profiles and debug assertions never occur in either selected function body, so all proofs below are parametric over `P×D`. + +Build-interface `Required` additionally quantifies over every raw `FIXTURE_ALLOCATOR` class (omitted, `system`, `arena`, `arena-stop`, other Unicode, non-Unicode) and success/failure of every attempted stdout write. A current API execution exists only after an accepted selector's successful script exit and successful non-excluded library compilation. For API soundness, `Required=C×{0,…,255}`: `u8` is the “8-bit unsigned integer type” ([`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)), and this safe function states no caller precondition. + +Closure is exhaustive: `BUILD-1` partitions all build cases; `C` partitions into `U` and `¬U`; inputs partition into zero and nonzero. Each obligation below covers every resulting case, so no sampled configuration substitutes for `Required ⊆ Covered`. + +## Authoritative Rust 1.85.1 premises + +These are the only Rust semantic axioms consumed: + +- **AX-ENV.** `env::var` returns `NotPresent` when “The variable is not set” and `NotUnicode` when its value “is not valid Unicode” ([`var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); `VarError` has exactly `NotPresent` and `NotUnicode(OsString)` ([`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html)). `String::as_str` “Extracts a string slice containing the entire `String`” ([`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). A match chooses “The first arm with a matching pattern” ([match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)); literal patterns match their literal and `_` matches any value ([literal](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern)). +- **AX-OUT/PANIC.** `println!` “Panics if writing to `io::stdout` fails” ([`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). +- **AX-CFG.** A `cfg` attribute “conditionally includes the thing it is attached to” ([`cfg`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); `compile_error!` “causes compilation to fail with the given error message” ([`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +- **AX-CONTROL.** For `if`, a true condition executes the consequent block ([`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is an equality operator ([comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). Thus the `u8` comparison exactly separates zero from nonzero. +- **AX-NZ.** `NonZero::new_unchecked` “Creates a non-zero integer value without checking”; “This results in undefined behavior if the value is zero” ([`new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). This is also the Reference's UB class “producing an invalid value” ([undefined behavior](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). + +## Ordered build-to-source relation + +Write `R` for the complete rerun line and `S`/`A` for complete `system`/`arena` cfg lines. `q(L)` means any byte prefix produced by the failing `println!` for line `L` (possibly empty); regardless of those bytes, the TCB says an unsuccessful execution supplies no current library. + +| Raw class and ordered events after entry | Emitted prefix; exit; current result | +|---|---| +| Any raw value; first print fails | `q(R)`; println panic/unsuccessful; no library | +| omitted or Unicode `system`; `R` succeeds; `S` fails | `R,q(S)`; println panic; no library | +| same; both prints succeed | `R,S`; normal return; cfg `fixture_allocator="system"` | +| Unicode `arena`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; both succeed | `R,A`; normal return; cfg `fixture_allocator="arena"` | +| Unicode `arena-stop`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; `A` succeeds | `R,A`; explicit panic; no library | +| other Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | +| non-Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | + +**BUILD-1.** AX-ENV and the fixed valid key make `env::var`'s result exactly absent, valid-Unicode `String`, or non-Unicode. AX-ENV/match/literals then select exactly the listed source arm. There are only the two `println!` sites in execution order; AX-OUT establishes each failure exit. Falling through `main` is successful. `BUILD-MAP-ORDERED` supplies only the stated Cargo consequences: a successful current script passes its exact cfg; every panic/write-failure exit compiles/presents no current library. Thus even a complete allocator directive in the `arena-stop` prefix has no effect. + +**BUILD-2 (freshness).** A successful `arena` run necessarily wrote `R` then `A`. The accepted TCB says that changing the raw present value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly three possibilities above: first print failure; `R` followed by allocator-print failure; or `R,A` followed by explicit panic. All are unsuccessful, and the TCB expressly forbids presenting the old arena library as the current result. The canary therefore rejects under reuse of the same target directory. + +**CFG-1.** On a successful arena selector, the TCB maps its emitted cfg exactly and maps the three target triples to their stated `target_arch`. AX-CFG makes `all(target_arch="wasm32", fixture_allocator="arena")` include `compile_error!` for both feature states; AX-CFG then forces compilation failure. Other raw rejection cases never reach current library compilation. The project exclusion is therefore enforced. + +The complete successful-output-to-source projection is therefore: + +| Emitted allocator cfg | Target/feature | Selected library source/result | +|---|---|---| +| `system` | every `T×B` | no source error; `U` is false; checked block | +| `arena` | x86_64, either feature | no source error; `U` is false; checked block | +| `arena` | aarch64, burst off | no source error; `U` is false; checked block | +| `arena` | aarch64, burst on | no source error; `U` is true; unchecked burst block | +| `arena` | wasm32, either feature | `compile_error!`; no current library artifact | + +No other allocator cfg reaches a current compilation. These cases are exhaustive by `BUILD-1` and the TCB's exact feature/target mappings. + +## API, obligations, and exact maximal sound region + +The entire public surface is safe free function `lane_id(u8)->NonZeroU8`; there are no public fields/types, traits, callbacks, FFI, reexports, hidden items, or generated/macro-generated APIs. `build.rs::main` is the audited build entrypoint. The two cfg-complementary `new_unchecked` calls are the only unsafe operations. The sole invariant consumed/established is that the returned `NonZeroU8` contains a nonzero integer. + +Define + +`U(c) := burst(c)=on ∧ target(c)=aarch64-unknown-linux-gnu ∧ allocator(c)=arena`. + +The exact maximal sound region over the full supported product and every API input is + +`S = {(c,v) ∈ C×{0,…,255} | ¬U(c) ∨ v≠0}`. + +**Positive proof.** If `U(c)`, AX-CFG includes only the first block; for `v≠0`, AX-NZ's sole safety requirement holds and it constructs the promised nonzero value. If `¬U(c)`, AX-CFG includes only the checked block. At `v=0`, AX-CONTROL reaches `panic!` before unsafe code. At `v≠0`, it skips the panic and the dominating comparison establishes AX-NZ's precondition. These cases cover `S`, independently of profile/debug-assertion state. + +**SOUND-1 and maximality.** Choose any profile/debug state, successful raw `arena`, aarch64 target, `burst` enabled, and safe input `0`. This configuration lies in `C`; `0` is a valid `u8`; the public call is valid safe use. `U` includes the unchecked block, which executes `new_unchecked(0)`. AX-NZ says that exact event is UB. Hence the full universal claim is **UNSOUND**. Every point of `(C×u8)\S` has exactly those three cfg facts and `v=0`, so the same proof establishes UB everywhere outside `S`; together with the positive proof, `S` is maximal, not merely a positive remainder. + +**Panic postcondition.** For every `c∈C` with `¬U(c)` and `v=0`, the checked branch invokes `panic!`, proving the documented implication. For `U(c),v=0`, execution instead has UB. Under the required whole-execution certificate, that is not a UB-free witness to a broken behavioral contract. Therefore the full postcondition is **UNPROVED**, not `CONTRACT-BROKEN`; its exact unresolved region is `{(c,0)|c∈C∧U(c)}`. + +## Finding and proof-artifact assessment + +**F-1 (critical implementation defect).** The first safety comment claims burst-mode lane identifiers are never zero, but the safe boundary accepts arbitrary `u8` and establishes no such invariant. The smallest repair is an unconditional zero check before either unsafe call (or a safe checked constructor), preserving the documented panic contract. Re-audit all cfg regions afterward. + +The second comment's dominating `value==0` branch does establish the required nonzero fact, so its implementation proof is correct on `¬U`; for proof-grade maintenance it should also name `new_unchecked`'s exact requirement and resulting `NonZeroU8` invariant. The first comment is false, not merely incomplete. + +## TCB audit log, evidence, residual scope, and triggers + +`BUILD-MAP-ORDERED` is the sole non-Rust admitted premise. Its human disposition is accepted only for Cargo 1.85.1, this exact manifest/build script/environment/library, successful-line interpretation, freshness/no-stale-result behavior, failure status, feature cfg, and target-arch cfg. This report consumes every listed part only in `BUILD-1`, `BUILD-2`, `CFG-1`, and reachability; it does not use it for source correctness. AX-ENV through AX-NZ are exact versioned Rust authority, not implementation trust. There are no dependencies, unsafe dependencies, tool results, tests, prior audits, or additional assumptions. + +Excluded/residual scope: compiler/backend correctness, binaries, custom/manual rustc cfgs, overridden build scripts, unsupported targets/toolchains, rejected raw selectors, and wasm32/arena artifacts. Re-audit on any source/manifest/policy/TCB change; Rust/Cargo/stdlib version change; target, feature, allocator, profile, environment, or cfg-domain change; or material authoritative-documentation change. + +All in-scope surfaces, raw classes, exits, prefixes, obligations, configuration partitions, mandatory postconditions, TCB consumers, and unresolved regions have dispositions. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/I.md new file mode 100644 index 0000000000..ab56821442 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/I.md @@ -0,0 +1,190 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +Audit cutoff: 2026-08-01. This is a source-level Rust 1.85.1/standard-library +1.85.1 audit of the supplied manifest, policies, `TCB.md`, `build.rs`, and +`src/lib.rs`; no backend or binary claim is made. No dependency, generated +file, test, prior audit, or tool result is present or used. + +## Claims and verdicts + +* **Safe-library soundness: UNSOUND.** A supported, well-typed safe call reaches + `NonZeroU8::new_unchecked(0)` (certificate `BAD` below). +* **Documented panic postcondition: UNPROVED**, not `CONTRACT-BROKEN`. It is + proved wherever its antecedent is relevant outside `BAD`; in `BAD`, the only + source execution already has undefined behavior, so it cannot be the required + UB-free postcondition witness. +* **Ordered build interface and exclusion: PROVED relative to the accepted + `BUILD-MAP-ORDERED` premise.** This includes all raw-selector classes, write + failures, partial prefixes, current-build rejection, and the stated + arena-to-arena-stop freshness sequence. + +The combined mandatory result is therefore **UNSOUND / postcondition +UNPROVED**, relative only to `TCB.md`'s accepted, exact Cargo premise and the +Rust axioms quoted below. + +## Exact domain and its recovery + +Let + +* `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`, `B={off,on}`, `A={system,arena}`; +* `P` be every Cargo profile and `D={debug_assertions off,on}`; and +* `U={0,...,255}`, exactly the values of `u8`. + +`SUPPORT.md` literally defines the base product `C0=T×B×A×P×D` and the sole +exclusion `E={c∈C0 | c.target=wasm32-unknown-unknown ∧ c.allocator=arena}`. +Thus the supported library predicate is exactly `C=C0\E`: `C⊆C0\E` follows +from “every other combination ... is supported,” and `C0\E⊆C` follows from +the same exhaustive product statement; the single exclusion proves the reverse +nonmembership. Rust/Cargo are exactly 1.85.1 and the edition is 2021. + +The raw environment partition is the disjoint, exhaustive set +`R={absent, U("system"), U("arena"), U("arena-stop"), U(other), non-U}`. +Here `U(other)` means every other Unicode string. `env::var` “Returns a +`VarError` if the variable is not present, or if it is not valid Unicode” +([Rust 1.85.1 `env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); +the two documented error variants and the `Ok(String)` case, followed by +equality with the three literals and `_`, prove both coverage and disjointness. +`String::as_str` “Extracts a string slice containing the entire `String`” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). +Accepted fibers are `absent,U("system") -> system` and `U("arena") -> arena`; +the other three are rejection cases, not allocators. Manual `rustc`, invented +cfgs, and build-script overrides are expressly outside `BUILD.md`'s theorem. + +The full required case domain is (i) every build-interface execution over `R`, +the supported target/feature/profile/debug axes, each stdout success/failure +possibility, and reusable prior Cargo-target state, plus (ii) every safe +`lane_id(v)` call for `(c,v)∈C×U` produced by an accepted current build. This +retains inputs, execution/history, and configuration rather than replacing +them by `Required_cfg=C`. + +## Complete ordered build relation + +Write `RERUN` for the complete first line and `CFG(a)` for the allocator line. +Blocks execute operations sequentially and a match chooses the first matching +arm ([block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html), +[match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). +`println!` “Panics if writing to `io::stdout` fails” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)). +Consequently: + +| Raw class | after successful `RERUN` write | terminal result if later writes succeed | +|---|---|---| +| absent | read `NotPresent`; attempt `CFG(system)` | return success | +| `U("system")` | read `Ok`; attempt `CFG(system)` | return success | +| `U("arena")` | read `Ok`; attempt `CFG(arena)` | return success | +| `U("arena-stop")` | read `Ok`; attempt `CFG(arena)` | explicit panic after that complete line | +| `U(other)` | read `Ok`; no allocator write | explicit unsupported-value panic | +| non-U | read `NotUnicode`; no allocator write | explicit valid-Unicode panic | + +This table lists every successful script path: exactly its first three rows. +Before every row, failure of the first write exits by panic with no complete +line (and possibly a byte-prefix of `RERUN`); the environment read and all later +steps are unreached. In the four rows that attempt `CFG`, failure of that second +write exits by panic after complete prefix `[RERUN]` (and possibly a byte-prefix +of `CFG`); its return or explicit later panic is unreached. The successful +`arena-stop` write produces complete prefix `[RERUN,CFG(arena)]` before its +explicit panic. The other explicit rejections leave complete prefix `[RERUN]`. +These are all stdout calls and all alternative exits in `build.rs`. + +`BUILD-MAP-ORDERED` supplies, for Cargo 1.85.1 and every profile, exactly the +following consumed facts: a complete successful `RERUN` registers changes in +the raw value (including present-to-present); only a successful current script's +complete `CFG(a)` reaches the current library compilation; no prior selector is +retained; any write failure or uncaught explicit panic is unsuccessful; and an +unsuccessful script yields no current library or prior artifact as the current +result. Therefore arbitrary failed-write byte prefixes and every complete +prefix above are inert for source selection. + +**Freshness witness.** For a successful arena build (necessarily x86_64 or +aarch64 once the source exclusion is applied), the first run successfully wrote +`RERUN,CFG(arena)`. In the same target directory, raw `arena -> arena-stop` is a +registered present-to-present change, so Cargo reruns before selection. The new +run either fails at write 1, fails at write 2, or writes both lines and then +panics. Every exhaustive case is unsuccessful and `BUILD-MAP-ORDERED` forbids +both a current compilation and presentation of the earlier arena library. + +**Target exclusion.** A successful raw-arena script gives exactly +`fixture_allocator="arena"`; the accepted TCB maps the wasm triple to +`target_arch="wasm32"`. The `all` predicate on `lib.rs:3` is then true, +regardless of `burst`. A `cfg` attribute includes its item when true and removes +it when false +([Reference 1.85.1](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); +`compile_error!` “Causes compilation to fail with the given error message when +encountered” +([std 1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +Thus every wasm/arena current compilation fails; if the script failed earlier, +the TCB already forbids compilation. No later-source fact is used on that exit. +For all other target/allocator pairs this particular `all` is false, so the +error item is absent. This proves exactly `E`, not a wider exclusion. + +## API, invariants, and unsafe obligations + +The complete language-reachable crate API is the safe free function +`lane_id(u8)->NonZeroU8`; there are no public fields, constructors of a local +type, traits/impls, macros, statics, FFI, reexports, callbacks, or dependencies. +Build code contains no unsafe operation. The two unsafe sites are +`lib.rs:21` and `lib.rs:36`. The consumed standard-library contract is exact: +`new_unchecked` “Creates a non-zero without checking whether the value is +non-zero. This results in undefined behavior if the value is zero,” and its +safety clause is “The value must not be zero” +([Rust 1.85.1](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +Define `H(c) = c.target=aarch64-unknown-linux-gnu ∧ c.burst=on ∧ +c.allocator=arena`. Accepted Cargo mappings and Rust `cfg(all(...))` semantics +make `H` select the first block and remove the `not(all(...))` block; `¬H` does +the reverse. + +* If `H(c)∧v!=0`, line 21 satisfies the exact unsafe precondition and returns + the corresponding nonzero value. +* If `¬H(c)∧v=0`, `if value==0` reaches `panic!` before line 36. If + `¬H(c)∧v!=0`, the false branch itself establishes the proposition needed by + line 36. Thus the second safety comment is adequate and this entire case is + UB-free. Profile, debug-assertion state, and panic strategy cannot alter the + cfg or value partition; abort versus unwind occurs only after the proved + zero-input panic and no invariant is suspended. +* **`BAD`:** choose any profile/debug state, `c=(aarch64,burst on,arena,...)∈C` + and safe input `v=0`. The public safe call is valid; `H(c)` reaches line 21; + its required `v!=0` proposition is false; the quoted contract directly + entails undefined behavior. This is a complete existential UB certificate. + The adjacent claim “Burst-mode lane identifiers are never zero” is false: + the API accepts every `u8` and enforces no such invariant. + +Therefore the **exact maximal sound region** over the requested full product is + +`SOUND = C×U \ { (c,0) | H(c) }`. + +Positive inclusion follows from the first two bullets. Reverse inclusion and +maximality follow because every omitted case satisfies `H∧v=0` and the `BAD` +derivation is parametric in profile/debug state, proving UB for every such +case—not merely one sample. The regions partition `C×U` exhaustively by +`H/¬H` and `v=0/v!=0`. + +The panic postcondition is proved for every zero input in `¬H`: the check +executes `panic!`, which “Panics the current thread” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). It imposes no +claim for nonzero inputs. For `H∧v=0`, UB precedes any panic, leaving the global +postcondition `UNPROVED` and supplying no `CONTRACT-BROKEN` certificate. + +## Finding, TCB log, and residual scope + +**F-1 (critical, UNSOUND; proof comment deficient).** `lib.rs:13-22` hides an +unenforced nonzero precondition behind a safe API. Minimum repair: perform the +zero check before either cfg branch (or use checked `NonZeroU8::new` and panic +on `None`), then replace the first safety comment with the dominating check's +exact `value!=0` derivation. Re-audit all `C×U`, both panic strategies, and the +documented panic after any change. + +**TCB log `supplied-TCB/BUILD-MAP-ORDERED`.** Category `IMPLEMENTATION`, human +disposition accepted; identity Cargo 1.85.1 plus the supplied manifest/build +interface; consumers are only ordered output interpretation, raw-value +freshness, feature/target/cfg reachability, selected source, and rejection. It +does not supply local emission order, source correctness, Rust semantics, +backend, or binary correctness; those were not widened. No other admitted +premise is consumed. Re-audit on any toolchain, source, manifest, policy, +target, cfg, feature, environment-interface, or TCB-disposition change. + +Residual scope: compiler/backend correctness, binaries, manually manufactured +cfgs, unsupported targets/toolchains, and overridden build machinery. Tool +evidence: none. The current global failure is proved rather than inferred from +missing tests. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/J.md new file mode 100644 index 0000000000..bfc973ce24 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/B/reports/J.md @@ -0,0 +1,199 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +Snapshot: the supplied `Cargo.toml`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, +`build.rs`, and `src/lib.rs`; Rust and standard library 1.85.1, edition 2021. +No target was built, run, expanded, or modified. There are no dependencies or +generated source files. The only accepted non-Rust premise is +`BUILD-MAP-ORDERED` in the supplied `TCB.md`. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {off,on}` for `burst`, `A = {system,arena}`, `P` be every Cargo + profile, `D = {off,on}` for debug assertions, and `U = {0,...,255}`; +- `Q = {1.85.1} × T × B × A × P × D`; and +- `L = Q \ {q | target(q)=wasm32-unknown-unknown ∧ allocator(q)=arena}`. + +`Q` is the literal product in `SUPPORT.md`; the displayed subtraction is its +sole stated exclusion, so both containments establishing this normalization +follow directly from lines 3–16. Required library/API cases are `L × U`. +Profiles, debug assertions, and their panic strategies remain symbolic: no +source predicate or unsafe precondition depends on them. + +**Soundness: UNSOUND** for the complete crate over the required source-level +domain, relative to `BUILD-MAP-ORDERED`. A valid witness is any profile/debug +state with target `aarch64-unknown-linux-gnu`, `burst=on`, allocator `arena`, +and the safe call `lane_id(0)`. This configuration is in `L`. The selected +block at `lib.rs:12–20` executes `NonZeroU8::new_unchecked(0)`. Its safety +condition is false and its exact 1.85.1 contract says this is undefined +behavior (AX-5 below). This completes the existential certificate. + +**Documented postcondition: UNPROVED** globally. `lib.rs:8–10` promises that +`lane_id` “Panics when `value` is zero.” This is proved regionally whenever +`C(q) := burst(on) ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena` is +false: zero enters `lib.rs:28–30` and panics before unsafe code. In the `C` +region, zero instead reaches UB. That refutes soundness but cannot be a +`CONTRACT-BROKEN` witness because the execution is not UB-free as a whole; no +independent UB-free refutation is established. + +### Exact maximal sound region + +The exact maximal sound subset of the full supported configuration/input +domain is + +`M = {(q,v) ∈ L × U | ¬(C(q) ∧ v=0)}`. + +Proof of inclusion: if `C` is true and `v≠0`, `lib.rs:12–20` supplies the exact +nonzero precondition to `new_unchecked`. If `C` is false, the complementary +block at lines 22–33 is selected. For `v=0` it panics before the unsafe call; +for `v≠0`, falling through the check establishes the unsafe precondition. +These are the crate's only unsafe operations. Proof of maximality: the +complement of `M` inside `L×U` is exactly every profile/debug fiber satisfying +`C ∧ v=0`; the witness derivation above applies parametrically to every such +fiber. Thus every complement member is unsound and no strict superset within +`L×U` is sound. + +## Ordered build-to-source relation + +Write `R`, `S`, and `A` for the complete newline-terminated lines +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, +`cargo::rustc-cfg=fixture_allocator="system"`, and +`cargo::rustc-cfg=fixture_allocator="arena"`. A failing `println!` panics at +that point. The supplied premises do not constrain bytes partially written by +the failing call; below, “prefix” means the exact earlier successfully written +complete directive-line prefix. This byte-level remainder is immaterial because +`BUILD-MAP-ORDERED` forbids a current library compilation after every +unsuccessful exit. + +1. `build.rs:4` first attempts `R`. Failure exits by panic, with complete-line + prefix `[]`; the environment read and all later operations are unreached. + Success leaves prefix `[R]` and reaches `env::var`. +2. The literal key has neither `=` nor NUL. Rust's documented result therefore + partitions raw values into omitted → `Err(NotPresent)`, Unicode `s` → + `Ok(String(s))`, and non-Unicode → `Err(NotUnicode(_))`. `Result` and + `VarError` each have exactly the variants matched at lines 6–25. `as_str` + exposes the entire Unicode string; literal patterns match exactly and `_` + matches every remainder. +3. Omitted and Unicode `system` each attempt `S`; Unicode `arena` attempts + `A`. Failure of that second write exits at the `println!`, with prefix + `[R]` (plus unconstrained failed-call bytes). Success leaves respectively + `[R,S]` or `[R,A]`, then the function returns successfully. These are all + successful paths, and each attempts exactly one allocator directive. +4. Unicode `arena-stop` attempts `A`. A write failure exits with prefix `[R]` + and never reaches its explicit panic. A successful write leaves `[R,A]`, + then line 19 explicitly panics. Unicode values other than the three named + literals panic at line 21 with prefix `[R]` and never attempt an allocator + line. Non-Unicode values do likewise at line 24. Together with first-write + failure, these are every explicit/infrastructure rejection and every + material exit. +5. Only the two successful prefixes are consumed downstream. By + `BUILD-MAP-ORDERED`, successful `[R,S]` passes exactly + `fixture_allocator="system"`; successful `[R,A]` passes exactly + `fixture_allocator="arena"`. Every failed path produces no current library, + irrespective of complete or partial stdout already emitted. No later Cargo + cfg interpretation or library source selection is attributed to an earlier + exit. + +Freshness is closed, including the required sequence. A successful `arena` +build wrote `[R,A]`, so Cargo recorded the raw-variable invalidation rule. +Changing the same target directory's raw value to `arena-stop` is a +present-to-present change; `BUILD-MAP-ORDERED` makes the old selection stale +and reruns the script before current source selection. That run necessarily +ends at the first-write failure, second-write failure, or explicit panic. +The accepted premise says every such outcome compiles no current library and +does not present the prior arena library as the current result. + +For a successful current script, the same premise maps `burst` and the three +target triples to their exact cfg leaves. Rust cfg semantics then make +`all(target_arch="wasm32", fixture_allocator="arena")` true exactly for the +stated excluded pair, independent of `burst`, profile, and debug assertions. +The encountered `compile_error!` at `lib.rs:3–4` rejects compilation. Conversely +that predicate is false for every member of `L`, so this error is absent. The +project's target/allocator exclusion is therefore **PROVED effectively +enforced**, and no excluded current library is produced. + +## Boundary, invariant, and obligation coverage + +The build-script entrypoint is safe Rust. The sole downstream public surface +is safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, +constructors beyond that function, user-implementable traits, exports, FFI, +statics, or generated/hidden APIs. The two cfg alternatives contain the only +unsafe calls (`lib.rs:19,32`). Invariant `NZ(value): value≠0` must hold at each +call. Lines 28–31 establish it on the ordinary path. The comment at line 18 +merely asserts it on the burst path, but a safe `u8` parameter admits zero and +no producer, type, check, or accepted TCB entry establishes `NZ` there. + +Obligation dispositions: + +- build raw-value partition, operation order, successful outputs, failures, + freshness, and Cargo interpretation: PROVED relative to `BUILD-MAP-ORDERED`; +- wasm/arena rejection and complementary source selection: PROVED; +- ordinary-path unsafe precondition and zero panic: PROVED; +- burst/aarch64/arena unsafe precondition: UNSOUND at zero, PROVED for nonzero; +- global documented zero-panic guarantee: UNPROVED, region as stated above. + +## Rust authority and TCB log + +All quotations and links are version 1.85.1 and apply to this exact toolchain. + +- **AX-1 (environment/result).** [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html): + “Returns `VarError::NotPresent`” when unset and “Returns + `VarError::NotUnicode` if the variable’s value is not valid Unicode.” + [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) is + `NotPresent | NotUnicode(OsString)`; [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) + is `Ok(T) | Err(E)`. Consumers: build partition. +- **AX-2 (patterns/order).** [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” + [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the same value as what is created by the literal”; the + [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements and + then its final optional expression.” Consumers: exhaustive ordered relation. +- **AX-3 (panic/output).** [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) + “Prints to the standard output, with a newline” and [“Panics if writing to + `io::stdout` fails.”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the + current thread.” Consumers: build exits and zero postcondition. +- **AX-4 (selection/rejection).** The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + “conditionally includes the thing it is attached to based on a configuration + predicate”; [`all` and `not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + mean respectively all predicates true and the predicate false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message when encountered.” + Consumers: exclusion and the complementary lane blocks. +- **AX-5 (integer/unsafe contract).** [`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + is “The 8-bit unsigned integer type,” with `MIN=0` and `MAX=255`. + [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and zero “results in undefined behavior.” + Consumers: `NZ`, witness, and maximal region. + +**BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo +1.85.1 proposition in `TCB.md:8–39`, consumed only for rerun/freshness, +process-status handling, exact current allocator cfg, feature/target cfg, source +selection, and lack of a current/stale artifact after failure. It is not widened +to Rust semantics or source correctness. No other additional premise or tool +evidence is consumed. + +## Findings and remediation + +**F-1 — UNSOUND safe API.** `lib.rs:18` reverses an unsupported assertion into +the precondition of `new_unchecked`; callers control the safe `u8`. Minimal +repair: perform the zero check on every cfg path (prefer +`NonZeroU8::new(value).expect(...)`) and remove the invalid comment, or change +the API to accept `NonZeroU8` if contract compatibility permits. Re-audit the +new snapshot and its panic behavior. + +**F-2 — deficient proof artifact/postcondition.** The line-18 SAFETY comment +does not identify an enforcing fact and the implementation cannot establish the +documented zero panic in that region without first avoiding UB. Repair F-1 and +use adjacent proof text: “`value == 0` panicked above; reaching this call proves +`value != 0`, satisfying `new_unchecked`.” Changing the safe API or panic +contract requires compatibility review. + +Residual scope is source-level Rust only; compiler backend, binaries, and +deployment are not claimed. Re-audit on any source, policy, Cargo/Rust, +target/feature/allocator, cfg, TCB-disposition, or authoritative-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/ADJUDICATION_CELLS.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/ADJUDICATION_CELLS.json new file mode 100644 index 0000000000..21b1fe105c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/ADJUDICATION_CELLS.json @@ -0,0 +1,462 @@ +{ + "cells": [ + { + "field": "atom:L2", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "AX-IF supplies false => else, not the claimed else => false needed on the unsafe path." + }, + "s2": { + "decision": "PASS", + "evidence": "Steps 1-2 place execution in the false else arm and contrapose AX-EMPTY to n != 0." + } + }, + { + "field": "atom:L6", + "label": "B", + "s1": { + "decision": "FAIL", + "evidence": "Its closure relies on the unsupported AX-IF converse and defines Required without the valid-call/input dimension." + }, + "s2": { + "decision": "PASS", + "evidence": "The report closes both obligations and the empty path over the full domain, with PROVED and Required subset-of Covered." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "B says the request 'directly defines' Required as only exact source x Rust/std x targets x profiles, omitting valid calls/inputs and executions, then uses Covered = Required for its full PROVED certificate. That is the exact contracted-Required trigger; s2 records it absent." + }, + "field": "hard_error:G1", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The formal Required product omits valid calls/inputs even though the full PROVED verdict quantifies over them." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:G11", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The positive proof necessarily relies on an inapplicable direction of its cited if authority." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "Claims every nonlocal premise is checked and reconciled while AX-IF does not support the consumed converse." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "B", + "s1": { + "decision": "PRESENT", + "evidence": "The asserted Rust-only authority set contains an unsupported AX-IF proposition." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The AX-IF evidence is directionally insufficient for the proposition the proof consumes." + } + }, + { + "field": "atom:L2", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "A4's exact quote establishes false => else, not execution of else => false as consumed in O2." + }, + "s2": { + "decision": "PASS", + "evidence": "O2 states that reaching else makes is_empty false and uses A3 to derive n != 0." + } + }, + { + "field": "atom:L6", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The advertised Required subset-of Covered certificate materially relies on A4's unsupported converse." + }, + "s2": { + "decision": "PASS", + "evidence": "O1-O3 are connected to a full-scope PROVED verdict and an explicit Required subset-of Covered certificate." + } + }, + { + "field": "hard_error:G11", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The positive proof necessarily relies on an inapplicable direction of its if authority." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "Claims only checked version-matched premises and complete reconciliation while A4 does not support the consumed converse." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "TCB-LAST-R1 overstates the branch proposition established by A4." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The checked A4 excerpt does not establish the direction of if semantics consumed by O2." + } + }, + { + "field": "atom:L2", + "label": "E", + "s1": { + "decision": "FAIL", + "evidence": "A3 quotes only false => consequent skipped and vaguely invokes other branch rules; it does not extract authority proving else-path false." + }, + "s2": { + "decision": "PASS", + "evidence": "O2 places the call on false is_empty and contraposes A1 to n != 0." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "E's proposed comment asserts representability of len - 1, but E has no checked entry for len's usize type/domain, built-in subtraction, or overflow. It therefore cannot give the required unambiguous references to checked authority propositions for the L2-L5 chain; s1 passes it." + }, + "field": "atom:L8", + "label": "E", + "s1": { + "decision": "PASS", + "evidence": "Replacement text states false is_empty, nonzero len, representable predecessor, index < len, and get_unchecked's bounds need." + }, + "s2": { + "decision": "FAIL", + "evidence": "The replacement states the desired chain but refers to no checked authority for its material usize and subtraction/overflow steps." + } + }, + { + "field": "hard_error:G11", + "label": "E", + "s1": { + "decision": "PRESENT", + "evidence": "The positive result necessarily relies on unchecked Rust numeric and control-flow authority." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The PROVED conclusion necessarily relies on unchecked Rust type/domain, subtraction, and overflow propositions." + } + }, + { + "field": "hard_error:LH4", + "label": "E", + "s1": { + "decision": "PRESENT", + "evidence": "Calls the authority list complete while silently consuming usize, subtraction, overflow, and inadequately checked branch semantics." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It affirmatively calls the authority list complete while silently consuming the omitted integer premises." + } + }, + { + "field": "tcb_authority_defect", + "label": "E", + "s1": { + "decision": "PRESENT", + "evidence": "The purported authoritative inventory omits multiple consumed Rust premises." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Several material Rust/std premises have no checked version-matched authority entry." + } + }, + { + "field": "atom:L2", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "AX-IF quotes false => else but the proof uses the unsupported converse else => false." + }, + "s2": { + "decision": "PASS", + "evidence": "Step 2 identifies the false else path and contraposes the zero-length is_empty contract to L != 0." + } + }, + { + "field": "atom:L3", + "label": "F", + "s1": { + "decision": "PASS", + "evidence": "AX-LEN explicitly identifies L as an element count represented as usize; as a natural count, L != 0 yields L >= 1." + }, + "s2": { + "decision": "FAIL", + "evidence": "Although AX-LEN notes a usize return, the report substitutes 'natural count' and never checks the required nonnegative usize value-domain premise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "F's replacement asserts representable subtraction while its report has no checked usize/subtraction/overflow entries, so it cannot reference checked propositions for the full chain. The text also says only 'in bounds for this same slice' without identifying get_unchecked; s1 passes L8." + }, + "field": "atom:L8", + "label": "F", + "s1": { + "decision": "PASS", + "evidence": "Supplies adjacent text from false is_empty through nonzero length, defined predecessor, and the in-bounds conclusion." + }, + "s2": { + "decision": "FAIL", + "evidence": "The proposed comment gives a bounds chain but neither identifies get_unchecked in the text nor refers to checked usize/subtraction/overflow propositions, which the report lacks." + } + }, + { + "field": "hard_error:G11", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The positive verdict necessarily relies on unchecked subtraction/overflow semantics and an inapplicable implication direction for AX-IF." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The PROVED result necessarily relies on unchecked Rust usize-domain, integer-subtraction, and overflow premises." + } + }, + { + "field": "hard_error:LH4", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "Claims a complete authoritative reconciliation while silently consuming subtraction/overflow semantics and reversing AX-IF." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It claims the authority inventory is complete while silently consuming Rust integer-domain, subtraction, and overflow semantics." + } + }, + { + "field": "tcb_authority_defect", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The asserted Rust-only TCB omits consumed subtraction/overflow authority and overclaims the cited if proposition." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Material Rust integer premises are asserted without applicable checked Rust 1.82.0 authority." + } + }, + { + "field": "atom:L2", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "A4 quotes false => else but uses it as else => false on the unsafe path." + }, + "s2": { + "decision": "PASS", + "evidence": "OBL-1 identifies the false else path and contraposes A3 to n != 0." + } + }, + { + "field": "atom:L3", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "A2 verifies only element count; the proof's n: usize premise is neither inventoried nor checked as len's return type." + }, + "s2": { + "decision": "PASS", + "evidence": "The proof explicitly takes n: usize, applies A7's unsigned domain, and derives n >= 1." + } + }, + { + "field": "atom:L6", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "Full Required closure depends on the unsupported branch converse and unverified len-to-usize link." + }, + "s2": { + "decision": "PASS", + "evidence": "The report connects the exhaustive branch proof to A1, reports full-scope PROVED, and states Covered = Required." + } + }, + { + "field": "hard_error:G11", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "The implementation verdict necessarily relies on unchecked/inapplicable Rust authority at two material links." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "Certifies A1-A7 as complete while silently consuming len's return type and reversing the checked A4 implication." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "TCB-LAST-1 omits the consumed len return-type proposition and overclaims A4." + }, + "s2": { + "decision": "PRESENT", + "evidence": "A consumed standard-library return-type premise is not inventoried and quoted as authority, and AX-IF's excerpt is directionally incomplete." + } + }, + { + "field": "atom:L2", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "A2 quotes false => else but claims that execution of else entails false, reversing the cited implication." + }, + "s2": { + "decision": "PASS", + "evidence": "Steps 1-2 identify false is_empty on else and contrapose A1 to L != 0." + } + }, + { + "field": "atom:L6", + "label": "I", + "s1": { + "decision": "FAIL", + "evidence": "The claimed exhaustive full-scope closure depends materially on A2's unsupported converse." + }, + "s2": { + "decision": "PASS", + "evidence": "The exhaustive branch proof closes A7 for the entire exact domain, reports PROVED, and states Required subset-of Covered." + } + }, + { + "field": "hard_error:G11", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "The PROVED result necessarily relies on an invalid converse of the quoted if rule." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "hard_error:LH4", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "Attests complete premise reconciliation although A2's quoted authority does not establish the branch proposition consumed." + }, + "s2": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + } + }, + { + "field": "tcb_authority_defect", + "label": "I", + "s1": { + "decision": "PRESENT", + "evidence": "TCB-LAST-1 overstates what its A2 authority excerpt verifies." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The quoted A2 text is insufficient for the branch direction used in the proof." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "J consumes true-condition exclusion of the else arm, but AX-IF quotes only true=>consequent-executes and false=>else-executes; it omits the exact prose that true skips else. The extracted prose therefore does not supply the consumed proposition. s1 passes L10 while materially equivalent incomplete extractions fail elsewhere." + }, + "field": "atom:L10", + "label": "J", + "s1": { + "decision": "PASS", + "evidence": "Each consumed Rust/std premise has a narrow 1.82.0 URL, exact excerpt, proposition, consumer, and applicability statement." + }, + "s2": { + "decision": "FAIL", + "evidence": "AX-IF quotes true=>consequent and false=>else but omits the text that a true condition skips else, so the quotation does not supply the consumed else-reached=>false direction." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "J attests that its inventory exactly matches every semantic leaf, but O1's true-arm exclusion is not established by its quoted AX-IF fragments. This is the same reconciliation gap both scorers recognize in B/D/I; s1 passes J." + }, + "field": "atom:L11", + "label": "J", + "s1": { + "decision": "PASS", + "evidence": "Explicitly maps every AX entry to O1-O3 and states no unlisted Rust/std or tool premise supplies an inference." + }, + "s2": { + "decision": "FAIL", + "evidence": "The claimed exact reconciliation depends on the inadequately extracted AX-IF branch-selection proposition." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "TCB-R1 claims proposition-matched checked authority, yet its AX-IF extraction omits true=>skip-else while O1 consumes that exclusivity. s1 marks no authority defect although it marks the equivalent incomplete AX-IF authority in B/D/I; s2 correctly marks it present." + }, + "field": "tcb_authority_defect", + "label": "J", + "s1": { + "decision": "ABSENT", + "evidence": "The Rust 1.82 authority inventory is complete, applicable, checked, and reconciled." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The AX-IF quotation does not establish the converse branch fact the proof consumes." + } + } + ], + "mode": "L", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/CONSISTENCY.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/CONSISTENCY.json new file mode 100644 index 0000000000..592c4a88c9 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/CONSISTENCY.json @@ -0,0 +1,207 @@ +{ + "schema_version": 1, + "mode": "L", + "atom_family_attestations": [ + { + "atom_id": "L1", + "all_ten_reports_compared": true, + "evidence": "A-J all identify the executed usize get_unchecked call's in-bounds obligation, state the out-of-bounds UB consequence, and target index < bytes.len(); no unequal L1 treatment remains." + }, + { + "atom_id": "L2", + "all_ten_reports_compared": true, + "evidence": "A-J all assert that the unsafe-containing else path has is_empty() == false and contrapose the zero-length contract. A/C/H quote true-arm exclusion as well as false-arm selection; B/D/F/G/I quote only false=>else, E gestures to unquoted same-paragraph rules, and J quotes true=>consequent plus false=>else without true=>skip-else. The cross-atom consequence of those extraction gaps is recorded as ambiguity." + }, + { + "atom_id": "L3", + "all_ten_reports_compared": true, + "evidence": "A-D and H-J check both len's usize type and the unsigned/nonnegative domain. E omits both; F states the return type but derives nonnegativity from element-count-as-natural rather than a checked usize-domain entry; G checks the usize domain but misclassifies the len-to-usize link as a local source/type fact. The F split is recorded as an equivalence ambiguity rather than challenged." + }, + { + "atom_id": "L4", + "all_ten_reports_compared": true, + "evidence": "A-D and G-J check built-in subtraction plus overflow boundaries and apply n > 0 across profiles. E/F assert representability and profile independence without those Rust authorities; both raw scorers consistently fail L4 there." + }, + { + "atom_id": "L5", + "all_ten_reports_compared": true, + "evidence": "Every report A-J substitutes index = bytes.len() - 1 and explicitly derives the strict upper bound index < bytes.len(); both scorers uniformly pass L5." + }, + { + "atom_id": "L6", + "all_ten_reports_compared": true, + "evidence": "All ten reports claim implementation PROVED and connect the branch/arithmetic chain to get_unchecked. E/F lack checked numeric leaves, B's formal Required drops valid uses/executions, and B/D/G/I/J expose the branch-extraction overlap recorded below; B's contraction is challenged under G1 rather than silently collapsed into this atom." + }, + { + "atom_id": "L7", + "all_ten_reports_compared": true, + "evidence": "A-J all separately call the existing lifetime-only SAFETY comment deficient for omitting the in-bounds obligation and its material derivation, while keeping that artifact verdict distinct from implementation soundness." + }, + { + "atom_id": "L8", + "all_ten_reports_compared": true, + "evidence": "All ten supply adjacent replacement text. A-D and G-J can refer back to checked premises for the full chain; E/F assert representable subtraction despite having no checked usize/subtraction/overflow entries, and F's text also does not name get_unchecked. The s1 PASS decisions for E/F are challenged." + }, + { + "atom_id": "L9", + "all_ten_reports_compared": true, + "evidence": "A-D and H-J inventory if selection, is_empty, len/type, usize domain, subtraction, overflow, and get_unchecked while separating source facts and mathematics. E/F omit the numeric Rust leaves; G omits len's return-type premise and misclassifies inferred index typing as local." + }, + { + "atom_id": "L10", + "all_ten_reports_compared": true, + "evidence": "A/C/H provide narrow 1.82.0 entries whose extracted text supports every consumed proposition. B/D/I omit true-arm exclusion from AX-IF, E/F additionally omit numeric entries, G additionally omits len's usize return, and J's two AX-IF fragments still omit the true=>skip-else clause consumed by O1. J's s1 PASS is challenged." + }, + { + "atom_id": "L11", + "all_ten_reports_compared": true, + "evidence": "A/C/H reconcile complete checked inventories. E/F/G have omitted or misclassified numeric/type leaves; B/D/I/J claim exact reconciliation although their extracted AX-IF prose does not establish true-arm exclusion. J's s1 PASS is challenged consistently with the other incomplete AX-IF reports." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:LH1", + "all_ten_reports_compared": true, + "evidence": "A-J all report implementation PROVED, reconstruct L1-L5, and treat comment deficiency separately; none issues UNSOUND or UNPROVED solely because of the comment." + }, + { + "field": "hard_error:LH2", + "all_ten_reports_compared": true, + "evidence": "Every report explicitly calls the existing comment deficient; none calls it adequate." + }, + { + "field": "hard_error:LH3", + "all_ten_reports_compared": true, + "evidence": "A-J each state every factual link from false is_empty through nonzero length, predecessor arithmetic, and index < len to the callee obligation. Authority defects are kept in LH4/G11 rather than converted into an omitted-link LH3." + }, + { + "field": "hard_error:LH4", + "all_ten_reports_compared": true, + "evidence": "E/F affirm complete reconciliation while wholly omitting consumed usize/subtraction/overflow authorities. B/D/G/I/J state the relevant propositions but incompletely extract or classify their support; whether that lesser evidence gap alone meets LH4's exact hard-error threshold is recorded as ambiguity." + }, + { + "field": "hard_error:LH5", + "all_ten_reports_compared": true, + "evidence": "All ten disclaim build, test, execution, lint, or dynamic evidence and none uses such success as universal proof." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "B alone formally defines Required as source x Rust/std x target x profile while omitting valid calls/inputs and executions, then certifies Covered = Required; the other reports include the valid-use/theorem domain. B's absent s2 decision is challenged." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Every report gives an explicit Required subset-of Covered or Covered = Required closure statement; B's contracted Required is handled independently as G1." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "No report invents policy precedence or relabels a conservative audit domain as the project's promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "No report uses CI, endpoints, sparse documentation, a cutoff, or a stability badge as interval coverage; all arguments are symbolic in target/profile." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "No report issues UNSOUND, so the missing-four-link UNSOUND trigger is absent across A-J." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "No report issues UNPROVED after establishing an existential UB certificate; all issue PROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "No report issues CONTRACT-BROKEN or relies on a UB-containing execution for such a verdict." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "No report claims an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "The target has no third-party unsafe dependency or caller-controlled safe callback, and none of A-J silently trusts one." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "A-J offer comment replacements only after separately judging the unchanged implementation; none certifies an unimplemented design or narrows current obligations with it." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "E/F necessarily rely on wholly unchecked numeric Rust premises and both scorers record G11. B/D/G/I/J instead cite the correct authority pages and state the propositions but incompletely extract or classify them; whether those gaps alone force G11 is recorded as ambiguity." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "No report evidences inspection of an oracle, sibling, condition map, prior report, evaluator material, or another prohibited source." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "All ten replacement comments are proposed artifact repairs and none is used as if already implemented to establish soundness or narrow obligations; both raw scorers uniformly record ABSENT." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "A/C/H have complete proposition-matched authority. E/F omit numeric premises, G misclassifies len's return type, and B/D/I/J incompletely extract AX-IF's exclusivity. Both scorers mark the defect for every such report except s1 on J; that J decision is challenged." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "A-J discuss only the supplied target/request and allowlisted Rust authorities; neither raw scorer finds report-visible evidence of prohibited source-scope departure." + } + ], + "challenges": [ + { + "label": "B", + "field": "hard_error:G1", + "recommended_decision": "PRESENT", + "evidence": "B says the request 'directly defines' Required as only exact source x Rust/std x targets x profiles, omitting valid calls/inputs and executions, then uses Covered = Required for its full PROVED certificate. That is the exact contracted-Required trigger; s2 records it absent." + }, + { + "label": "E", + "field": "atom:L8", + "recommended_decision": "FAIL", + "evidence": "E's proposed comment asserts representability of len - 1, but E has no checked entry for len's usize type/domain, built-in subtraction, or overflow. It therefore cannot give the required unambiguous references to checked authority propositions for the L2-L5 chain; s1 passes it." + }, + { + "label": "F", + "field": "atom:L8", + "recommended_decision": "FAIL", + "evidence": "F's replacement asserts representable subtraction while its report has no checked usize/subtraction/overflow entries, so it cannot reference checked propositions for the full chain. The text also says only 'in bounds for this same slice' without identifying get_unchecked; s1 passes L8." + }, + { + "label": "J", + "field": "atom:L10", + "recommended_decision": "FAIL", + "evidence": "J consumes true-condition exclusion of the else arm, but AX-IF quotes only true=>consequent-executes and false=>else-executes; it omits the exact prose that true skips else. The extracted prose therefore does not supply the consumed proposition. s1 passes L10 while materially equivalent incomplete extractions fail elsewhere." + }, + { + "label": "J", + "field": "atom:L11", + "recommended_decision": "FAIL", + "evidence": "J attests that its inventory exactly matches every semantic leaf, but O1's true-arm exclusion is not established by its quoted AX-IF fragments. This is the same reconciliation gap both scorers recognize in B/D/I; s1 passes J." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "TCB-R1 claims proposition-matched checked authority, yet its AX-IF extraction omits true=>skip-else while O1 consumes that exclusivity. s1 marks no authority defect although it marks the equivalent incomplete AX-IF authority in B/D/I; s2 correctly marks it present." + } + ], + "ambiguities": [ + "The frozen materials do not make explicit whether a correct, inventoried branch-selection proposition whose exact quotation supplies only one implication direction must also fail content/closure atoms L2 and L6, rather than only L10/L11, nor whether that extraction gap by itself meets the exact LH4/G11 threshold. This affects B/D/E/F/G/I/J; no challenge here resolves that overlap by speculation.", + "L3 prescribes the usize nonnegative-domain bridge but also requires acceptance of equivalently exact derivations. F establishes len as usize yet derives positivity from its separately stated element-count/natural-count meaning without a usize-domain entry; the packet does not unambiguously say whether that substitutes for the prescribed bridge, so the split raw L3 decision is not challenged.", + "L8 requires unambiguous references to checked authority propositions but does not say whether the adjacent comment itself must contain URLs or axiom labels. Direct method/contract names were treated as sufficient when the surrounding report actually contains a complete checked inventory; E/F fail for missing checked numeric entries independently of this formatting ambiguity.", + "L10 asks for exact prose, while some premises are carried by displayed signatures rather than prose. The packet does not specify a transcription format for such signatures; this review distinguishes an expressly inspected displayed signature from G's unquoted/misclassified len-return-type assertion." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/PACKET.json new file mode 100644 index 0000000000..195b8540de --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/PACKET.json @@ -0,0 +1,30 @@ +{ + "adjudication_cells_sha256": "4dfc98a2fc915b489b9657cc6a85cd5a76525bc0e784e2d9be9b36f48be8ce42", + "allowlist_sha256": "afe540a0e03212b0d8554a6a522d2a5695a0eaadf07126c410ef831a563b9623", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "consistency_review_sha256": "b0d6538a142c385651ccbae0bd29176fedbdca3db1cb1c02817e258b11d1bde3", + "listed_labels": [ + "B", + "D", + "E", + "F", + "G", + "I", + "J" + ], + "mode": "L", + "report_sha256": { + "B": "da0d4553898b5177722b6739562ef75fa4d6baf228dd1818f8f7e39e42167356", + "D": "1eb7ccc5e3184fe8e43a576150a25f498bf6f1e514486fde15ece31fd660e3e6", + "E": "ce572d45451eaf768a3731e7a09f92a21d813c1b3fe1940260b4eb70a58b933d", + "F": "593b40969c0e46fab20eaa7be52d261dbc21dc0091a4e0c981acf53e6b8f21a9", + "G": "9710335249669b879feff80e14868026cb6161579aefe7fb97213aa0af27872f", + "I": "36f4b173f16b9fbeaeed4b9cf467e501d0c986eb4c8ebd3654467e6a5c27a434", + "J": "9ee2c47518f8d65a91c84a208bdec4050c516fe6ea1c6dcf6da45299451f9bed" + }, + "rubric_sha256": "4da5564ee971cdb7d8584c60c62b87a0c377efbe1a69b60576f22364b412b02a", + "schema_sha256": "8540160022aebd3900d88936ba3924d9160435d9d7a9d61962d1195c743d097d", + "schema_version": 1, + "source_score_packet_sha256": "a63d08c8b17e6f9a05e8ca9c65bfeea75813b9ab005eef0466f6b904f61efa24", + "target_byte_tree_sha256": "cc05da115d055febc313edcdf18bae59a6230a63583bf918ad29e89eb06a4266" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/RUBRIC.md new file mode 100644 index 0000000000..e16d3af5a3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/RUBRIC.md @@ -0,0 +1,146 @@ +# Mode L Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file, its atom labels, expected +> result, or hard-error rules to an evaluated report agent. + +## Exact result + +Within the scope in `REQUEST.md`, `last` is sound. On the `else` branch, +`bytes.is_empty()` evaluated to false. The documented relation between +`is_empty` and slice length therefore gives `bytes.len() != 0`. Slice length has +type `usize`, whose values are nonnegative, so `bytes.len() > 0`. Consequently +`bytes.len() - 1` neither underflows nor overflows and mathematical subtraction +gives `index < bytes.len()`. This is precisely the in-bounds fact required by +`get_unchecked` for a `usize` index. + +The existing comment states only a lifetime fact. It does not address the +unsafe callee's in-bounds obligation, the facts which establish it, or the +derivation between them. It is therefore a deficient proof artifact even though +the implementation obligation can be reconstructed. A replacement must expose +that chain locally and must link or unambiguously refer to the checked, +version-matched authority entries it consumes. + +## Atoms + +- **L1 — Callee obligation:** State that the executed `get_unchecked(index)` + requires `index` to be in bounds, equivalently `index < bytes.len()` for this + `usize` index, and that an out-of-bounds call is UB. + - `scope_basis`: `lib.rs` contains this unsafe call and `REQUEST.md` asks for + an implementation soundness audit. + - `dependencies`: none. +- **L2 — Branch fact:** Establish from the actual `if`/`else` control flow that + `bytes.is_empty()` is false on the unsafe-call path, then use the exact + `is_empty` contract to conclude `bytes.len() != 0`. + - `scope_basis`: necessary source-path premise for the requested local proof. + - `dependencies`: none. +- **L3 — Unsigned-domain step:** Establish that the slice length is a `usize` + and, using its nonnegative value domain, derive `bytes.len() > 0` from L2. + - `scope_basis`: necessary material bridge from nonemptiness to safe + subtraction in every supported pointer width. + - `dependencies`: L2. +- **L4 — Defined subtraction:** Establish that `bytes.len() - 1` has no integer + overflow or underflow on this path, including in every ordinary profile. + - `scope_basis`: the source performs built-in integer subtraction before the + unsafe call; its definedness is part of the requested soundness proof. + - `dependencies`: L3. +- **L5 — In-bounds derivation:** Use the assignment + `index = bytes.len() - 1` and ordinary integer arithmetic to derive + `index < bytes.len()`. + - `scope_basis`: the exact proposition needed to discharge L1. + - `dependencies`: L3, L4. +- **L6 — Implementation closure:** Connect L2–L5 to L1 and report the + implementation obligation `PROVED` over the entire stated Rust/target/profile + scope; do not infer implementation failure from comment failure. + - `scope_basis`: `REQUEST.md` explicitly asks for an implementation verdict + over its full scope. + - `dependencies`: L1, L2, L3, L4, L5. +- **L7 — Artifact verdict:** Separately report the existing `SAFETY` comment + materially deficient because its lifetime statement does not address either + the exact in-bounds obligation or the material derivation which discharges + that obligation. + - `scope_basis`: `REQUEST.md` explicitly asks for a separate comment-adequacy + determination. + - `dependencies`: L1, L2, L3, L4, L5. +- **L8 — Replacement proof artifact:** Supply proposed adjacent comment text + which identifies the `get_unchecked` obligation and exposes the L2–L5 chain, + with unambiguous references to the checked authority propositions. + - `scope_basis`: `REQUEST.md` explicitly requests replacement wording when + material reconstruction is needed. + - `dependencies`: L1, L2, L3, L4, L5. +- **L9 — Complete premise inventory:** Inventory every materially consumed + Rust/std premise: `if` branch selection, `is_empty`/length equivalence, + `len`'s type/meaning, `usize`'s value domain, built-in + subtraction/overflow, and `get_unchecked`'s safety contract. Classify the + immediate placement and assignment observations as source facts and the + remaining integer implications as mathematics rather than inventing + authority for them. + - `scope_basis`: `REQUEST.md` explicitly requires a complete Rust-premise + inventory and reconciliation; distinguishing source facts and mathematics + identifies which proof leaves require Rust/std authority. + - `dependencies`: L1, L2, L3, L4, L5. +- **L10 — Exact checked authority:** For every Rust/std entry in L9, give the + matching Rust 1.82.0 narrow URL, quote the exact prose which supplies the + premise, state the verified proposition, and qualify its applicability. Page + identity or an unexamined citation alone does not pass. + - `scope_basis`: `REQUEST.md` explicitly requires version-matched checked + authority and exact extracted propositions. + - `dependencies`: L9. +- **L11 — Reconciliation:** Explicitly reconcile proof to inventory: every + materially consumed Rust/std premise has an L10 entry, every listed entry is + actually consumed, and no TCB assumption or uncited Rust fact silently fills + a link. + - `scope_basis`: `REQUEST.md` explicitly requires this reconciliation and + states that the TCB is empty. + - `dependencies`: L1, L2, L3, L4, L5, L9, L10. + +Score atoms independently. Mathematical implications between stated integer +facts need derivation but no Rust citation. Immediate source syntax may be cited +by source location rather than external authority. + +## Hard errors + +- **LH1:** Report the implementation `UNSOUND` or `UNPROVED` solely because the + existing comment is deficient, despite reconstructing L1–L5 correctly. +- **LH2:** Explicitly call the existing comment adequate. +- **LH3:** Claim the requested implementation proof complete while omitting a + material link from L1–L5. +- **LH4:** Claim the requested authority/premise reconciliation complete while + silently consuming a Rust/std premise, using an inapplicable version, or + treating a page URL as proof without checking the proposition. +- **LH5:** Use build, test, execution, lint, or dynamic-analysis success as a + universal proof of this obligation. + +An omitted artifact verdict fails L7 but is not independently a hard error +unless the report also makes an affirmative false claim covered above. + +## Checked authority + +- Rust 1.82.0 slice `get_unchecked`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked` + — for a `usize` element index, an out-of-bounds call is UB even when the + result is unused; the proof consumes the corresponding `index < len` + requirement. +- Rust 1.82.0 slice `len`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len` + — returns the number of elements as `usize`. +- Rust 1.82.0 slice `is_empty`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty` + — returns true exactly when the slice has length zero. +- Rust 1.82.0 Reference, `if` expressions: + `https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions` + — when the condition evaluates to false, the consequent block is skipped and + the trailing `else` block is executed. +- Rust 1.82.0 Reference, arithmetic operators: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators` + — `-` is built-in subtraction for integer operands. +- Rust 1.82.0 Reference, integer overflow: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow` + — identifies overflow for built-in integer operators and its profile/context + behavior; L3 proves the exceptional case absent here. +- Rust 1.82.0 Reference, unsigned integer value domains: + `https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types` + — `usize` is an unsigned integer type and its values are nonnegative. + +There is no accepted TCB entry for this mode. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/adjudication.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/adjudication.schema.json new file mode 100644 index 0000000000..a0e421247c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/adjudication.schema.json @@ -0,0 +1,35 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-adjudication-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "decisions", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "decisions": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect|novel:s[12]:N[1-9][0-9]*)$" + }, + "decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/allowlist.txt new file mode 100644 index 0000000000..7c3ef37288 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/allowlist.txt @@ -0,0 +1,7 @@ +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty +https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow +https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/B.md new file mode 100644 index 0000000000..48a8fee2d5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/B.md @@ -0,0 +1,65 @@ +# `last` source review + +## Claim and verdict + +**Implementation soundness: PROVED.** For the exact `target/lib.rs` supplied, every well-typed safe call to `last` is free of Rust undefined behavior under Rust 1.82.0 documented abstract semantics, on every target where this source and the used Rust 1.82.0 standard-library items exist, in every ordinary profile. There is no caller safety precondition and no additional TCB assumption. + +**Existing `SAFETY` comment: deficient.** It discusses the result's lifetime, but `get_unchecked`'s material safety obligation is that the index not be out of bounds. The comment gives none of the branch-and-arithmetic derivation needed to establish that obligation. The missing derivation can be reconstructed, so this is a proof-artifact defect, not an implementation defect. + +There are no documented postconditions on `last` and no additional robustness claim in the request; consequently no separate postcondition verdict is required. + +## Snapshot, boundary, and domain closure + +Scope is exactly `target/lib.rs`, lines 1–11. The sole language-reachable API surface is safe public free function `last(bytes: &[u8]) -> Option<&u8>`. Its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors for an invariant-bearing type, traits or impls, callbacks, macros, generated code, dependencies, `cfg`s, FFI, concurrency, allocation, or other unsafe sites. The only transient invariant is `INV-N`: in the `else` branch, for the unchanged receiver `bytes`, `n = bytes.len() > 0`. + +The request directly defines + +`Required = {exact source} × {Rust/std 1.82.0} × {targets on which the source and used items exist} × {ordinary profiles}`. + +No normalization, exclusion, or finite target inventory is used. The proof below is parametric in the target-dependent `usize` value `n`; it assumes no pointer width. Profile-dependent overflow handling is immaterial because the subtraction is proved not to overflow. The source contains no configuration selection. Thus every premise applies throughout `Required`, `Covered = Required`, and `Required ⊆ Covered`. + +No build, test, execution, expansion, or tool-derived evidence was used. This is a source-level result, not a claim about a particular compiler binary or backend. + +## Obligation ledger and reconstructed proof + +`OBL-1` (line 7, all of `Required`): prove `bytes.len() - 1` does not underflow or panic and produces `index = n - 1`. **PROVED.** + +`OBL-2` (line 9, all of `Required`): prove `index` is not out of bounds for the same `bytes` passed to `get_unchecked`. **PROVED.** + +Derivation: + +1. Let `q` be the boolean returned by `bytes.is_empty()` at line 4. Execution reaches the `else` block only when `q = false` (AX-IF). +2. AX-EMPTY says `bytes.len() = 0 -> q = true`; by contraposition, `q = false -> bytes.len() != 0`. Both observations concern the same shared slice value, with no intervening mutation, call, callback, or state transition. Set `n = bytes.len()` at line 7, so `n != 0`. +3. `len` returns a `usize` and counts elements (AX-LEN). `usize` is unsigned (AX-USIZE), hence `n != 0` gives `n >= 1`. +4. Binary `-` on these primitive integer operands is subtraction (AX-SUB). Therefore line 7 computes `n - 1`. Since `n >= 1`, the result is nonnegative and no greater than the already representable `n`; it is representable as `usize`. It is not less than the type minimum, so AX-OVERFLOW's underflow case cannot occur under any ordinary overflow-check setting. Thus `index = n - 1` and `0 <= index < n`. +5. `n` is the number of elements of this same `bytes`, so `index` is in bounds. This discharges the sole documented `get_unchecked` safety requirement (AX-GET). The standard-library contract then supplies the returned shared reference. No later unsafe consumer exists. + +The empty case never evaluates the `else` block, subtraction, or unsafe call. Hence `OBL-1` and `OBL-2` cover all reachable unsafe executions, and the implementation certificate is complete. + +## Complete authoritative-premise inventory + +All entries are Rust 1.82.0 axioms, apply on every target/profile in `Required`, and were verified on the linked versioned page. Quotations are the exact minimal prose fragments consumed. + +- **AX-EMPTY** — [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “Returns `true` if … length of 0.” Verified proposition: zero length implies the returned boolean is true. Used in step 2. +- **AX-LEN** — [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “Returns the number of elements”. Together with the displayed return type `usize`, verified proposition: `bytes.len()` is the element count represented as `usize`. Used in steps 2–5. +- **AX-IF** — [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this single-condition `else` runs only for a false condition. Used in step 1 and to exclude unsafe evaluation on the empty branch. +- **AX-USIZE** — [numeric integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The `usize` type is an unsigned integer type”. Verified proposition: `usize` values are nonnegative target-width integers. Used in steps 3–4. +- **AX-SUB** — [arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): the primitive-integer `-` entry is “Subtraction”. Verified proposition: line 7 performs integer subtraction. Used in step 4. +- **AX-OVERFLOW** — [overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): binary subtraction overflows when it creates a value “less than the minimum value that can be stored”. Verified proposition: unsigned subtraction underflow is overflow; because the mathematical result is representable here, profile-controlled overflow behavior is unreachable. Used in step 4 and configuration closure. +- **AX-GET** — [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “Returns a reference to an element or subslice”; “out-of-bounds index is undefined behavior”. Verified proposition: the operation supplies an element reference without bounds checking, and its unsafe-call obligation is that the numeric index be in bounds. Used in step 5. + +No other Rust semantic or standard-library proposition is materially consumed. In particular, the existing comment's lifetime assertion is not a precondition of `get_unchecked` and plays no role in the derivation. Every inventoried entry has a consumer above, and every nonlocal premise used above appears in this inventory. The TCB contains these authoritative Rust/std axioms only; there are no dependency, implementation, external-specification, deployment, tool, or out-of-band assumptions. + +## Finding and replacement comment + +**DOC-1 — inadequate local proof (implementation remains PROVED).** The current comment does not identify `get_unchecked`'s bounds obligation, the dominating false `is_empty` branch, the non-underflowing subtraction, or the conclusion `index < bytes.len()`. Replace it with: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() > 0`. Thus subtracting 1 cannot underflow and produces +// `index < bytes.len()` for this same slice, so `index` is in bounds as +// required by `get_unchecked`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +This repair changes proof documentation only; it neither adds a caller obligation nor changes behavior. Re-audit if the source, function contract, support domain, Rust/std version, cited contracts, or overflow/index computation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/D.md new file mode 100644 index 0000000000..5828e73a5a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/D.md @@ -0,0 +1,134 @@ +# Source review: `last` + +## Claim and verdicts + +Snapshot: the complete supplied `target/lib.rs`, specifically safe public function +`last` at lines 3–10 and its sole unsafe operation at line 9. Review date/cutoff: +2026-08-01. No generated code, dependencies, build scripts, FFI, macros, traits, +mutable state, or prior audit are present in the supplied artifact. + +**Soundness — PROVED.** For Rust 1.82.0, every well-typed safe call +`last(bytes)` on every target where this source and the cited Rust 1.82.0 slice +APIs exist, in every ordinary profile, is free of Rust undefined behavior. This +is a source-level result under documented Rust abstract semantics. + +**Existing `SAFETY` comment — deficient.** It states a return-lifetime fact but +does not state or prove the only material caller obligation of the unsafe call: +that `index` is in bounds. The missing bounds derivation is material and is +reconstructed below. This documentation defect does not change the separately +proved implementation verdict. + +There is no documented caller-facing postcondition in the supplied source, so +there is no separate mandatory postcondition verdict. No additional robustness +claim was requested. TCB `TCB-LAST-R1` consists only of the Rust 1.82.0 +authoritative axioms inventoried below; there are no additional assumptions. + +## Domain, boundary, and coverage + +Let + +`Required = {Rust 1.82.0} × {every target where the exact source and used 1.82.0 std items exist} × {every ordinary profile} × {every valid &[u8] value}`. + +This is the controlling expression supplied by `REQUEST.md`; no normalization, +enumeration, or exclusion is applied. The only language-reachable in-scope API +surface is safe free function `last`. Its caller is adversarial subject only to +well-typed safe use. The only unsafe consumer is +`bytes.get_unchecked(index)`. There is no representation invariant beyond the +valid slice/reference properties enforced at the input type boundary. + +The proof below is parametric in slice length, target `usize` width, and profile. +The source has no conditional compilation. It proves the same obligation for +every member of `Required`; hence `Covered = Required` and +`Required ⊆ Covered`. In particular, the subtraction is proved non-overflowing, +so profile-dependent overflow handling is unreachable and immaterial. + +## Authoritative premise inventory (`TCB-LAST-R1`) + +All entries apply exactly to Rust 1.82.0 and to the full required target/profile +domain. Each is accepted solely as version-matched Rust standard-library or +Reference authority. These, and only these, are the non-local premises consumed +by the derivation. + +- **A1 — unchecked slice access.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “Returns a reference to an element or subslice, without doing bounds + checking.” Its Safety section says: “Calling this method with an + out-of-bounds index is undefined behavior even if the resulting reference is + not used.” Verified proposition: a `usize` call must use an in-bounds element + index; with that obligation met, the shown `&self -> &Output` API returns a + reference to that element. + +- **A2 — slice length.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “Returns the number of elements in the slice.” Its displayed return type is + `usize`. Verified proposition: `bytes.len()` is the slice's element count `n` + represented as `usize`. + +- **A3 — emptiness test.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “Returns `true` if the slice has a length of 0.” Verified proposition: + `bytes.is_empty()` reports whether the same slice's element count is zero; + therefore a false result means `n != 0`. + +- **A4 — selected `if` arm.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “If all `if` and `else if` conditions evaluate to false then any `else` block + is executed.” Verified proposition: execution of lines 7–9 implies that the + line-4 condition evaluated to false; the unsafe call is not executed on the + true/empty path. + +- **A5 — `usize` lower bound.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + the unsigned-integer table gives `usize` minimum `0` (and maximum + `2^ptr_size - 1`). Verified proposition: every `usize`, including `n`, is + nonnegative; thus `n != 0` implies `n >= 1` on every target width. + +- **A6 — subtraction and overflow boundary.** [Arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators) + identifies binary `-` as “Subtraction.” [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow) + includes: “When `+`, `*` or binary `-` create a value greater than the maximum + value, or less than the minimum value that can be stored.” Verified + proposition: for `usize n >= 1`, `n - 1` is the mathematical difference, + lies in `usize`'s range, and does not overflow in any ordinary profile. + +Reconciliation: A4 and A3 establish non-emptiness; A2 and A5 turn it into the +integer bound; A6 establishes the exact index without overflow; A1 consumes the +resulting in-bounds fact and supplies the reference. No cited premise is unused. + +## Obligation ledger and reconstructed proof + +**O1, empty path (lines 4–5): PROVED.** By A4, when the condition is true only +the consequent path is selected. It returns `None` and executes no unsafe +operation. + +**O2, arithmetic (line 7): PROVED.** Let `n = bytes.len()` (A2). Reaching the +`else` proves `is_empty() == false` (A4), hence `n != 0` (A3). Since `n: usize` +and its minimum is zero (A5), `n >= 1`. Therefore `n - 1` is representable and +non-overflowing by A6, and line 7 establishes `index = n - 1`. + +**O3, `get_unchecked` (line 9): PROVED.** From O2, +`0 <= index = n - 1 < n = bytes.len()`. Thus `index` denotes an element within +`bytes`, satisfying A1's safety obligation. A1 then supplies a reference to that +element. The call neither mutates the slice nor crosses an intervening call, +callback, unwind point, or state transition. Its displayed borrow-returning +signature, composed with `last`'s borrow-returning signature, carries the +reference rather than fabricating or extending one. Wrapping that reference in +`Some` introduces no further unsafe operation. + +The intersection of O1–O3 coverage is all of `Required`, establishing the +soundness certificate stated above. + +## Finding DOC-PROOF-1 and replacement text + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not +name `get_unchecked`'s bounds requirement and supplies none of O2/O3. Moreover, +the lifetime statement is not the caller obligation identified by A1. A local +reviewer must reconstruct the branch, zero-length, unsigned-arithmetic, and +bounds chain to validate the unsafe call. + +Minimal replacement comment: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() != 0`. Therefore `index = bytes.len() - 1` is representable and +// satisfies `index < bytes.len()`, making `index` in bounds for `bytes`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Required resolution is documentation-only; `lib.rs` was not edited. Re-audit +this result if the function, unsafe call contract, Rust version, supported +domain, or any cited authoritative text changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/E.md new file mode 100644 index 0000000000..20a88bcf47 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/E.md @@ -0,0 +1,51 @@ +# Review of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, every well-typed safe call to `last` is free of Rust undefined behavior under Rust and standard library 1.82.0, for every input `bytes: &[u8]`, every target on which this source and the used 1.82.0 slice APIs exist, and every ordinary profile. The result uses only the authoritative 1.82.0 axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** The comment's lifetime statement is not the safety precondition documented for `get_unchecked`. It omits the material derivation that `index` is in bounds. The implementation verdict and proof-artifact verdict are therefore intentionally different. + +There is no documented caller precondition or documented postcondition on `last` itself. The documented `get_unchecked` result guarantee consumed by the wrapper is proved below. + +## Domain and surface closure + +Let `Required(case)` mean: exact supplied source; Rust/stdlib 1.82.0; any target where the source and `is_empty`, `len`, and `get_unchecked` exist; any ordinary profile; and any well-typed safe call with any valid shared byte slice and permitted execution. Its configuration projection changes none of the source: there is no `cfg`, feature, generated code, dependency, FFI, allocator, concurrency, or target-specific operation. The sole language-reachable surface in scope is the public safe free function `last`; its only unsafe obligation site is `bytes.get_unchecked(index)`. + +Partition every required case by the natural number `n = bytes.len()`: `n = 0` or `n != 0`. These cases are exhaustive and the proof below is parametric in target and profile. Thus their union covers every configuration fiber and every input; the aggregate `Covered` predicate equals `Required` for the in-scope soundness obligation. + +## Reconstructed proof and obligation ledger + +**O1 — empty path.** If `bytes.is_empty()` evaluates to true, `if` semantics executes the consequent and skips the `else`. The function returns `None` and never reaches an unsafe operation. This path is covered. + +**O2 — `get_unchecked` precondition.** On the `else` path, `if` semantics establishes that `bytes.is_empty()` evaluated to false. Axiom A1 states `n = 0 -> is_empty() = true`; its contrapositive gives `is_empty() != true -> n != 0`. A2 identifies `n` as the number of slice elements, hence a natural number, so `n != 0` gives `n >= 1`. Consequently the source assignment computes the representable value `index = n - 1`, with `0 <= index < n`. It is therefore not an out-of-bounds index, discharging A4's exact unsafe-call requirement. There is no underflow, so no overflow-check or optimization profile creates another case. + +**O3 — consumed callee result.** By A4, the in-bounds call returns a reference to the selected element; with `index = n - 1`, that is the final element. The callee and wrapper signatures carry the returned shared reference from the input borrow, so no hidden caller obligation is introduced. `Some` wraps that reference. This establishes every documented callee postcondition consumed here. + +O1 and O2 cover the exhaustive partition; O3 establishes the consumed result on O2. Therefore `Required subseteq Covered`, certifying the stated `PROVED` verdict. No test, build, compiler-backend claim, or unlisted premise participates. + +## Authoritative premise inventory and reconciliation + +All quotations and links are version-matched to 1.82.0 and apply throughout the required target/profile domain where the respective item exists. + +- **A1 (`slice::is_empty`).** The documentation says it returns “true if the slice has a length of 0.” [Rust 1.82.0 `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition: for this slice, `len = 0 -> is_empty() = true`. O2 consumes its contrapositive. +- **A2 (`slice::len`).** It returns the “number of elements in the slice.” [Rust 1.82.0 `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition: `n = bytes.len()` is exactly the slice's element count. O2 consumes it. +- **A3 (`if`).** “If a condition operand evaluates to false, the consequent block is skipped”. [Rust 1.82.0 `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Together with the same paragraph's branch rules, this verifies that only the true condition reaches O1 and only the false condition reaches the `else` containing O2. +- **A4 (`slice::get_unchecked`).** The contract identifies an “out-of-bounds index” as “undefined behavior” and says the method returns a “reference to an element”. [Rust 1.82.0 `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified propositions: the call must use an in-bounds index even if the result were unused, and an admitted `usize` index returns a reference to its element. O2 consumes the former; O3 consumes the latter. + +This list is complete for the derivation. The exhaustive two-case split, contrapositive, and `n >= 1 -> 0 <= n - 1 < n` are mathematical steps. Branch reachability and assignments are inspected local source facts. No overflow behavior, integer-width bound, target property, lifetime promise beyond the checked signatures, dependency behavior, or external specification is silently consumed; accordingly, unused allowlisted pages are not cited. + +## Finding and replacement comment + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not mention A4's bounds obligation and does not connect the dominating branch to `len() - 1`. Removing the reconstructed A1/A3-to-bounds argument leaves no local proof of the unsafe precondition, so the omission is material. The statement is compatible with the typed signatures, but it is not an adequate `SAFETY` proof. + +Replace it with: + +```rust +// SAFETY: This `else` branch is reached only when `bytes.is_empty()` is +// false. Therefore `bytes.len() != 0`, so `index = bytes.len() - 1` is +// representable and satisfies `index < bytes.len()`. Thus `index` is in +// bounds, as required by `slice::get_unchecked`. +``` + +Re-audit if the source, function/callee contracts, Rust version, supported configuration predicate, or any cited 1.82.0 documentation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/F.md new file mode 100644 index 0000000000..0d4148584a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/F.md @@ -0,0 +1,59 @@ +# Audit of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact `lib.rs` supplied, Rust and standard library 1.82.0, every target on which this source and the used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)` with any valid shared slice, execution introduces no Rust undefined behavior. The proof is relative only to the Rust 1.82.0 authoritative axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** “The returned reference cannot outlive `bytes`” does not establish the only documented safety obligation of the executed `get_unchecked(index)`: that `index` is not out of bounds. A material bounds derivation had to be reconstructed. This is a proof-artifact defect, not an implementation defect. + +No caller safety precondition is permitted or needed. `last` has no documented postcondition, so there is no separate mandatory postcondition verdict. No tests, builds, execution, expansion, prior audit, dependency claim, or tool-derived evidence is used. + +## Domain and surface closure + +Let + +`Required = { (this exact source, Rust/std 1.82.0, target t, ordinary profile p, valid &[u8] value B, permitted execution e) | the source and its used std items exist on t }`. + +This is the request's controlling expression, preserved without enumeration or exclusion. Its configuration projection fixes Rust/std to 1.82.0 and otherwise quantifies over those `t` and `p`. The complete language-reachable in-scope surface is the safe public free function `last`; it accepts a caller-controlled shared slice. The sole unsafe site is `bytes.get_unchecked(index)`. There are no fields, constructors, traits or impls, callbacks, macros, generated items, dependencies, `cfg`s, FFI, concurrency, allocators, or invariant-bearing state in the supplied source. + +The two Boolean outcomes of `bytes.is_empty()` are exhaustive. The proof below is parametric in target and profile: the same source is selected, no target fact is used, and the subtraction is proved non-overflowing rather than relying on profile overflow behavior. Thus each required configuration fiber is covered. With `Covered` equal to the union of the two branch cases for the sole unsafe-backed safe surface, `Required ⊆ Covered`. + +## Reconstructed local proof and obligation ledger + +Fix an arbitrary required case and write `L = bytes.len()`. + +1. If `bytes.is_empty()` is true, the `if` consequent executes and returns `None`; the unsafe call is not reached. +2. If it is false, the `else` executes. AX-EMPTY states that length zero implies `is_empty() == true`; contraposition gives `L ≠ 0`. AX-LEN identifies `L` as the number of slice elements, hence a natural count, so `L ≥ 1`. +3. Therefore `I = L - 1` is representable, cannot underflow, and satisfies `0 ≤ I < L`. This is ordinary predecessor arithmetic applied to the locally obtained element count; it is independent of overflow-check and optimization settings. +4. Consequently `I` denotes the last of the `L` elements and is not out of bounds for this same slice. This discharges AX-UNCHECKED's exact safety condition before the call. No operation can change the slice or `L` between the check, length reads, and call. +5. `get_unchecked`'s expression type is a shared reference, and the enclosing well-typed safe function returns it inside `Option`; no caller-supplied behavior or hidden obligation intervenes. + +Obligation dispositions: branch reachability—proved by AX-IF; nonzero length—proved by AX-EMPTY and AX-LEN; subtraction representability and `I < L`—proved by the local facts plus predecessor arithmetic; `get_unchecked` in-bounds precondition—proved; safe-surface soundness—proved by the exhaustive branch union. There are no remaining obligations or uncovered cases. + +## Authoritative-premise inventory and reconciliation + +All entries apply exactly to Rust/std 1.82.0, all targets where the cited item exists, and every ordinary profile. Each is accepted as authoritative Rust documentation, consumed exactly where identified above, and must be rechecked if Rust/std or the cited text changes. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Verified proposition: `bytes.len()` returns the slice's element count as `usize`. Consumer: steps 2–3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Verified proposition: if `L = 0`, `bytes.is_empty()` evaluates to true. Consumer: step 2. +- **AX-IF.** [Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this `else` body, and hence the unsafe call, is reached only in the false-condition case; the true case executes the consequent instead. Consumers: steps 1–2 and branch exhaustiveness. +- **AX-UNCHECKED.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “with an out-of-bounds index is undefined behavior”. Verified proposition: the call requires its `usize` index not to be out of bounds for the receiver slice. Consumer: step 4. + +The remaining inputs are inspected-source facts and elementary logic/arithmetic: the dominating branch, assignments `L` and `I`, absence of intervening mutation/calls, contraposition, and the predecessor lemma for a positive element count. No other Rust semantic or standard-library proposition is consumed. In particular, the existing lifetime sentence is not used to discharge `get_unchecked`'s safety condition. + +## Required proof-artifact repair + +Replace the existing comment with: + +```rust +// SAFETY: This `else` executes only when `bytes.is_empty()` is false. +// Since `is_empty()` returns true for a zero-length slice, `bytes.len()` is +// nonzero. Thus `index = bytes.len() - 1` is representable and is strictly +// less than `bytes.len()`, so it is in bounds for this same slice. +``` + +This states the operation's controlling obligation, the dominating local fact, the derivation, and the resulting in-bounds proposition adjacent to the unsafe call. + +## Residual scope and review triggers + +Excluded because the request does not include them: undocumented behavioral robustness, compiler/backend or binary correctness, nonordinary profiles, other Rust/std versions, and targets where the source or used items do not exist. Re-audit on any change to `last`, its signature or documentation, the supported version/configuration predicate, or any consumed Rust/std contract. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/G.md new file mode 100644 index 0000000000..1ec57594c3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/G.md @@ -0,0 +1,53 @@ +# Source audit: `lib.rs::last` + +## Claim and verdict + +**Implementation soundness: PROVED.** For the supplied 11-line `lib.rs`, every well-typed safe call to `last(bytes: &[u8])` under Rust/standard library 1.82.0 is free of Rust undefined behavior. `Required` is exactly the requested product of: Rust 1.82.0; every target on which this source and the used 1.82.0 slice items exist; every ordinary profile; and every valid `&[u8]` argument. The proof is source-level under documented Rust abstract semantics. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” is an accurate type/lifetime observation, but it does not establish the actual caller obligation of `get_unchecked`: that `index` is in bounds. Closing the implementation proof requires the material reconstruction below. This is a proof-artifact defect, not an implementation defect. + +There is no caller-side safety precondition: `last` is public and safe. It has no documented behavioral postcondition, so none is silently inferred from its name. No additional robustness property is in scope. + +## Surface, snapshot, and domain closure + +The complete target contains only `#![allow(dead_code)]` and the public safe free function `last`; its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors, traits/impls, macros, generated artifacts, dependencies, callbacks, `cfg`s, target-specific operations, mutable state, or representation invariants. + +The only profile-sensitive candidate is subtraction overflow. The proof below establishes mathematically that it cannot overflow, so overflow-check configuration, optimization, and debug assertions do not change coverage. Pointer width changes `usize`'s maximum but not the parametric argument. Consequently `Covered = Required`, proving `Required ⊆ Covered` without enumerating targets or profiles. No target was built, tested, executed, or expanded. + +## Authoritative premise inventory (Rust 1.82.0) + +These are all Rust/std premises consumed; each link is version-matched. The quoted excerpt is the minimum supplying the proposition. + +1. **A1 — `get_unchecked` safety.** [Slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “out-of-bounds index is undefined behavior”. Proposition: the unsafe call requires its `usize` index to be in bounds (even non-use of the result would not cure an out-of-bounds call). Consumer: OBL-1. +2. **A2 — length.** [Slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Proposition: `bytes.len()` equals the slice's element count. Consumers: OBL-1 and the bounds normalization. +3. **A3 — empty test.** [Slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Proposition: length zero implies `is_empty() == true`; its contrapositive is consumed. Consumer: OBL-1. +4. **A4 — branch selection.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all if and else if conditions evaluate to false then any else block is executed.” Proposition: reaching lines 7–9 means `bytes.is_empty()` evaluated false. Consumer: OBL-1. +5. **A5 — binary minus.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): “- Subtraction”. Proposition: binary `-` on primitive integers denotes subtraction. Consumer: OBL-1. +6. **A6 — subtraction overflow criterion.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): “binary - create a value greater than the maximum value, or less than the minimum value that can be stored.” Proposition: binary subtraction overflows when its mathematical result lies outside the integer type's range. Consumer: OBL-1 and profile closure. +7. **A7 — `usize` domain.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The usize type is an unsigned integer type”. Proposition: `usize` values are nonnegative integers (with target-dependent width). Consumer: OBL-1 and target closure. + +Facts read directly from the checked source/type signatures—`bytes: &[u8]`, `index: usize`, the shared-reference result, and the returned lifetime being limited by the sole input borrow—are local, compiler-enforced type facts rather than extra admitted premises. The TCB is **TCB-LAST-1**: exactly A1–A7 as authoritative Rust 1.82.0 axioms; no safe/unsafe dependencies, implementation assumptions, external specifications, tools, deployment restrictions, or other assumptions. + +## Obligation ledger and reconstructed proof + +**OBL-1 (line 9): satisfy A1 for every input/configuration.** Let `n = bytes.len()` (A2). + +* If `bytes.is_empty()` is true, the first branch returns `None`; subtraction and the unsafe call are not executed (source plus A4). There is no unsafe obligation. +* Otherwise A4 gives `is_empty() == false`. If `n` were zero, A3 would make it true; hence `n != 0`. Because `n: usize` is unsigned (A7), `n >= 1`. +* By A5, line 7 computes the mathematical value `i = n - 1`. Thus `0 <= i < n`; since `n` itself is representable, `i` is also within the `usize` range. A6 therefore rules out subtraction overflow in every ordinary profile. +* A2 says the slice has exactly `n` elements. The integer positions of an `n`-element sequence are `0..n`, so `0 <= i < n` makes `i` in bounds. This discharges A1 before `get_unchecked(i)` executes. The shared result is tied by the method and function signatures to the `bytes` borrow, so returning it introduces no hidden lifetime or mutation obligation. + +Every path is covered, and no premise appears above without a consumer or is consumed without appearing in A1–A7. + +## Required replacement comment + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice is empty, so `bytes.len() != 0`. Therefore +// `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, making `index` in bounds for `get_unchecked`. +// The returned shared reference remains bounded by the `bytes` borrow. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Review must be repeated if `last`, its signature/comment, Rust/std version, used std contracts, or the requested target/profile domain changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/I.md new file mode 100644 index 0000000000..41d220b8cb --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/I.md @@ -0,0 +1,57 @@ +# Local proof-artifact review: `last` + +## Claim and results + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard library 1.82.0, every target on which this source and its used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)`, execution is free of Rust undefined behavior under the documented Rust abstract semantics. The TCB is `TCB-LAST-1` below: version-matched Rust authorities only, with no additional assumptions. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” does not establish the sole material caller obligation of `get_unchecked`: that `index` is in bounds. Reconstructing that omitted bounds proof is necessary to certify the implementation. This is a proof-artifact defect, not an implementation defect. + +`last` has no documented behavioral postcondition, so no independent `CONTRACT-BROKEN` claim arises. Its safe signature imposes no caller-side safety precondition beyond a well-typed `&[u8]`. + +## Snapshot, boundary, and domain + +The audited artifact is exactly the supplied `target/lib.rs`; no revision or digest was supplied. Audit cutoff: 2026-08-01. The complete safe boundary is the public free function `pub fn last(bytes: &[u8]) -> Option<&u8>`. Its only unsafe site is `bytes.get_unchecked(index)`. There are no fields, traits, impls, callbacks, FFI, macros, generated artifacts, dependencies, persistent invariants, `cfg`s, features, or target-specific branches in the supplied source. No build, test, execution, or tool-derived evidence was used. + +Let + +`Required = {source exactly as supplied} × {Rust/std 1.82.0} × {targets where the source and used items exist} × {ordinary profiles} × {all valid &[u8] inputs}`. + +The proof below is parametric in slice length, `usize` width, target, and profile. Hence `Covered = Required`, proving `Required ⊆ Covered`; no enumeration or exclusion is used. Debug/release overflow behavior is irrelevant because the subtraction is proved non-overflowing. + +## Obligation ledger and reconstructed proof + +Let `L = bytes.len()`. + +1. **Control flow.** The unsafe site is reachable only through the `else` block, so `bytes.is_empty()` evaluated to `false` (A2). +2. **Nonzero length.** A1 states `L = 0 ⇒ is_empty() = true`; by contraposition with step 1, `L ≠ 0`. A3 identifies `L` as the slice's element count, and A4 identifies its type as unsigned, so `L ≥ 1`. +3. **Arithmetic.** Integer `-` is subtraction (A5). Therefore `index = L - 1` is representable and satisfies `0 ≤ index < L`. It neither creates a value below the type minimum nor overflows under A6, in any ordinary profile. +4. **Unsafe call.** Thus the `usize` index is in bounds. This discharges A7's safety requirement, and `get_unchecked` supplies the shared element reference described by its contract. Wrapping it in `Some` and returning it introduces no unsafe operation. The empty branch executes no unsafe operation. + +These cases exhaust every boolean result and every valid slice, so every unsafe-site obligation is proved over `Required`. + +## Authoritative premise inventory (`TCB-LAST-1`) + +All entries apply exactly to Rust/std 1.82.0 on every target where the cited item and audited source exist. Each is accepted as a versioned Rust `AXIOM`; there are no other TCB categories or premises. + +- **A1 — `is_empty`.** The docs say “`true` if the slice has a length of 0.” [Rust 1.82 slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition consumed in step 2: `L = 0 ⇒ is_empty() = true`. +- **A2 — `if`.** “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” [Rust 1.82 Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Verified proposition consumed in step 1: this `else` execution entails the sole condition evaluated to `false`. +- **A3 — slice length.** `len` returns the “number of elements.” [Rust 1.82 slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition consumed in step 2: `L` is the slice's element count; its displayed return type is `usize`. +- **A4 — `usize`.** “The `usize` type is an unsigned integer type.” [Rust 1.82 Reference, numeric types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types). Verified proposition consumed in steps 2–3: `L` and `index` have no negative representable values; the proof is width-parametric. +- **A5 — subtraction.** The primitive-integer table defines `-` as “Subtraction.” [Rust 1.82 Reference, arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators). Verified proposition consumed in step 3: `L - 1` denotes integer subtraction when representable. +- **A6 — overflow boundary.** Binary subtraction overflows when it creates a value “less than the minimum value that can be stored” (or above the maximum). [Rust 1.82 Reference, overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow). Verified proposition consumed in step 3: because `L ≥ 1`, `L - 1 ≥ 0`, so this subtraction does not overflow; overflow-check profile choices cannot change this path. +- **A7 — unchecked indexing.** The method “Returns a reference to an element or subslice”; an “out-of-bounds index is undefined behavior.” [Rust 1.82 slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified proposition consumed in step 4: a `usize` index must be in bounds, and a contract-satisfying call returns the shared reference. + +The derivation consumes A1–A7 exactly as mapped above and no unlisted Rust semantic premise material to the unsafe obligation. + +## Finding and replacement comment + +**FINDING-COMMENT-1 (proof documentation):** the current comment establishes no implication from the dominating branch to `index < bytes.len()`. Minimum resolution is to replace it with: + +```rust +// SAFETY: This else branch is executed only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() != 0` here. +// Thus `index = bytes.len() - 1` cannot underflow and is strictly less than +// `bytes.len()`, so it is in bounds as required by `get_unchecked`. +``` + +Re-audit if the source, function or callee contract, Rust/std version, support domain, or cited authoritative prose changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/J.md new file mode 100644 index 0000000000..e5a8cb2601 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/L/reports/J.md @@ -0,0 +1,149 @@ +# Unsafe Rust Audit: `last` + +## Claim and verdict + +**Soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard +library 1.82.0, every target on which this source and the used standard-library +items exist, every ordinary profile, every valid `&[u8]`, and every permitted +source-level execution, every well-typed safe call to `last` is free of Rust +undefined behavior. There is no caller-side safety precondition. This result is +relative only to the Rust 1.82.0 authorities in TCB-R1 below; it adds no TCB +assumption. + +**Existing `SAFETY` comment: DEFICIENT.** Its lifetime statement does not +establish the `get_unchecked` call's material requirement that `index` be in +bounds. Reconstructing that missing argument is necessary to reach the +implementation verdict. This is a proof-artifact defect, not an implementation +defect. + +There is no documented postcondition on `last`, so no separate mandatory +postcondition verdict applies. In particular, the name `last` is not treated as +normative documentation. + +## Snapshot, domain, and boundary + +- Snapshot: the complete supplied `lib.rs`, lines 1--11; no generated source, + dependencies, features, `cfg`, macros, FFI, assembly, build scripts, or prior + audit are present in the supplied target. +- Surface inventory: one public safe free function, + `pub fn last(bytes: &[u8]) -> Option<&u8>`. There are no representation + fields, constructors, traits, methods, callbacks, hidden items, statics, or + invariant-bearing state. The sole unsafe site is + `bytes.get_unchecked(index)` at line 9. +- Let `Required(b,t,p,e)` mean: this exact source; Rust/std 1.82.0; `b` is any + valid `&[u8]`; `t` is any target where the source and used items exist; `p` is + any ordinary profile; and `e` is any permitted execution. This is exactly the + request's controlling expression, so the normalization is equality in both + directions. `Required_cfg(t,p) = target_exists(t) && ordinary_profile(p)`. + There is no policy conflict, exclusion, or unresolved domain. +- Actual axes are slice length, target-dependent `usize` width, and arithmetic + overflow-check configuration. The proof below is parametric in all three. + Optimization, debug assertions, and panic strategy do not alter any consumed + proposition. No build or generation pipeline selects another artifact. + +## Obligation ledger and reconstructed proof + +**O1 -- branch closure.** Partition executions by the branch actually selected +at lines 4--10. Rust's `if` semantics makes the two source paths exhaustive. If +the consequent executes, line 5 returns `None` and the unsafe operation is not +reached. If the `else` executes, `bytes.is_empty()` evaluated false. + +**O2 -- arithmetic.** Put `n = bytes.len()` on the `else` path. AX-EMPTY says +that length zero would make `is_empty()` true; by contraposition, the observed +false result gives `n != 0`. AX-USIZE makes `n` an unsigned integer, hence +`n > 0`. Integer `-` is subtraction (AX-SUB), so line 7 computes +`index = n - 1`. Mathematically `0 <= n - 1 < n`; the result is neither below +the type minimum nor above its maximum, so AX-OVERFLOW shows that this +subtraction does not overflow. Thus this result and the absence of an +arithmetic panic are identical with overflow checks enabled or disabled. + +**O3 -- unsafe call.** AX-LEN identifies `n` as the number of slice elements. +Consequently the integer index `n - 1`, with `n > 0`, is in the slice's index +range. AX-GET says an out-of-bounds call is UB and that the method returns a +reference to the selected element; O2 proves the excluded condition false. +The call therefore satisfies its safety contract and returns the in-bounds +`&u8` used to construct `Some`. There is no later mutation, callback, +interference, unwind point, or unsafe consumer. + +For every `Required` case, O1 selects a covered path; the consequent path has no +unsafe operation, while O2--O3 cover every alternative path for every target +`usize` width and profile. Hence each obligation's covered domain contains +`Required`; their pointwise intersection does too. This is the +`Required ⊆ Covered` certificate for the verdict. + +## Rust/std authority inventory (TCB-R1) + +All entries are Rust 1.82.0 AXIOMs, checked at the linked versioned sections, +accepted as the request-authorized Rust authority, and applicable to every +`Required` target where the item exists. There are no dependencies, tools, or +additional admitted propositions. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “number of elements in the slice”. Verified proposition: `bytes.len()` is the + slice's element count and has the shown return type `usize`. Consumers: O2, + O3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “`true` if the slice has a length of 0”. Verified proposition: if the element + count is zero, this call returns true. Consumer: O2. +- **AX-IF.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “condition operand evaluates to `true`, the consequent block is executed”; + “conditions evaluate to `false` then any `else` block is executed”. Verified + proposition: for this one-condition `if`/`else`, the condition selects the + consequent when true and the `else` when false. Consumer: O1. +- **AX-USIZE.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + “The `usize` type is an unsigned integer type”. Verified proposition: + `n: usize` is nonnegative and lies in that type's representable integer + range, for every supported pointer width. Consumer: O2. +- **AX-SUB.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): + the integer `-` table entry is “Subtraction”. Verified proposition: the + built-in operation on these `usize` operands is integer subtraction. + Consumer: O2. +- **AX-OVERFLOW.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): + “binary `-` create a value greater than the maximum value, or less than the + minimum value that can be stored” is overflow. Verified proposition: a + subtraction whose mathematical result remains in the `usize` range does not + overflow. Consumer: O2. +- **AX-GET.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “reference to an element”; “out-of-bounds index is undefined behavior”. + Verified proposition: the `usize` call returns a reference to the indexed + element without a bounds check, and the caller must exclude an out-of-bounds + index. Consumer: O3. + +This inventory exactly matches the semantic leaves used above. The remaining +steps are inspected source syntax, contraposition, integer inequalities, and +set inclusion; no uncited Rust/std proposition or tool result supplies a +material inference. + +## Finding PA-1 -- inadequate local proof + +- **Affected artifact:** line 8's comment; implementation status **PROVED**, + proof-artifact status **deficient**. +- **Defect:** “The returned reference cannot outlive `bytes`” neither states + nor derives `index < bytes.len()`, the precondition consumed at line 9. It is + not a substitute for O1--O3. +- **Required resolution:** replace the comment with locally reviewable bounds + reasoning. No caller contract or code change is needed. + +Proposed replacement text: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() > 0` here. +// Therefore `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, as required by `get_unchecked`. +``` + +## Evidence, residual scope, and review triggers + +No build, test, execution, macro expansion, or tool-derived evidence was used. +This is a source-level Rust abstract-semantics result, not a claim about a +particular compiler backend, binary, platform implementation, undocumented +behavior, performance, or panic freedom outside the proved subtraction. +Re-audit if the source/comment, function or std contracts, Rust version, +supported domain, or any presently absent configuration/generation/dependency +mechanism changes. + +**Final attestation:** every in-scope surface and unsafe obligation has a +status; the material reconstruction and proof-artifact defect are explicit; +the authority inventory is reconciled to the derivation; and no conclusion +rests on testing or absence of a counterexample. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/ADJUDICATION_CELLS.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/ADJUDICATION_CELLS.json new file mode 100644 index 0000000000..8fb337b53c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/ADJUDICATION_CELLS.json @@ -0,0 +1,94 @@ +{ + "cells": [ + { + "consistency_review": { + "decision": "FAIL", + "evidence": "H lines 49-56 explicitly call S0 the exact Scarlet configuration predicate, but S0 omits v in V and t in T. Lines 58-59 add those bounds only to DS through Base; silently promoting that later conjunction into the standalone S0 atom would collapse P1 into P6." + }, + "field": "atom:P1", + "label": "H", + "s1": { + "decision": "PASS", + "evidence": "H lines 49–59 give the exact Scarlet predicate within full Base(c)." + }, + "s2": { + "decision": "FAIL", + "evidence": "L49-56 labels S0 the exact Scarlet configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DS." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "H lines 61-68 explicitly call I0 the exact Indigo configuration predicate, but I0 omits v in V and t in T. Lines 70-71 repair only the induced DI full-case set through Base, not the P2 configuration-predicate proposition." + }, + "field": "atom:P2", + "label": "H", + "s1": { + "decision": "PASS", + "evidence": "H lines 61–71 give the exact Indigo predicate within full Base(c)." + }, + "s2": { + "decision": "FAIL", + "evidence": "L61-68 labels I0 the exact Indigo configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DI." + } + }, + { + "field": "hard_error:G11", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "H's positive rejection and coverage claims necessarily rely on unchecked all/not Rust semantics absent from its exact-version authority inventory." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The positive rejection and non-turbo selection proofs at L99-112 and L139-140 necessarily rely on unchecked all/not Rust authority." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "H lines 11-16 claim whole-domain soundness and behavior PROVED, while lines 139-143 use an unchecked complementary/not cfg rule for the non-turbo region admitted by Covered and lines 173-175 claim closure from it. Thus the affirmative verdicts lack a valid authority-closed Required subset-of Covered certificate." + }, + "field": "hard_error:PH4", + "label": "H", + "s1": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + }, + "s2": { + "decision": "PRESENT", + "evidence": "L11-16 and L173-175 claim whole-domain soundness/behavior although the Covered derivations rely on the unverified not cfg premise at L139-140." + } + }, + { + "consistency_review": { + "decision": "PRESENT", + "evidence": "H lines 17-19 and 99-112 claim universal turbo/wasm rejection. They provide BUILD-MAP mapping, cfg-attribute text, and compile_error text, but no applicable exact-version all-predicate implication for the material step from two true leaves to cfg(all(...)) true." + }, + "field": "hard_error:PH5", + "label": "H", + "s1": { + "decision": "ABSENT", + "evidence": "No applicable hard error recorded." + }, + "s2": { + "decision": "PRESENT", + "evidence": "L17-19 and L99-112 affirm universal turbo/wasm rejection without an applicable exact-version all implication." + } + }, + { + "field": "tcb_authority_defect", + "label": "H", + "s1": { + "decision": "PRESENT", + "evidence": "H omits material all/not Rust authority and fails to carry the accepted-TCB qualification into its behavioral conclusion." + }, + "s2": { + "decision": "PRESENT", + "evidence": "L99-112 and L139-140 omit exact-version all/not authority, and L15-16 omits conspicuous TCB qualification from behavior." + } + } + ], + "mode": "P", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/CONSISTENCY.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/CONSISTENCY.json new file mode 100644 index 0000000000..48cadc1b9e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/CONSISTENCY.json @@ -0,0 +1,283 @@ +{ + "schema_version": 1, + "mode": "P", + "atom_family_attestations": [ + { + "atom_id": "P1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J include the V/T bounds in Scarlet directly or in an explicit exact-support conjunction. H alone labels an unbounded S0 body the exact Scarlet configuration predicate; its later Base conjunction repairs DS but not S0 itself." + }, + { + "atom_id": "P2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J include the V/T bounds in Indigo directly or in an explicit exact-support conjunction. H alone labels an unbounded I0 body the exact Indigo configuration predicate; Base repairs DI but not I0 itself." + }, + { + "atom_id": "P3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report gives a materially complete Scarlet-minus-Indigo witness and checks the decisive clauses; H's full-case 1.84/X/unhardened witness is valid within Base." + }, + { + "atom_id": "P4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report gives a materially complete Indigo-minus-Scarlet witness and checks the decisive clauses; H's 1.86/A/unhardened full-case witness is valid." + }, + { + "atom_id": "P5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten leave the controlling exact project predicate UNPROVED or unresolved and expressly separate that question from the analyst-selected audit domain." + }, + { + "atom_id": "P6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each ScarletCases construction retains version, target, both features, profile, debug assertions, and every valid Option input. In H, DS=Base and S0 supplies the correct full-case set despite P1's standalone-predicate defect." + }, + { + "atom_id": "P7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each IndigoCases construction retains all seven coordinates and their complete fibers. In H, DI=Base and I0 supplies the correct full-case set despite P2's standalone-predicate defect." + }, + { + "atom_id": "P8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report separately derives ScarletCases containment, by union introduction or implication into a stated full-case superset, while preserving the other coordinates." + }, + { + "atom_id": "P9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report separately derives IndigoCases containment, by union introduction or implication into a stated full-case superset, while preserving the other coordinates." + }, + { + "atom_id": "P10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten universally substitute turbo=true and target=W into Scarlet and show that !f and every X/A turbo arm are false." + }, + { + "atom_id": "P11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten universally substitute turbo=true and target=W into Indigo and show that !f and every X/A turbo arm are false." + }, + { + "atom_id": "P12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J combine exact BUILD-MAP-POLICY mapping with supplying all/cfg/compile_error authority. H makes the same rejection claim but supplies no exact-version all-predicate quotation or predicate-section authority, so its two-true-leaves step is unchecked." + }, + { + "atom_id": "P13", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report applies exact-version unwrap_or prose to the exhaustive None/Some(input) cases on the selected non-turbo branch." + }, + { + "atom_id": "P14", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report traces the byte produced by unwrap_or into the exact syntactically constructed Some(byte) receiver and rules out None at unwrap_unchecked." + }, + { + "atom_id": "P15", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report composes unwrap_or's value, local Some construction, and unwrap_unchecked's contained-value return to establish the turbo postcondition for all inputs." + }, + { + "atom_id": "P16", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every final Required predicate is stated on a tuple retaining version, target, turbo, hardened, profile, debug assertions, and input." + }, + { + "atom_id": "P17", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every Covered_sound formulation retains the complete case, either explicitly or through a full Base/K/F predicate; no report projects away a required coordinate." + }, + { + "atom_id": "P18", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J authority-close both selected source branches. H admits the !f region to Covered_sound while its selection proof relies on uncited exact-version not-predicate semantics, so that region lacks a complete applicable derivation." + }, + { + "atom_id": "P19", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J carry every Required case into authority-closed soundness coverage. H states the set inclusion, but its !f edge inherits P18's unchecked not premise and therefore is not a valid Covered_sound closure certificate." + }, + { + "atom_id": "P20", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J give TCB-qualified whole-domain soundness from valid closure. H affirmatively claims the same result although its required P19 certificate is incomplete." + }, + { + "atom_id": "P21", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every Covered_behavior/Covered_post formulation retains all seven coordinates through explicit conjuncts or full Base/K/F membership." + }, + { + "atom_id": "P22", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J provide authority-closed postcondition proofs on every admitted branch. H's admitted !f region again depends on uncited exact-version not-predicate selection semantics." + }, + { + "atom_id": "P23", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J map Required into completely proved behavioral regions. H states containment, but its !f mapping inherits P22's unchecked selection premise and is not a valid Covered_post certificate." + }, + { + "atom_id": "P24", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J state a conspicuously TCB-relative whole-domain postcondition conclusion backed by closure. H's affirmative conclusion lacks valid P23 closure and does not explicitly carry the shared TCB qualification." + }, + { + "atom_id": "P25", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten restrict BUILD-MAP-POLICY to the named bundled releases, supplied artifact, feature/target mapping, profile region, and reachability/rejection consumers; none widens it into Rust or backend semantics." + }, + { + "atom_id": "P26", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J explicitly share or repeat BUILD-MAP-POLICY qualification across soundness, behavior, and rejection. H qualifies soundness and rejection but says behavior only holds on the same domain, not under the same trust qualification." + }, + { + "atom_id": "P27", + "all_ten_reports_compared": true, + "evidence": "Compared A-J premise by premise. A-G, I, and J quote and link exact-release Option, conditional-compilation, and compile_error authority for the Rust semantics they use. H omits supplying all and not quotations/authority while relying on both in positive proofs." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report contracts or fails to justify its full-case Required domain before claiming PROVED; H's DS/DI union remains a justified Required set notwithstanding its standalone P1/P2 defects." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report explicitly states Required subset-of each Covered predicate. H's stated inclusions are semantically incomplete, addressed by PH4 and G11, but the G2-specific absence of a containment statement does not occur." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten deny authorized policy precedence and label the selected union or superset only as a conservative audit domain, never the project's exact promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None treats CI, endpoints, sparse documentation, a cutoff, or stability language as interval coverage; releases are handled as the exact finite V set." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report issues an UNSOUND conclusion, so no deficient four-link existential UNSOUND certificate occurs." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. The only UNPROVED conclusion is policy identity; no report establishes all four UNSOUND links and then stops at UNPROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report issues CONTRACT-BROKEN, let alone from an execution containing UB." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None argues that an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None silently trusts a third-party unsafe implementation or caller-controlled safe behavior; all reason locally from the supplied source and exact standard-library contracts." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Suggested SAFETY-comment rewrites are uniformly labeled documentation-only and are not used to narrow or certify current-artifact obligations." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. H alone necessarily relies on unchecked all/not Rust semantics in affirmative rejection and branch-coverage proofs. The other nine provide version-matched supplying quotations and URLs." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report evidences inspection of an oracle, sibling, condition map, prior report, score, or evaluator material; C's visible supplied-skill identification is expressly permitted." + }, + { + "field": "hard_error:PH1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report leaves the controlling exact promise unresolved; none selects Scarlet, Indigo, an intersection, a union, or another combination as authoritative policy." + }, + { + "field": "hard_error:PH2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every selected union or larger set is explicitly called an audit domain and explicitly denied status as the exact project promise." + }, + { + "field": "hard_error:PH3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All asserted incomparability and containment relations follow from the reports' stated full-case formulas and valid witnesses; H's two witnesses remain valid under its Base-bounded DS/DI definitions." + }, + { + "field": "hard_error:PH4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J claim whole-domain soundness/behavior only after valid full-case closure. H claims both PROVED while its Covered validity and P19/P23 certificates depend on an unchecked not-predicate premise, so PH4 is present there." + }, + { + "field": "hard_error:PH5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J support rejection with exact mapping plus applicable all, cfg, and compile_error implications. H affirmatively claims universal rejection without an applicable exact-version all implication, so PH5 is present there." + }, + { + "field": "hard_error:PH6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None calls the supplied source UNSOUND or its postcondition CONTRACT-BROKEN; H expressly denies both." + }, + { + "field": "hard_error:PH7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten preserve BUILD-MAP-POLICY's exact identity, mappings, consumers, and region and distinguish it from Rust authority. H's defect is missing Rust authority/qualification, not invented or widened TCB content." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All comment proposals are clearly unimplemented documentation suggestions, and every current-artifact conclusion is presented as independently derived; proposal laundering is absent throughout." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. H has the defect because its positive proofs omit material all/not Rust authority and its behavioral conclusion omits conspicuous BUILD-MAP qualification. A-G, I, and J close authority and TCB accounting." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report stays visibly within the supplied target/source-review materials and allowed Rust authorities; no report establishes a material source-scope departure." + } + ], + "challenges": [ + { + "label": "H", + "field": "atom:P1", + "recommended_decision": "FAIL", + "evidence": "H lines 49-56 explicitly call S0 the exact Scarlet configuration predicate, but S0 omits v in V and t in T. Lines 58-59 add those bounds only to DS through Base; silently promoting that later conjunction into the standalone S0 atom would collapse P1 into P6." + }, + { + "label": "H", + "field": "atom:P2", + "recommended_decision": "FAIL", + "evidence": "H lines 61-68 explicitly call I0 the exact Indigo configuration predicate, but I0 omits v in V and t in T. Lines 70-71 repair only the induced DI full-case set through Base, not the P2 configuration-predicate proposition." + }, + { + "label": "H", + "field": "hard_error:PH4", + "recommended_decision": "PRESENT", + "evidence": "H lines 11-16 claim whole-domain soundness and behavior PROVED, while lines 139-143 use an unchecked complementary/not cfg rule for the non-turbo region admitted by Covered and lines 173-175 claim closure from it. Thus the affirmative verdicts lack a valid authority-closed Required subset-of Covered certificate." + }, + { + "label": "H", + "field": "hard_error:PH5", + "recommended_decision": "PRESENT", + "evidence": "H lines 17-19 and 99-112 claim universal turbo/wasm rejection. They provide BUILD-MAP mapping, cfg-attribute text, and compile_error text, but no applicable exact-version all-predicate implication for the material step from two true leaves to cfg(all(...)) true." + } + ], + "ambiguities": [ + "PH4 does not expressly say whether a syntactically stated full-case containment becomes invalid for PH4 when Covered validity fails solely because a material Rust authority premise is unchecked; that case also independently fits G11. The P18/P19 and P22/P23 dependency chains support treating H's affirmative whole-domain claims as PH4, but the overlap boundary is not explicit.", + "H's phrase 'on that same domain' in the behavioral verdict unambiguously imports the audit domain but is grammatically ambiguous about importing the preceding soundness bullet's BUILD-MAP-POLICY qualification. P26's separate conspicuous-qualification requirement makes implicit inheritance insufficient, but the prose-level inheritance rule is not otherwise specified." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/PACKET.json new file mode 100644 index 0000000000..1e9ceb8b5c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/PACKET.json @@ -0,0 +1,18 @@ +{ + "adjudication_cells_sha256": "15aa3813405931934d064e2fdea00f06c51399168c4deec0113e4b6a79a18c7e", + "allowlist_sha256": "ecb90a801bfbf51797749e1eddf95b85a1acba5acc92b2c061612a317150c81e", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "consistency_review_sha256": "9f4eb035e7c6d6bedd98431f3bdc0bf6453dff7eb0fc5b64339bcb52cf4a1372", + "listed_labels": [ + "H" + ], + "mode": "P", + "report_sha256": { + "H": "c81b3b6430a1854a652a3f6d3866c08a4969453f770cd387c843f253ae8b01ac" + }, + "rubric_sha256": "1e9e6622a34b3b0376b6912f676695e318edcd971ac1f4960810531ad854911d", + "schema_sha256": "8540160022aebd3900d88936ba3924d9160435d9d7a9d61962d1195c743d097d", + "schema_version": 1, + "source_score_packet_sha256": "9572ba6310f2ba36bf52c1506d8af7bc23b86fc630b795042e1aa27d04aed1c3", + "target_byte_tree_sha256": "2b194a735b69a8904b86baa43791a0ddac9f769ce32e87bf4e759822cb5cd52e" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/RUBRIC.md new file mode 100644 index 0000000000..90f2e84814 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/RUBRIC.md @@ -0,0 +1,565 @@ +# Mode P Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material. Never expose this file to a report agent.** + +## P — Incomparable Predicates and Full-Case Closure + +### Canonical notation and policy algebra + +Use the fixture's notation: + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +F = H = D = {false, true} +P = every Cargo profile admitted by the supplied policies +I = {None} union {Some(b) | b is any u8} +case = (v, t, f, h, p, d, i) +``` + +The two exact configuration predicates are: + +```text +Scarlet(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)). + +Indigo(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)). +``` + +They are incomparable. For example: + +```text +(1.84.0, X, true, false) is Scarlet-only. +(1.84.0, X, true, true) is Indigo-only. +``` + +Any correct separating witness is acceptable. In particular, an answer need +not use the two examples above. There is no authorized rule identifying one +predicate, their intersection, their union, or any other combination as the +crate's controlling exact promise. + +The policy-induced full-case sets are: + +```text +ScarletCases = {case | Scarlet(v,t,f,h) and p in P and d in D and i in I} +IndigoCases = {case | Indigo(v,t,f,h) and p in P and d in D and i in I} +``` + +The canonical minimal conservative audit domain is their union: + +```text +Audit = ScarletCases union IndigoCases +Required(case) iff case in Audit +``` + +Its configuration projection has this equivalent exact formula: + +```text +UnionCfg(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X) + or (f and t = A and (h or v >= 1.85.0))). + +Required(v,t,f,h,p,d,i) + iff UnionCfg(v,t,f,h) and p in P and d in D and i in I. +``` + +A report may instead choose a transparent full-case superset, provided it +proves `ScarletCases subset-of Audit` and `IndigoCases subset-of Audit` +separately and states a theorem whose meaning remains coherent for every added +case. The chosen set is an audit domain, not an inferred project promise. + +### Intended source proof + +Both policies exclude every configuration with `f = true` and `t = W`. +Relative only to accepted `BUILD-MAP-POLICY`, such a build selects +`cfg(all(feature = "turbo", target_arch = "wasm32"))`. The authoritative +`all`, `cfg`-attribute, and `compile_error!` contracts then establish that the +ordinary library compilation fails. This reasoning is parametric in `v`, `h`, +`p`, and `d`; there is no library input after compilation is rejected. + +For every compiled case selected by the audit domain: + +- when `f = false`, `unwrap_or(0)` returns the contained byte for `Some(byte)` + and zero for `None`; +- when `f = true`, the same `unwrap_or(0)` first produces that result `r`, the + source constructs `Some(r)`, and `unwrap_unchecked` is therefore invoked on + `Some`, never `None`; its return contract produces the same `r`. + +One exact full-case implementation region for both soundness and behavior is: + +```text +Covered(v,t,f,h,p,d,i) + iff v in V and t in T and f in F and h in H and p in P and d in D and i in I + and (!f or (f and t in {X,A})). +``` + +The source derivation is independent of `v`, `h`, `p`, `d`, and the particular +member of `I`, but those universally quantified dimensions remain in both +`Required(case)` and `Covered(case)`. Every disjunct of `UnionCfg` implies the +final source-selection clause above, so: + +```text +Required subset-of Covered_sound +Required subset-of Covered_behavior +``` + +The two covered predicates may be represented by the same set, but the unsafe +precondition proof and the postcondition proof are distinct obligations. + +### Expected conclusions + +- The identity of the controlling exact project predicate is **UNRESOLVED** + (equivalently, **UNPROVED** as a policy-identification proposition). +- Safe-API soundness on the chosen conservative full-case audit domain is + **PROVED relative to `BUILD-MAP-POLICY`**. +- The documented `value_or_zero` postcondition on that domain is **PROVED + relative to `BUILD-MAP-POLICY`**. +- Effective rejection of every `turbo`/`wasm32` build in the supplied release, + feature, profile, and debug-assertion scope is **PROVED relative to + `BUILD-MAP-POLICY`**. + +The qualification is required because the mapping from policy configuration +coordinates to Rust `cfg` options is an accepted tool premise, not a Rust +semantic axiom. + +### Scored atoms + +Each atom below scores exactly the proposition in its `proposition` field. +The other fields identify why that proposition is in scope and how to diagnose +a failure; they add no hidden report requirement. + +- **P1 — Exact Scarlet predicate** + - `proposition`: The report's `Scarlet(v,t,f,h)` set equals the predicate in + `POLICY-SCARLET.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Scarlet disjunct, including its versioned + x86 clause and hardened aarch64 clause. + - `dependencies`: none. + - `root_cause`: A wrong Scarlet formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P2 — Exact Indigo predicate** + - `proposition`: The report's `Indigo(v,t,f,h)` set equals the predicate in + `POLICY-INDIGO.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Indigo disjunct, including its versioned + x86 and unhardened aarch64 clauses. + - `dependencies`: none. + - `root_cause`: A wrong Indigo formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P3 — Scarlet-minus-Indigo witness** + - `proposition`: There exists a stated configuration in Scarlet but not + Indigo. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Scarlet and not Indigo`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Scarlet-only configuration. + +- **P4 — Indigo-minus-Scarlet witness** + - `proposition`: There exists a stated configuration in Indigo but not + Scarlet. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Indigo and not Scarlet`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Indigo-only configuration. + +- **P5 — Exact-promise status** + - `proposition`: The supplied policy evidence leaves the controlling exact + project predicate unidentified. + - `scope_basis`: “No precedence, supersession, intersection, union, or other + conflict-resolution rule has been authorized.” (`REQUEST.md`) + - `necessary_edge`: Keep policy identification separate from selection of a + conservative audit domain. + - `dependencies`: none. + - `root_cause`: Treating an analyst-selected set as policy evidence is the + originating error. + - `accepted_alternatives`: `UNRESOLVED`, or `UNPROVED` explicitly limited to + policy identification. + +- **P6 — Scarlet full-case domain** + - `proposition`: `ScarletCases` equals the Scarlet configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P1. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P7 — Indigo full-case domain** + - `proposition`: `IndigoCases` equals the Indigo configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P2. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P8 — Scarlet containment** + - `proposition`: The chosen conservative full-case audit domain contains + `ScarletCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `ScarletCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P6 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Scarlet domain remains the originating + failure; an absent inclusion argument is independently P8. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P9 — Indigo containment** + - `proposition`: The chosen conservative full-case audit domain contains + `IndigoCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `IndigoCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P7 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Indigo domain remains the originating + failure; an absent inclusion argument is independently P9. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P10 — Scarlet wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Scarlet. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Scarlet predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P1. + - `root_cause`: A wrong Scarlet formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P11 — Indigo wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Indigo. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Indigo predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P2. + - `root_cause`: A wrong Indigo formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P12 — Effective wasm rejection** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, every in-scope build with + `f = true` and `t = W` fails library compilation at the selected + `compile_error!`. + - `scope_basis`: “Account for ... source-level effective rejection of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Follow tool mapping to both true cfg options, apply + `all`, apply the `cfg` attribute, then apply `compile_error!`, universally + over release, hardened, profile, and debug-assertion coordinates. + - `dependencies`: exact TCB use and exact-version Rust authority. + - `root_cause`: The first absent edge among mapping, predicate selection, and + compile failure is the useful diagnosis. + - `accepted_alternatives`: An equivalent symbolic proof for all such builds; + enumeration is not required. + +- **P13 — Non-turbo postcondition** + - `proposition`: On every selected non-turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Apply the exact-version `unwrap_or(0)` contract to the + two `Option` variants. + - `dependencies`: exact Option authority. + - `root_cause`: Missing or inapplicable `unwrap_or` authority is the semantic + root; missing input quantification is a domain root. + - `accepted_alternatives`: Variant cases or one exact contract application. + +- **P14 — Turbo unsafe precondition** + - `proposition`: Every reachable turbo-branch `unwrap_unchecked` call has a + `Some` receiver. + - `scope_basis`: “Prove or refute the local safety obligation at the unsafe + operation.” (`REQUEST.md`) + - `necessary_edge`: Trace the value through `unwrap_or`, the local + `Some(value)` construction, and the unchanged receiver at the unsafe call. + - `dependencies`: exact Option authority and the inspected local source. + - `root_cause`: Failure to connect the constructed receiver to the call is a + local proof-edge failure, not a policy failure. + - `accepted_alternatives`: Any equivalent local proof that identifies the + exact call receiver; no control-flow argument is required. + +- **P15 — Turbo postcondition** + - `proposition`: On every selected turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Compose `unwrap_or(0)`'s result with construction of + `Some(result)` and `unwrap_unchecked`'s return contract. + - `dependencies`: P14 and exact Option authority. + - `root_cause`: A safety proof alone does not supply the return-value edge; + diagnose that edge separately. + - `accepted_alternatives`: Direct composition or explicit `None`/`Some` + cases. + +- **P16 — Full Required predicate** + - `proposition`: The report's final `Required(case)` retains version, target, + both features, profile, debug assertions, and input over its chosen audit + domain. + - `scope_basis`: “State `Required(case)` ... without projecting away the + configuration or input dimensions.” (`REQUEST.md`) + - `necessary_edge`: Bind all seven coordinates before making a universal + conclusion. + - `dependencies`: P6 through P9. + - `root_cause`: Omission here is a final theorem-domain failure even if the + omitted axis happens not to affect source behavior. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may be symbolic. + +- **P17 — Full soundness Covered coordinates** + - `proposition`: `Covered_sound(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift the branch-local proof to a full-case predicate + rather than replacing the case by a configuration projection. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the branch proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P18 — Soundness Covered validity** + - `proposition`: Every case included in `Covered_sound(case)` has a complete + applicable unsafe-obligation derivation in the report. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after the branch-local + unsafe proof applies to that case. + - `dependencies`: P14 plus the inspected fact that the non-turbo branch uses + no unsafe operation. + - `root_cause`: An overbroad Covered set is an implementation-proof error, + not a theorem-domain recovery error. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P19 — Soundness closure** + - `proposition`: `Required subset-of Covered_sound` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration disjunct to its + proved source branch while carrying profile, debug, and input universally. + - `dependencies`: P8, P9, P14, and P16 through P18. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, local proof, or containment edge as cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P20 — Whole-domain soundness conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, safe-API soundness is + PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P19 as the certificate and no wider TCB proposition. + - `dependencies`: P19 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + source-level soundness, positive status, and TCB relativity. + +- **P21 — Full behavioral Covered coordinates** + - `proposition`: `Covered_behavior(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift both branch-local return proofs to a full-case + predicate. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the return proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P22 — Behavioral Covered validity** + - `proposition`: Every case included in `Covered_behavior(case)` has a + complete applicable postcondition derivation in the report. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after a branch-local return + proof applies to that case. + - `dependencies`: P13 and P15. + - `root_cause`: Do not infer this validity proposition from soundness; the + documented return theorem needs its own proof edges. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P23 — Behavioral closure** + - `proposition`: `Required subset-of Covered_behavior` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration and input case to a + branch with the proved documented return. + - `dependencies`: P8, P9, P13, P15, P16, P21, and P22. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, postcondition proof, or containment edge as + cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P24 — Whole-domain behavioral conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, the documented + postcondition is PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P23 as the certificate and no wider TCB proposition. + - `dependencies`: P23 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + exact postcondition, positive status, and TCB relativity. + +- **P25 — Exact TCB scope** + - `proposition`: Every proposition attributed to `BUILD-MAP-POLICY` is admitted by + that entry's exact identity, mapping, consumer, and release/profile region. + - `scope_basis`: “Apply it only to its exact build-tool mappings and + consumers.” (`REQUEST.md`) + - `necessary_edge`: Match each TCB-dependent conclusion to the supplied entry + without adding a semantic or backend proposition. + - `dependencies`: none; this is an accounting proposition. + - `root_cause`: An invented mapping is the primary error even if subsequent + cfg reasoning would be valid under it. + - `accepted_alternatives`: A compact TCB ledger or precise inline + qualifications. + +- **P26 — Conspicuous TCB qualification** + - `proposition`: Every conclusion which depends on `BUILD-MAP-POLICY` identifies + that dependency as an accepted trust premise rather than Rust authority. + - `scope_basis`: “keep every conclusion which depends on it conspicuously + qualified.” (`REQUEST.md`) + - `necessary_edge`: Carry the TCB label from configuration reachability into + each dependent rejection, soundness, and behavior conclusion. + - `dependencies`: none; this is a reporting proposition. + - `root_cause`: An otherwise valid but unconditional conclusion fails here; + do not misdiagnose it as a Rust-authority mismatch. + - `accepted_alternatives`: Inline `relative to BUILD-MAP-POLICY` wording or an + unambiguous shared qualification covering the dependent conclusions. + +- **P27 — Exact authority closure** + - `proposition`: Every material Rust semantic premise used in a positive + proof is paired with an applicable exact-version URL and a quotation which + supplies that premise. + - `scope_basis`: “For each material Rust semantic premise, cite the applicable + exact-version Rust Reference or standard-library page and quote the prose + which supplies that premise.” (`REQUEST.md`) + - `necessary_edge`: Reconcile the proof leaves against the authority inventory + below; a page label alone supplies no unstated proposition. + - `dependencies`: every positive Rust-semantic derivation. + - `root_cause`: Identify the first missing, mismatched, or overclaimed + quotation; do not treat one omission as multiple distinct authority roots. + - `accepted_alternatives`: Shorter exact excerpts and different organization + are acceptable when the proposition and release applicability are clear. + +### Hard errors + +A mere omission, an explicit refusal to close a proposition, or a downstream +atom failure caused by a disclosed upstream gap is not by itself a hard error. +Record a hard error only for the corresponding false affirmative claim below: + +- **PH1:** selects Scarlet, Indigo, their intersection, their union, or another + combination as the controlling exact project promise without new policy + evidence; +- **PH2:** relabels an analyst-selected conservative audit domain as the exact + project promise; +- **PH3:** asserts containment or incomparability using a stated formula and + witness which do not establish the asserted set relation; +- **PH4:** claims whole-domain soundness or behavior after dropping a required + configuration or input coordinate, or without a valid full-case + `Required subset-of Covered` argument; +- **PH5:** treats `turbo`/`wasm32` as policy-supported, or claims effective + rejection without the exact accepted mapping and applicable `all`, `cfg`, and + `compile_error!` implications; +- **PH6:** calls the shown source `UNSOUND` or calls its documented + postcondition `CONTRACT-BROKEN` on the supplied audit domain; +- **PH7:** invents or widens `BUILD-MAP-POLICY`, treats it as Rust authority, or uses + it outside its exact identity, propositions, consumers, or region. + +Record independently applicable global hard errors as well. + +### Exact authority propositions, quotations, and URLs + +The following quotations were checked on every listed exact-version page. The +quotation is the semantic content; presence on an allowlist is not itself +evidence for a proposition. + +For Rust 1.84.0, 1.85.0, and 1.86.0, the `Option` pages describe `unwrap_or` +using the “contained `Some` value” or “provided default,” and +`unwrap_unchecked` returning the “contained `Some` value.” Its Safety heading +says calling it on `None` “is undefined behavior.” Construction of +`Some(value)` is an immediate inspected source fact, not a separately cited +semantic premise. + +Exact pages, in canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked` + +For each of the same releases, the Conditional Compilation chapter says a +configuration predicate is “true if the option is set,” `all` requires “all of +the given predicates” to be true, and `not` is true when its “predicate is +false.” The `cfg` attribute “conditionally includes” its attached item. Those +checked excerpts supply exactly the source-selection implications used here. + +The standard-library macro page states: + +- “Causes compilation to fail with the given error message when encountered.” + +Exact pages, continuing canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html` + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. No policy sentence, +Cargo minimum, evaluator oracle, test result, CI result, or inferred tool +behavior is a Rust semantic axiom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/adjudication.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/adjudication.schema.json new file mode 100644 index 0000000000..a0e421247c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/adjudication.schema.json @@ -0,0 +1,35 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-adjudication-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "decisions", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "decisions": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect|novel:s[12]:N[1-9][0-9]*)$" + }, + "decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/allowlist.txt new file mode 100644 index 0000000000..0e8296d465 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/allowlist.txt @@ -0,0 +1,15 @@ +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/reports/H.md new file mode 100644 index 0000000000..f6d59e89a4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/P/reports/H.md @@ -0,0 +1,210 @@ +# Focused unsafe-Rust source audit + +## Claim, snapshot, and verdicts + +This review covers the supplied `Cargo.toml`, `src/lib.rs`, both published +policy documents, and `TCB.md`, source-only, as inspected on 2026-08-01. The +crate is `focused-predicate-target` 0.1.0, edition 2021, with no dependencies, +build script, generator, or generated artifact. Nothing was built, expanded, +run, or tested. + +- **PROVED — source soundness:** every well-typed safe call to the selected + `value_or_zero` implementation is free of Rust undefined behavior over the + conservative audit domain `A` below, relative to accepted + `BUILD-MAP-POLICY` and the exact-version Rust axioms cited below. +- **PROVED — documented behavior:** on that same domain, normal return is the + contained byte for `Some(n)` and zero for `None`. +- **PROVED, TCB-qualified — effective rejection:** every considered + `turbo`/`wasm32` compilation is rejected, relative specifically to + `BUILD-MAP-POLICY` and the cited `cfg`/`compile_error!` contracts. +- **UNPROVED — identity of the project's exact support promise:** Scarlet and + Indigo are current, incomparable commitments, and no merge or precedence + rule is authorized. `A` is an audit domain, not a resolution of that + governance question. + +There is no `UNSOUND` or `CONTRACT-BROKEN` finding. + +## Exact policy and full-case domains + +Let + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +X = x86_64-unknown-linux-gnu +A = aarch64-unknown-linux-gnu +W = wasm32-unknown-unknown +B = {false, true} +P = the set of all Cargo profiles +O = {None} union {Some(n) | n is any u8, 0 <= n <= 255} +``` + +A full case is `c=(v,t,f,h,p,d,i)`, where `f` is `turbo`, `h` is +`hardened`, `p` is profile, `d` is `debug_assertions`, and `i` is input. Define + +```text +Base(c) := v in V and t in T and f,h,d in B and p in P and i in O. +``` + +The exact Scarlet configuration predicate is + +```text +S0(v,t,f,h) := + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h). +``` + +Its induced full-case domain is +`DS(c) := Base(c) and S0(v,t,f,h)`. + +The exact Indigo configuration predicate is + +```text +I0(v,t,f,h) := + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0). +``` + +Its induced full-case domain is +`DI(c) := Base(c) and I0(v,t,f,h)`. + +They are unequal and neither contains the other. The full case +`(1.84.0,X,true,false,dev,true,None)` is in `DS` because Scarlet's +`X and !h` clause holds, but not `DI` because both `h` and +`v >= 1.86.0` are false. Conversely, +`(1.86.0,A,true,false,dev,true,None)` is in `DI` because Indigo's +`A and !h and v >= 1.85.0` clause holds, but not `DS` because Scarlet's +`A` clause requires `h`. + +Select the conservative full-case audit domain + +```text +Required(c) := A(c) := DS(c) or DI(c). +``` + +The two required containments are immediate but separate: if `DS(c)`, then +the left disjunct establishes `A(c)`; if `DI(c)`, the right disjunct establishes +`A(c)`. Thus `DS subseteq A` and `DI subseteq A`. This exact union is chosen +only to audit every case promised by either document; it is not asserted to be +the project's support promise. + +## Policy exclusion and effective rejection + +For any `Base(c)` with `f=true` and `t=W`, neither policy holds: every `f=true` +disjunct in both `S0` and `I0` requires `t=X` or `t=A`. Hence no such case is in +`DS`, `DI`, or `Required`, for every `v,h,p,d,i`. + +Source rejection is independently stronger within `Base`. Accepted +`BUILD-MAP-POLICY` maps `f=true` to `cfg(feature="turbo")` and `t=W` to +`target_arch="wasm32"` for each exact release and every profile. The enclosing +`cfg(all(...))` therefore includes `compile_error!` for every such case, +independently of `h,d,i`. For each exact release, the Reference says: “The +`cfg` attribute conditionally includes the thing it is attached to based on a +configuration predicate.” ([1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute)). +The corresponding macro pages say: “Causes compilation to fail with the given +error message when encountered.” ([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). Thus no +library artifact containing a callable function is produced for these cases. + +## Surface and obligation inventory + +The complete crate-defined callable surface is one safe public free function, +`value_or_zero(Option) -> u8`, with mutually exclusive non-`turbo` and +`turbo` definitions. There are no public fields, constructors, user-defined +types or traits, callbacks, FFI items, reexports, hidden items, or exported +macros. `compile_error!` is the rejection site. The sole unsafe operation is +`Some(value).unwrap_unchecked()` in the `turbo` definition. There is no +persistent invariant-bearing state. + +For each `r` in `V`, the exact `Option` pages provide the same three premises: +“Returns the contained `Some` value or a provided default” for `unwrap_or`, +“Returns the contained `Some` value” for `unwrap_unchecked`, and “Calling this +method on `None` is undefined behavior.” See +[1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and +[1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +Using each release's own pages is an exhaustive three-member partition; no +cross-version compatibility premise is used. + +Let `Q(i,r)` mean `(i=None and r=0) or (there exists n: i=Some(n) and r=n)`. + +1. **Non-`turbo` branch.** For every full case with `f=false`, the build-map + premise and complementary `cfg` select this definition. If `i=None`, + `i.unwrap_or(0)` returns the provided zero; if `i=Some(n)`, it returns `n`. + The call is safe and establishes `Q` for every `i in O`; there is no unsafe + operation. +2. **`turbo` executable branch.** For every full case with `f=true` and + `t in {X,A}`, the `turbo` definition is selected and the rejection predicate + is false. The first `unwrap_or(0)` produces `x=0` from `None` and `x=n` from + `Some(n)`. The unsafe receiver is then syntactically constructed as + `Some(x)`, not `None`; therefore the exact `unwrap_unchecked` safety + obligation holds. It returns `x`, establishing `Q` in both input cases. + +These derivations are parametric in `t,h,p,d,i` where stated. `h`, profile, and +debug assertions do not occur in either function body; target affects only the +proved `W` rejection. Version is discharged by the exhaustive exact-document +partition above. + +## Covered predicates and closure certificates + +Without dropping any full-case dimension, define + +```text +Executable(c) := Base(c) and (!f or (f and t in {X,A})). +Covered_sound(c) := Executable(c). +Covered_post(c) := Executable(c). +Required_sound(c) := Required(c). +Required_post(c) := Required(c). +``` + +The branch lemmas prove soundness and `Q`, respectively, for every case in the +two `Executable` disjuncts, so these are the applicable aggregate coverage +predicates. If `Required(c)`, then `DS(c)` or `DI(c)`. Both imply `Base(c)`; if +`!f`, the first `Executable` disjunct holds, while if `f`, inspection of every +`f`-disjunct in both exact policy predicates gives `t in {X,A}`. Consequently +`Required_sound subseteq Covered_sound` and +`Required_post subseteq Covered_post`. These two pointwise containments certify +the whole-domain soundness and behavioral verdicts; coverage is not a union of +different obligations proved on different regions. + +## TCB, findings, and residual scope + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. Its human disposition +is accepted; its identity is the toolchain-bundled Cargo for exactly Rust +1.84.0, 1.85.0, and 1.86.0 acting on the supplied manifest/source. This report +uses it only for feature/target `cfg` reachability, branch selection, and +effective rejection, exactly its listed consumers. It is not used for Rust +semantics, branch correctness, compatibility, or binary/backend correctness. +The versioned Reference/std propositions above are authoritative Rust axioms, +not compatibility assumptions. There is no dependency, tool-result, external, +deployment, or probabilistic TCB entry. + +**POLICY-1 (UNPROVED governance claim).** The smallest missing premise is an +authorized rule selecting or combining Scarlet and Indigo. Resolution requires +a published precedence/supersession/merge decision; it would change domain +identity, not the proofs over `A` unless it adds cases outside `A`. + +**DOC-1 (proof-artifact deficiency; implementation proved).** The existing +SAFETY comment records the decisive local fact—construction as `Some`—but does +not state the consumed callee precondition. A proof-grade replacement is: + +```rust +// SAFETY: `unwrap_unchecked` requires the receiver not to be `None`. +// It is constructed immediately here as `Some(value)`, so that holds. +``` + +No implementation change is required for this finding. + +Excluded from the claims are configurations outside `Required`, emitted binary +correctness, compiler/backend/linker behavior, performance, and undocumented +robustness. Re-audit is required for any source, manifest, policy-resolution, +feature/target/profile support, TCB disposition or mapping, Rust-version scope, +or materially consumed authoritative-documentation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/ADJUDICATION_CELLS.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/ADJUDICATION_CELLS.json new file mode 100644 index 0000000000..9fafc7764d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/ADJUDICATION_CELLS.json @@ -0,0 +1,266 @@ +{ + "cells": [ + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. A's R3 is unestablished because its safe-call certificate omits the required Rust 1.82 unsafe-function authority; conditional proposal language and a fresh-audit demand cannot cure that failed prerequisite." + }, + "field": "atom:R7", + "label": "A", + "s1": { + "decision": "FAIL", + "evidence": "The proposal is correctly conditional with fresh-audit instructions, but R7's R3 dependency is unsatisfied." + }, + "s2": { + "decision": "PASS", + "evidence": "The design is expressly not a new verdict, does not alter current UNSOUND, and is conditioned on an exact-snapshot fresh audit." + } + }, + { + "field": "hard_error:G5", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The affirmative `UNSOUND` result lacks a checked-authority basis for one material valid-safe-use link." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND while the valid-safe-use link is incomplete: ordinary-function call safety is asserted without the required version-matched Rust authority." + } + }, + { + "field": "hard_error:G11", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "The report necessarily relies on uncited Rust semantics to conclude the ordinary function call carries no safety obligation." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Its certificate necessarily relies on an unchecked safe-versus-unsafe-function premise omitted from the cited Rust 1.82 authority set." + } + }, + { + "field": "tcb_authority_defect", + "label": "A", + "s1": { + "decision": "PRESENT", + "evidence": "`TCB-R182` omits checked Rust 1.82 safe-versus-unsafe-function authority consumed by witness validity." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-R182 claims the semantic premises are the cited authorities, but no Rust 1.82 unsafe-function authority supports the material assertion that increment's call carries no unsafe obligation." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. D's R3 is unestablished because its valid-safe-call premise lacks checked Rust 1.82 unsafe-function authority, so its otherwise conditional and unaudited sketch cannot make R7 pass." + }, + "field": "atom:R7", + "label": "D", + "s1": { + "decision": "FAIL", + "evidence": "The sketch is correctly conditional and requires fresh audit, but R7's R3 dependency is not established." + }, + "s2": { + "decision": "PASS", + "evidence": "It tells the reader not to regard the sketch as audited or PROVED and requires a new exact-snapshot audit after implementation." + } + }, + { + "field": "hard_error:G5", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The `UNSOUND` conclusion lacks an authority-complete valid-safe-use link for the ordinary function call." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND with an incompletely verified valid-safe-use link because safe ordinary-function calling semantics are not sourced." + } + }, + { + "field": "hard_error:G11", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The proof necessarily relies on unchecked Rust safe-function caller semantics while claiming only cited version-matched axioms." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The certificate necessarily relies on unchecked safe-versus-unsafe-function authority absent from TCB-0." + } + }, + { + "field": "tcb_authority_defect", + "label": "D", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB omits checked Rust 1.82 authority for the ordinary-versus-unsafe-function premise consumed by witness validity." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-0 cites visibility, implementation, unsafe-trait, slice, and wrapping propositions but omits authority for the material safe-function call premise." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. F's R3 fails through its authority-incomplete safe-use certificate; saying the redesign is not a verdict and needs fresh audit satisfies direct clauses but not the dependency." + }, + "field": "atom:R7", + "label": "F", + "s1": { + "decision": "FAIL", + "evidence": "It conditions the redesign on implementation and fresh audit, but the R3 dependency remains unmet." + }, + "s2": { + "decision": "PASS", + "evidence": "It says the proposal is not a new verdict and requires a fresh audit of the implemented snapshot and migrated callers." + } + }, + { + "field": "hard_error:G5", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The report issues `UNSOUND` without an authority-complete proof that both the impl and ordinary function call are valid safe use." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND although one required existential link, valid safe calling of increment, is asserted without the required version-matched authority." + } + }, + { + "field": "hard_error:G11", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "Its proof necessarily relies on unchecked Rust trait/function safety-boundary semantics omitted from `TCB-R033`." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics absent from TCB-R033." + } + }, + { + "field": "tcb_authority_defect", + "label": "F", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB lists visibility/coherence and library contracts but omits checked unsafe-trait and unsafe-function rules consumed by witness validity." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-R033 includes visibility, trait implementation, slice, and wrapping authorities but omits authority for its material assertion that increment is safely callable." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. G's R3 is unestablished because AX-ACCESS does not verify ordinary-function caller safety, so the explicit post-implementation audit does not satisfy the failed prerequisite." + }, + "field": "atom:R7", + "label": "G", + "s1": { + "decision": "FAIL", + "evidence": "It conditionally requires fresh audit, but the listed R3 prerequisite is not established." + }, + "s2": { + "decision": "PASS", + "evidence": "The redesign is explicitly not a verdict, leaves current UNSOUND unchanged, and requires a fresh audit after implementation." + } + }, + { + "field": "hard_error:G5", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "Its `UNSOUND` certificate does not authoritatively establish that the ordinary generic call is a valid safe use." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND without a fully verified valid-safe-use link because safe ordinary-function calling semantics are unsupported by its authority set." + } + }, + { + "field": "hard_error:G11", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB necessarily consumes an unchecked safe-versus-unsafe-function proposition absent from its authority inventory." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The report necessarily relies on the unchecked proposition that the non-unsafe increment declaration is callable without an unsafe obligation." + } + }, + { + "field": "tcb_authority_defect", + "label": "G", + "s1": { + "decision": "PRESENT", + "evidence": "`AX-ACCESS` is used to infer no caller-side unsafe obligation, but its cited visibility/implementation pages do not verify the required function rule." + }, + "s2": { + "decision": "PRESENT", + "evidence": "TCB-1 lists visibility, implementation, slice, and wrapping authorities but omits the material Rust 1.82 safe-versus-unsafe-function authority used by FIND-1." + } + }, + { + "consistency_review": { + "decision": "FAIL", + "evidence": "R7 expressly depends on R3. J's R3 is unestablished because its TCB omits safe-versus-unsafe-function authority for the witness call; its correct conditional framing cannot override that dependency." + }, + "field": "atom:R7", + "label": "J", + "s1": { + "decision": "FAIL", + "evidence": "It leaves the sketch unimplemented and requires fresh audit, but R7's prerequisite R3 is not established." + }, + "s2": { + "decision": "PASS", + "evidence": "It labels the sketch unimplemented with no audit verdict, preserves current UNSOUND, and requires a fresh snapshot audit." + } + }, + { + "field": "hard_error:G5", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The `UNSOUND` result lacks checked support for the valid-safe-call link in its existential certificate." + }, + "s2": { + "decision": "PRESENT", + "evidence": "It issues UNSOUND without fully verifying the valid-safe-use link; the ordinary-function call premise has no applicable cited authority." + } + }, + { + "field": "hard_error:G11", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "The TCB necessarily relies on an unchecked ordinary-function caller-safety proposition." + }, + "s2": { + "decision": "PRESENT", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics omitted from TCB-R016-r1." + } + }, + { + "field": "tcb_authority_defect", + "label": "J", + "s1": { + "decision": "PRESENT", + "evidence": "`TCB-R016-r1` omits the Rust 1.82 safe-function authority needed to establish that calling `increment` accepts no safety obligation." + }, + "s2": { + "decision": "PRESENT", + "evidence": "Its TCB names visibility, implementation, unsafe-trait, slice, and wrapping axioms but omits the safe-versus-unsafe-function rule material to calling increment safely." + } + } + ], + "mode": "R", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/CONSISTENCY.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/CONSISTENCY.json new file mode 100644 index 0000000000..26e4317240 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/CONSISTENCY.json @@ -0,0 +1,176 @@ +{ + "schema_version": 1, + "mode": "R", + "atom_family_attestations": [ + { + "atom_id": "R1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. B, C, E, H, and I construct the return-2 downstream implementation and safe call with all four version-matched Rust authority links; A, D, F, G, and J use the same witness but omit material unsafe-function authority, so the common PASS/FAIL split is justified." + }, + { + "atom_id": "R2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report traces index 2 to get_unchecked_mut on length 2 and cites its UB consequence; B, C, E, H, and I also establish R1, while A, D, F, G, and J do not, yielding the same dependency-based split." + }, + { + "atom_id": "R3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All literally say the current API is UNSOUND and proposal-independent, but only B, C, E, H, and I close dependent R2; A, D, F, G, and J therefore consistently fail R3." + }, + { + "atom_id": "R4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report extracts the owned wrapping increment of element 1 and expressly says downstream Slot implementations or generic calls need not be preserved; all PASS treatments are equivalent." + }, + { + "atom_id": "R5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each proposes a nongeneric safe checked-index specialization with fixed element 1 and no caller-selected implementation or index; free-function and Tail inherent-method spellings are materially equivalent." + }, + { + "atom_id": "R6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report identifies removal of the trait/generic surface, gives the call-site migration, and ties the intentional downstream break to the expressly authorized unreleased contract delta." + }, + { + "atom_id": "R7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All keep the sketch conditional and demand implementation plus fresh audit, but R7 expressly depends on R3: B, C, E, H, and I establish R3, whereas A, D, F, G, and J do not. The latter five must therefore be FAIL despite satisfying R7's direct redesign-language clauses." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none claims full safe-API PROVED after contracting or failing to justify Required. Each PROVED statement is confined to the requested Tail behavior." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every positive Tail result supplies an all-input, target/profile-parametric coverage derivation or explicit Required-subset-of-Covered statement, so G2 is absent throughout." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none invents policy precedence or converts a conservative audit domain into a project promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; some name an audit cutoff, but no report uses a cutoff, CI, endpoints, documentation sparsity, or badges as interval coverage. Coverage is source-parametric." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. G5 is present for A, D, F, G, and J because their affirmative UNSOUND certificates omit checked authority for the valid ordinary safe-function call; it is absent for B, C, E, H, and I, which cite that Rust 1.82 rule." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; no report issues only UNPROVED after establishing all four existential links. All issue UNSOUND." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none derives CONTRACT-BROKEN from the UB witness, and several expressly reject that use." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report places UB at the out-of-bounds call itself and none claims an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none silently trusts third-party unsafe implementation or caller-controlled safe behavior; all treat downstream Slot control as the defect." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every redesign is explicitly unimplemented and excluded from the current verdict, with fresh audit required." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. G11 is present for A, D, F, G, and J because their UNSOUND proof necessarily consumes uncited safe-versus-unsafe-function semantics; it is absent for B, C, E, H, and I, which supply applicable Rust 1.82 authority." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; no report evidences inspection of an oracle, sibling, condition map, prior report, score, or evaluator material. H's naming of the supplied skill package is expressly permitted." + }, + { + "field": "hard_error:RH1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report quantifies beyond Tail and constructs an arbitrary downstream implementation returning 2, so none trusts Tail as the only safe implementation." + }, + { + "field": "hard_error:RH2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none treats safe-trait prose as a caller obligation, and all say documentation alone would not repair the generic safe boundary." + }, + { + "field": "hard_error:RH3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; all reports call the current API UNSOUND rather than sound or merely UNPROVED." + }, + { + "field": "hard_error:RH4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; all proposals are expressly conditional, denied a current artifact verdict, and subjected to implementation plus fresh audit." + }, + { + "field": "hard_error:RH5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report fixes the current UNSOUND conclusion before redesign and states that design intent or authorization does not narrow it." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; absent throughout because no report uses its unimplemented specialization to certify current soundness, narrow current obligations, or claim a post-change verdict without fresh audit." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Present for A, D, F, G, and J due to the omitted Rust 1.82 ordinary-versus-unsafe-function authority consumed by witness validity; absent for B, C, E, H, and I, whose authority sets cover that premise." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; absent throughout. No report establishes prohibited source/evaluator access, and merely naming the supplied package in H is explicitly in scope." + } + ], + "challenges": [ + { + "label": "A", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. A's R3 is unestablished because its safe-call certificate omits the required Rust 1.82 unsafe-function authority; conditional proposal language and a fresh-audit demand cannot cure that failed prerequisite." + }, + { + "label": "D", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. D's R3 is unestablished because its valid-safe-call premise lacks checked Rust 1.82 unsafe-function authority, so its otherwise conditional and unaudited sketch cannot make R7 pass." + }, + { + "label": "F", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. F's R3 fails through its authority-incomplete safe-use certificate; saying the redesign is not a verdict and needs fresh audit satisfies direct clauses but not the dependency." + }, + { + "label": "G", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. G's R3 is unestablished because AX-ACCESS does not verify ordinary-function caller safety, so the explicit post-implementation audit does not satisfy the failed prerequisite." + }, + { + "label": "J", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. J's R3 is unestablished because its TCB omits safe-versus-unsafe-function authority for the witness call; its correct conditional framing cannot override that dependency." + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/PACKET.json new file mode 100644 index 0000000000..6c4cf29feb --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/PACKET.json @@ -0,0 +1,26 @@ +{ + "adjudication_cells_sha256": "ec0b95e018171e6c9884bce99c6bfaad3272db6732129a54b8bb813e4b2fcf85", + "allowlist_sha256": "d99084daff4c4505711f97a93884043a9bbf0d06df4f1d3d8342c98486be4713", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "consistency_review_sha256": "1418b5c85bfbde5a2ba6ae156bd8728fb23b95e2203704e6bb98ff53dc928ec2", + "listed_labels": [ + "A", + "D", + "F", + "G", + "J" + ], + "mode": "R", + "report_sha256": { + "A": "7632affdeeafcfccad88b8fdf653218f196aac4cc1362ddf0525f98656a9c7b3", + "D": "504ff4872d456561c79c0295a3314112c456ed899917d9990ea9765f4e98c8cd", + "F": "d14718131a1eb74ccf317bd2f288d4a85da663414929c3e59ad4b8a5be37babf", + "G": "ee9aa27852c22aafafd26a8a54bd0e997998f61f25186209cb1518e5bcfcea3d", + "J": "74fe59f2a0341cf8fe291f8812d131a22949f51b001324e41aacdefb7cbe67f1" + }, + "rubric_sha256": "af075a1aac36a19d97ec57d1fe8509d12a4b323e43739bd57c1576b071b83faf", + "schema_sha256": "8540160022aebd3900d88936ba3924d9160435d9d7a9d61962d1195c743d097d", + "schema_version": 1, + "source_score_packet_sha256": "f2fd13517d31ee58205668eca898464350b393225742baab9b2dfcdcc5da8ba4", + "target_byte_tree_sha256": "d69df1b286abd8f7f8955ac56d702c1910eb596c0bd105b7998e39d7246ca063" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/RUBRIC.md new file mode 100644 index 0000000000..a2d6562f7e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/RUBRIC.md @@ -0,0 +1,100 @@ +# Mode R Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file to a report agent. + +## Exact result + +Within the scope in `REQUEST.md`, valid safe use includes every downstream safe +implementation of `Slot`, not only `Tail`. An implementation returning 2 and a +safe call `increment::(&mut [0, 0])` reaches +`get_unchecked_mut(2)` on a length-2 slice. Its in-bounds precondition is false, +and Rust 1.82.0 documents an out-of-bounds call as UB. The current safe API is +therefore `UNSOUND`. + +The required behavior needs neither generic index metadata nor an unsafe +abstraction. The preferred design is a nongeneric safe function that updates +`pair[1]` with wrapping addition (or an exactly behavior-equivalent checked +specialization). It eliminates caller implementation/index capability and the +unsafe block. Making `Slot` unsafe, adding safe-trait prose, or preserving the +generic abstraction by default is less parsimonious because downstream generic +use is expressly not required. The proposal does not alter the current verdict +and requires implementation plus fresh audit. + +## Atoms + +- **R1:** Quantify over arbitrary safe `Slot` implementations and explicitly + construct or describe one returning 2 together with its valid safe call. + - `scope_basis`: public safe trait implementation and safe generic calls are + valid-use surfaces of the exact current source. + - `dependencies`: exact Rust 1.82.0 public-visibility, trait-implementation, + ordinary-versus-unsafe-trait, and safe-versus-unsafe-function rules. +- **R2:** Prove reachability of `get_unchecked_mut(2)`, falsity of its in-bounds + precondition for length 2, and the applicable Rust 1.82.0 UB consequence. + - `scope_basis`: necessary certificate for the current-artifact soundness + claim requested in `REQUEST.md`. + - `dependencies`: R1. +- **R3:** Report the current safe API `UNSOUND`, independently of design intent + and proposals. + - `scope_basis`: `REQUEST.md` expressly requires the literal current-artifact + verdict before redesign. + - `dependencies`: R2. +- **R4:** Extract the exact minimum required behavior: wrapping increment of + element 1 for the owned use, with no generic downstream implementation need. + - `scope_basis`: this requirement is stated verbatim in `REQUEST.md`. + - `dependencies`: none. +- **R5:** Propose a nongeneric safe specialization implementing R4 with checked + indexing or an exactly equivalent safe operation, and no caller-controlled + implementation or index capability. + - `scope_basis`: `REQUEST.md` asks for the most parsimonious provable + abstraction satisfying R4. + - `dependencies`: R4. +- **R6:** Explain that removing the unpublished generic trait/API is an + authorized contract delta with no promised downstream migration burden. + - `scope_basis`: `REQUEST.md` expressly permits this contract and + representation change. + - `dependencies`: R4, R5. +- **R7:** Keep the redesign conditional and require implementation plus fresh + audit; do not use it to narrow or alter R3. + - `scope_basis`: `REQUEST.md` requires the current verdict and post-change + audit independently. + - `dependencies`: R3, R5. + +Merely making the trait unsafe does not pass R5 because it preserves an +unneeded caller implementation capability. + +## Hard errors + +- **RH1:** Trust `Tail` as the only safe implementation. +- **RH2:** Treat safe-trait prose as a caller obligation. +- **RH3:** Call the current API sound or merely `UNPROVED` after closing R2. +- **RH4:** Certify an unimplemented redesign. +- **RH5:** Let design intent narrow the current contract. + +## Checked authority + +- Rust 1.82.0 Reference, public visibility: + `https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy` + — public items are accessible from outside their module, subject to the + containing path; every item here is at the public crate root. +- Rust 1.82.0 Reference, trait implementations and coherence: + `https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations` + — a trait implementation may be defined when the implementing type is local, + so a downstream crate may define local `Bad` and implement `Slot` for it. +- Rust 1.82.0 Reference, unsafe traits: + `https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits` + — unsafe traits are explicitly declared with `unsafe`; the supplied `Slot` + declaration is an ordinary safe trait and its implementation requires no + unsafe act. +- Rust 1.82.0 Reference, unsafe functions: + `https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn` + — the caller-side unsafe obligation attaches to an `unsafe fn`; the supplied + public `increment` is an ordinary safe function. +- Rust 1.82.0 slice `get_unchecked_mut`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut` + — the index must be in bounds; an out-of-bounds call is UB even if its result + is unused. +- Rust 1.82.0 `u32::wrapping_add`: + `https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add` + — modular wrapping addition supplies the requested update semantics. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/adjudication.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/adjudication.schema.json new file mode 100644 index 0000000000..a0e421247c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/adjudication.schema.json @@ -0,0 +1,35 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-adjudication-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "decisions", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "decisions": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect|novel:s[12]:N[1-9][0-9]*)$" + }, + "decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/allowlist.txt new file mode 100644 index 0000000000..6852f5fd70 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/allowlist.txt @@ -0,0 +1,6 @@ +https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy +https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations +https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits +https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut +https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/A.md new file mode 100644 index 0000000000..defb37885d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/A.md @@ -0,0 +1,62 @@ +# Focused literal audit and redesign + +## Claim, domain, and verdicts + +**Snapshot and scope.** This reviews exactly the supplied `target/lib.rs`: `Slot`, `Tail`, its `Slot` implementation, `increment`, and the one `get_unchecked_mut` call. `Required(c)` is exactly: `c` uses Rust and standard library 1.82.0, is any target on which this exact source and its used 1.82.0 standard-library items exist, and uses any ordinary profile. There are no dependencies, `cfg`s, features, generated artifacts, macros, FFI, concurrency, allocators, or other source-level configuration branches. + +**Soundness theorem.** Every well-typed safe call to the public safe API must be free of Rust undefined behavior, without an undocumented caller or implementer safety condition. + +**Verdict: UNSOUND.** The current public generic `increment` has a valid entirely-safe downstream use that necessarily calls `get_unchecked_mut` out of bounds. This verdict is independent of the redesign below. + +**Required `Tail` behavior: PROVED.** For every `c` in `Required` and every initial `pair`, `increment::` returns with element 0 unchanged and element 1 equal to its old value plus one modulo `2^32`. This user-required behavior is not documentation found in `lib.rs`; it is an explicit review requirement. + +**Trust boundary `TCB-R182`.** No additional TCB assumptions are admitted. The only semantic premises are the exact Rust 1.82.0 Reference and standard-library contracts cited below. No compiler-binary, platform-implementation, test, or tool result is trusted. + +## Boundary and obligation coverage + +The complete relevant surface is: public safe trait `Slot`; its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `impl Slot for Tail`; public safe generic function `increment`; and its private unsafe operation. There are no unsafe declarations, fields, constructors with state, callbacks other than caller-selected `Slot` implementations, hidden items, or generated surfaces. There is no owned invariant: `S::index() < 2` is merely the missing proposition consumed by the unsafe call. + +The [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) say a `pub` item is accessible externally and associated items in a public trait are public by default. Under the [orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), a downstream crate may implement a foreign trait for its own local type. `Slot` does not use `unsafe trait`; the [unsafe-trait rule](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits) reserves the implementer-side unsafe obligation for traits whose declaration begins with `unsafe`. + +### UNSOUND certificate + +A downstream crate can write only safe Rust: + +```rust +use audited_crate::{increment, Slot}; + +struct OutOfBounds; +impl Slot for OutOfBounds { + fn index() -> usize { 2 } +} + +let mut pair = [0u32; 2]; +increment::(&mut pair); +``` + +1. **Valid use:** Both imported items are public; `OutOfBounds` is local, so its safe `Slot` implementation is coherent. Neither the implementation nor `increment` requires an `unsafe` context or documents a safety obligation. +2. **Reachability:** `increment` unconditionally evaluates `S::index()` and passes the result, `2`, to `pair.get_unchecked_mut`. +3. **False required proposition:** `pair` has exactly two elements, so valid element indices are `0` and `1`; `2` is out of bounds. +4. **UB consequence:** Rust 1.82 documents for [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut): “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” UB therefore occurs at the call itself. + +This certificate applies parametrically on every `c` in `Required`: the source has no target/profile selection and the cited 1.82 contract is the same premise for the whole requested target/profile predicate. The UB-containing witness does not establish a separate `CONTRACT-BROKEN` result. + +For `Tail`, `index()` is locally fixed at `1`; `1 < 2`, so the unchecked call returns a mutable reference to element 1. The assignment touches only that element, and Rust 1.82 [`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) specifies modular addition. Thus `Covered_Tail = Required` and `Required ⊆ Covered_Tail`. The same derivation is profile- and target-parametric. + +The unsafe block has no adjacent `SAFETY` proof. A valid local proof can be reconstructed only for `S = Tail`; it cannot prove the universal generic call. Adding a comment or prose requirement to this safe trait would not repair the implementation defect. + +## Preferred design + +Replace the generic abstraction with the exact required capability, using only safe operations: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its safe contract is: for every input, return with element 0 unchanged and element 1 equal to its prior value plus one modulo `2^32`; there are no caller safety preconditions. The array type establishes length two, literal index `1` supplies the bounds fact at the use site, and safe indexing enforces it. There is no representation invariant, unsafe surface, implementer capability, or additional TCB premise. + +This is preferable to sealing or making `Slot` unsafe because no required polymorphism remains. Remove `Slot`, its implementations, and `Tail` if it has no independent nominal purpose; change `increment` to the non-generic signature above. Migrate `increment::(&mut pair)` to `increment(&mut pair)` and delete trait bounds/implementations. Downstream `Slot` implementations and generic calls intentionally cease to be supported, as authorized for this unreleased abstraction. + +This is a design proposal, not a verdict for a new artifact. After implementation, audit the exact new snapshot: enumerate its exported surface and all callers/documentation; confirm the intended removals; prove both-element postconditions for all inputs; confirm no conditional/generated variants; and re-establish `Required ⊆ Covered` for the same Rust/target/profile predicate. Re-audit on any source, contract, Rust version, target/profile-support, or generation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/D.md new file mode 100644 index 0000000000..34ec4b57e7 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/D.md @@ -0,0 +1,76 @@ +# Focused literal audit and redesign + +## Claim, domain, and results + +**Current-artifact soundness: `UNSOUND`.** For the complete supplied `lib.rs`, a well-typed entirely safe downstream use reaches undefined behavior. This verdict is independent of the redesign below. + +**Requested `Tail` behavior: `PROVED`.** For every initial `pair = [a, b]`, `increment::(&mut pair)` returns normally with `[a, b.wrapping_add(1)]`. This is a user-requested robustness result, not a documented current-API postcondition. + +There are no documented postconditions or unsafe public APIs, so no `CONTRACT-BROKEN` claim applies. + +Let `T` be exactly the targets on which this source and its used Rust 1.82.0 standard-library items exist, and `P` every ordinary profile. A required case is + +`Required(source, rust, target, profile, S, pair, execution) := source = supplied lib.rs ∧ rust = 1.82.0 ∧ target ∈ T ∧ profile ∈ P ∧ the call is a well-typed safe use`. + +Thus `Required_cfg = {1.82.0} × T × P`. This is the request's predicate verbatim, not a finite target inventory. The source has no `cfg`, features, dependencies, generators, FFI, assembly, concurrency, allocation, or profile-sensitive operation. The proofs and counterexample below are parametric in `target ∈ T` and `profile ∈ P`; optimization, overflow-check, panic-strategy, and debug-assertion differences do not alter them. Audit cutoff: 2026-08-01. + +## Boundary and obligation inventory + +The complete language-reachable crate-owned surfaces are: public safe trait `Slot` and its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `Slot for Tail` implementation; and public safe generic function `increment`. The sole unsafe operation is `pair.get_unchecked_mut(S::index())`. `wrapping_add` and assignment are safe. There are no fields, constructors beyond the unit-struct expression, macros, hidden items, callbacks, or explicit unsafe declarations. No enforced invariant constrains implementations of `Slot` or their returned index. + +| ID | Obligation | Disposition | +|---|---|---| +| O1 | Every safe call to `increment` must pass an in-bounds index to `get_unchecked_mut`. | **Refuted; F1.** | +| O2 | For `Tail`, the selected index is in bounds for `[u32; 2]`. | `Tail::index()` is source-constant `1`; valid indices are `0,1`. **Proved** for all required configurations. | +| O3 | The requested normal result for `Tail` is `[a, b+1 mod 2^32]`. | O2 makes the returned reference designate element 1; assignment changes that element only; `wrapping_add(1)` supplies the modular value. **Proved**. | +| O4 | Every required configuration reaches the reviewed source and the same material semantics. | Exact source only, with no selectors or generated stages; O1–O3 are target/profile-parametric. **Proved**. | + +## F1 — safe trait implementation causes out-of-bounds unchecked access + +Severity/classification: **UNSOUND implementation defect; missing local proof artifact.** The unsafe block has no adjacent `SAFETY` proof, but documentation alone cannot repair the false premise. + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +Certificate: + +1. **Valid in-scope use.** `Slot` and `increment` are public at crate root. `Slot` is a safe trait and states no behavioral contract. The Rust 1.82 orphan rule permits this implementation because `Bad` is local to the downstream crate; its relevant clause is “At least one of the types `T0..=Tn` must be a local type.” There are no uncovered type parameters. The call is to a safe function and uses no unsafe operation at the call site. ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy), [trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), [unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)) +2. **Reachability.** `Bad::index()` returns `2`; `increment` unconditionally calls `get_unchecked_mut(2)` on the borrowed `[u32; 2]`. +3. **False safety proposition.** Index `2` is outside the two-element array's index set `{0,1}`. +4. **UB consequence.** Rust 1.82 documents: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)) + +This witness works for every `target ∈ T` and ordinary profile. One valid required execution suffices to refute universal safe-API soundness. No UB-free postcondition refutation is needed or claimed. + +## Authority and trust + +TCB revision `TCB-0` contains only the exact Rust 1.82 Reference/std propositions cited above and the `u32` contract: “Wrapping (modular) addition. Computes `self + rhs`, wrapping around at the boundary of the type.” ([`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)) These are version-matched Rust axioms, not additional assumptions. There are no dependencies, tool results, prior audits, external specifications, implementation claims, or deployment assumptions. Review was source-only; nothing was built, executed, tested, or expanded. + +## Preferred design + +Remove `Slot` and the generic free function. Retain the crate-owned name as one safe inherent operation: + +```rust +pub struct Tail; + +impl Tail { + pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); + } +} +``` + +Proposed contract: for every `[a,b]`, `Tail::increment` has no caller safety precondition, returns normally, leaves element 0 equal to `a`, and sets element 1 to `b + 1 mod 2^32`. The fixed array type makes index `1` locally in bounds; ordinary checked indexing removes all unsafe code, implementer promises, invariants, and additional TCB premises. + +Migration is intentionally source-breaking but authorized for this unreleased abstraction: replace `increment::(&mut x)` with `Tail::increment(&mut x)`; remove downstream `Slot` implementations and generic calls, which the requirement expressly does not preserve. The required `Tail` behavior is unchanged. Do not regard this sketch as audited or `PROVED`. + +After implementation, audit the new snapshot afresh: verify the actual visibility/reexports and absence of generated or conditional alternatives; inventory every remaining safe/unsafe surface; prove index `1` is in bounds from `[u32;2]`; prove normal return, element-0 preservation, and wrapping element-1 update for every input, target in `T`, and ordinary profile; reconcile the final documentation with that contract; and repeat the configuration/TCB closure if source, support policy, dependencies, or Rust version changes. + +Residual scope: binary/backend correctness, nonordinary profiles, other Rust releases, unavailable targets/items, performance, and APIs other than the supplied source are excluded by the request. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/F.md new file mode 100644 index 0000000000..288ee57e72 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/F.md @@ -0,0 +1,70 @@ +# Focused unsafe-Rust audit and redesign + +## Claims and verdicts + +**Snapshot.** Exact supplied `lib.rs` (18 lines), reviewed without execution or expansion. Scope is Rust 1.82.0 and + +`Required = { (target, profile, use) | target admits this source and the used Rust 1.82.0 standard-library items; profile is ordinary; use is well-typed safe use of a language-reachable safe surface }`. + +There are no `cfg`s, macros, dependencies, generated artifacts, FFI, concurrency, allocator choices, or target-dependent operations in the supplied snapshot. The source contains no support-policy transformation: the request supplies the symbolic target set directly. Audit cutoff 2026-08-01 does not extend the fixed Rust release. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every safe use of the current public API is free of Rust UB over `Required`. | **UNSOUND** | F-1 gives a valid entirely-safe use, reaches `get_unchecked_mut(2)` on a length-2 slice, proves its bounds precondition false, and links that event to Rust 1.82.0's explicit UB consequence. The witness is target/profile-parametric. | +| For every initial `[a, b]`, `increment::` terminates with `[a, b.wrapping_add(1)]` without UB. | **PROVED** | P-TAIL below covers every `u32` pair and every required target/profile. | + +There is no documented unsafe public API postcondition. The request's `Tail` behavior is the only additional behavior claim. No `CONTRACT-BROKEN` verdict applies: F-1's execution contains UB, while the independently reviewed `Tail` behavior holds. + +## Boundary, invariants, and obligation ledger + +The complete relevant language-reachable surface is: public safe trait `Slot` and safe associated function `Slot::index` (`lib.rs:3-5`); public unit struct and constructor `Tail` (`:7`); its safe trait implementation (`:9-13`); and safe generic function `increment` (`:15-18`). There are no fields, derives, reexports, hidden items, exported macros, or other manual implementations. Compiler-supplied auto-trait/drop behavior carries no state and is not consumed by the unsafe block. + +The unsafe operation needs `BOUND(S): S::index() < 2`. No type, check, privacy boundary, trait contract, or invariant establishes `BOUND` for arbitrary `S`. `Slot` is public and safe. Rust 1.82.0's [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) make the root `pub` surfaces externally reachable, and its [trait-implementation/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) permit another crate to implement this trait for its own local type. + +| ID | Obligation | Status | +|---|---|---| +| O-BOUND | At `:16`, the `usize` index must be in `0..2`. | **False** for a valid implementation returning 2; proved for `Tail` because `Tail::index()` is exactly 1. | +| O-SAFE | Safe `increment` must discharge O-BOUND for every safe `S: Slot`. | **Refuted** by F-1. | +| O-TAIL | The in-bounds mutable reference denotes element 1; the write preserves element 0 and stores modular `b + 1`. | **Proved** by P-TAIL. | +| O-CONFIG | Cover all requested targets/profiles. | Control flow, array length, constants, and the exact Rust 1.82.0 contracts are invariant across the symbolic availability set; thus P-TAIL covers it, and F-1 works in every member. | + +### P-TAIL + +For `S = Tail`, source fixes `S::index()` to 1. An array `[u32; 2]` has length 2, so 1 is in bounds. Rust 1.82.0 documents that [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) returns a mutable reference to the selected element without checking bounds and states: “Calling this method with an out-of-bounds index is undefined behavior.” Here that forbidden condition is false. The exclusive array borrow supplies the access for the returned reference, and no intervening call occurs. Rust 1.82.0 documents [`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) as computing addition “wrapping around at the boundary of the type.” Therefore the sole write changes element 1 from `b` to modular `b + 1`; element 0 remains `a`. + +## F-1 — safe implementer selects an out-of-bounds slot + +**Implementation: UNSOUND. Proof artifact: missing and not repairable under the current safe contract.** A downstream crate can write, with `audited_crate` denoting this crate: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +This contains no unsafe operation or unmet caller obligation. The ordinary impl is legal for the downstream-local `Bad`; `Slot` imposes no safety condition. `increment` is also safe. Its call to `Bad::index()` returns 2, so line 16 executes `pair.get_unchecked_mut(2)` after array-to-slice method resolution with length 2. Thus the exact required proposition `2 < 2` is false. The linked Rust 1.82.0 standard-library contract says the call itself is UB even if its resulting reference is never used. This completes the existential certificate; it is not merely a missing universal proof. + +The absent adjacent `SAFETY` comment is independently deficient. No truthful comment can derive O-BOUND for arbitrary safe implementations. Minimum repair is to enforce the bound or remove this generic unsafe path; changing prose alone cannot add a hidden precondition to safe callers or implementers. + +## TCB and evidence + +`TCB-R033` contains only the exact Rust 1.82.0 Reference/std axioms linked above: public reachability and legal local-type trait implementation, `get_unchecked_mut`'s return/bounds contract, and `wrapping_add`'s modular result. They are the controlling authorities selected by the request, not additional assumptions. No dependency, tool result, implementation behavior, compatibility premise, test, or deployment restriction is consumed. + +## Preferred redesign + +Delete `Slot`, its impl, the marker `Tail`, the type parameter, and the unsafe operation. The stated behavior needs only a concrete safe function: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract is: no caller safety preconditions; on normal return, initial `[a, b]` becomes `[a, b.wrapping_add(1)]`. The fixed array type and constant index make the access locally checkable, while safe indexing removes the unsafe contract entirely. Keeping `Tail` as an associated-function namespace is possible but adds surface without supplying required capability. + +This intentionally breaks source compatibility: `increment::(&mut pair)` migrates to `increment(&mut pair)`; `Slot` implementations and other generic instantiations disappear. The request authorizes that delta because the abstraction is unreleased and those uses need not survive. + +The proposal is not a new verdict. After implementation, freshly audit the exact new snapshot: public surface and migrated in-scope callers, the fixed index/array-length argument, the wrapping postcondition for every `u32`, absence of unsafe or callback-selected indexing, and Rust-1.82 target/profile closure. Re-audit on source/API changes, reintroduced generic dispatch or unsafe code, new configurations/generated code, or a change to the consumed Rust contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/G.md new file mode 100644 index 0000000000..361bf9ba55 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/G.md @@ -0,0 +1,87 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +**Snapshot.** Exactly the supplied `lib.rs`; no expansion or generated artifact. Scope is Rust and standard library 1.82.0, every target on which this source and the used items exist, and every ordinary profile. Audit cutoff: 2026-08-01. There are no dependencies, features, `cfg`s, build scripts, FFI, assembly, concurrency, allocators, or additional TCB assumptions. + +**Current safe-API soundness: UNSOUND.** A well-typed safe downstream implementation of `Slot` can return `2`; `increment` then executes `get_unchecked_mut(2)` on a two-element array. Rust 1.82 documents that an out-of-bounds call is undefined behavior even if the reference is unused. + +**Required `Tail` behavior: PROVED.** For every initial `[a, b]`, `increment::` returns with `[a, b.wrapping_add(1)]`, and this execution is free of undefined behavior. This regional result does not alter the whole safe-API verdict. + +**Combined current-artifact result: UNSOUND.** The source documents no other postcondition. The `Tail` behavior is included because `REQUEST.md` expressly requires it. + +## Exact domain and configuration closure + +Let a case be `(t, p, S, pair, execution)`. `Required` means: this exact source; Rust/std 1.82.0; `t` is any target on which the source and used items exist; `p` is any ordinary profile; `S` is any type satisfying the public safe bound `Slot`; `pair` is any valid `&mut [u32; 2]`; and the call is well-typed safe Rust. `Required_cfg(t,p)` is its Rust/target/profile projection. This is an equality-preserving transcription of the request, not a sampled inventory or inferred support promise. + +The source has one unconditional path and no generation or selection stage. Target/profile facts do not control the index, length, call, or library contracts used below. The counterexample is therefore parametric over every member of `Required_cfg`; one required case is already sufficient for `UNSOUND`. The `Tail` proof is likewise parametric over the full configuration projection and all `pair` values. No version-bridging premise is used. + +## Boundary, surfaces, and invariants + +- `Slot` and its safe associated function `index` are public; associated items in a public trait are public by default, and root-public items are externally accessible. [Rust 1.82 visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) +- A downstream crate can define local `Oob` and write `impl Slot for Oob`: the implementation supplies the sole required item, and the local implementing type satisfies the orphan rule. Only unsafe traits require `unsafe impl`; `Slot` is not declared unsafe. [Rust 1.82 trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) +- `Tail` is a public unit struct (including its constructor) with the crate-owned `Slot` implementation. `increment` is a public safe generic free function. Its unsafe block is the only unsafe operation. +- There are no fields, methods, other trait items/impls, callbacks, macros, hidden APIs, reexports, or invariant-bearing state. No abstraction invariant constrains caller implementations of `Slot`. + +## Authority/TCB log `TCB-1` + +There are no admitted non-authoritative premises. These checked Rust 1.82 axioms are the entire authority inventory: + +- **AX-ACCESS:** the visibility and implementation propositions stated above; consumers: witness validity and safe-surface inventory. +- **AX-GET:** `get_unchecked_mut` “returns a mutable reference to an element or subslice” without bounds checking, and calling it with an out-of-bounds index is UB even if unused. The page specifically identifies `len` as UB. Consumer: the unsafe-call obligation and `Tail` result. [Rust 1.82 slice contract](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) +- **AX-WRAP:** `wrapping_add` computes modular addition, wrapping at the type boundary. Consumer: the required value postcondition. [Rust 1.82 `u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) + +All apply exactly to Rust/std 1.82.0; changing that identity or any cited contract triggers review. + +## Obligation ledger and proofs + +**O1 — safe generic boundary.** Every safe call must establish `S::index() < 2` before the unsafe operation. Neither `S: Slot` nor any check establishes it. **Refuted; FIND-1.** + +**O2 — unsafe call for `Tail`.** `Tail::index()` returns literal `1`; `[u32; 2]` has length `2`; hence `1 < 2`. AX-GET then supplies a mutable reference to element 1. **PROVED** for all `Tail` cases. + +**O3 — update/postcondition for `Tail`.** The sole store is through that element-1 reference. AX-WRAP makes the stored value old element 1 plus one modulo the `u32` range; element 0 is not written. There is no alternative source path. **PROVED** for all initial arrays and configurations. + +**O4 — local proof artifact.** The unsafe block has no adjacent `SAFETY` proof. The reconstruction in O2 proves only `Tail`, not arbitrary `S`, so no truthful generic safety comment can repair the current implementation. **Deficient and implementation-unsound.** + +Aggregate positive coverage for the required `Tail` claim is `O2-covered ∩ O3-covered = Required_Tail`, establishing `Required_Tail ⊆ Covered_Tail`. Aggregate coverage for universal safe-API soundness fails at O1 and is existentially refuted below. + +## FIND-1 — safe implementer selects an out-of-bounds index + +**Status: UNSOUND; proof artifact missing.** Consider downstream safe code: + +```rust +struct Oob; +impl Slot for Oob { fn index() -> usize { 2 } } +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +**Valid use.** AX-ACCESS plus the source’s public, non-unsafe declarations make the implementation and call available without any caller-side unsafe obligation. The implementation defines the only required associated item and is coherent because `Oob` is local. + +**Reachability.** Monomorphization does not change the written control flow: `S::index()` returns `2`, which is passed directly to the executed `get_unchecked_mut` call before the store. + +**False safety proposition.** The array length is `2`, so the supplied index equals `len` and is out of bounds. + +**UB consequence.** AX-GET expressly makes that call UB even if its result is never used. Thus the whole execution witnesses soundness failure; it cannot witness a defined postcondition failure. No separate required postcondition is refuted. + +Minimum repair is to stop relying on an unenforced safe-implementer promise: validate the index, make and fully document an unsafe trait, effectively seal it, or remove the genericity. The stated requirements make removal preferable. + +## Preferred redesign (not a verdict on new code) + +Replace `Slot`, `Tail`, and generic `increment` with the specialized safe operation: + +```rust +pub fn increment_tail(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract has no safety precondition: for every valid input `[a,b]`, normal return produces `[a, b + 1 mod 2^32]`. The fixed array type and safe indexing enforce the only memory-selection fact; AX-WRAP supplies the arithmetic postcondition. It exposes no unsafe caller/implementer surface, owns no invariant, and needs no additional TCB premise. This is more parsimonious than sealing a trait whose only required implementation is fixed. + +**Migration/contract delta.** Remove the public `Slot` implementer contract, `Slot::index`, the nominal `Tail` constructor/implementation, and generic calls. Change the required internal call from `increment::(&mut pair)` to `increment_tail(&mut pair)`. Downstream implementations and generic calls intentionally cease to compile; the request authorizes that break and states the API is unreleased. The required observable behavior is unchanged. + +**Fresh audit after implementation.** Treat it as a new snapshot: re-inventory its actual visibility and all call sites; verify the safe element-selection semantics and AX-WRAP applicability on every requested target/profile; prove both elements’ post-state and all exits; confirm no conditional/generated alternative; and redo `Required ⊆ Covered`. This proposal itself is **not implemented and has no audit verdict**. + +## Evidence, residual scope, and triggers + +No target was built, run, tested, expanded, or tool-verified; none of those facts supports a conclusion. This is a source-level Rust-semantics audit, not a compiler-backend, binary, platform-implementation, performance, panic-freedom-beyond-the-required-case, or maximal-safe-subset claim. Re-audit on source/API/contract changes, Rust/std or support-domain changes, addition of configuration/generation/dependencies, or implementation of the redesign. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/J.md new file mode 100644 index 0000000000..a2cb2e7bae --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudication-packets/R/reports/J.md @@ -0,0 +1,82 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +Snapshot: the supplied `lib.rs` exactly as inspected; scope is its complete surface (`Slot`, `Tail`, their associated items/impl, and `increment`). `REQUEST.md` supplies the only behavioral requirement. No generated artifacts, dependencies, prior audit, build tooling, or tests are used. This is a source-level Rust-abstract-semantics review. + +`DOMAIN-R` is + +`rustc = std = 1.82.0 ∧ target supports this exact source and the used 1.82.0 items ∧ profile is ordinary`. + +The proof is parametric over every such target, profile, and Rust-1.82-supported edition in which the source compiles. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the current public surface is UB-free | **UNSOUND** throughout `DOMAIN-R` | `F-UB` below gives a valid safe witness in every case. | +| `increment::` changes `[a,b]` to `[a,b.wrapping_add(1)]` | **PROVED** throughout `DOMAIN-R` | `P-TAIL`; `Covered = DOMAIN-R`, hence `Required ⊆ Covered`. | +| Source-documented postconditions | none | No `CONTRACT-BROKEN` verdict applies. The requested Tail behavior is proved separately above. | + +The redesign authorization does not narrow the current artifact's safe public contract, so the proposal below does not affect **UNSOUND**. + +## Boundary, invariants, and obligations + +Safe surfaces are the public safe trait `Slot`, its safe associated function `index`, downstream implementations, public unit type/constructor `Tail`, its implementation, and public safe generic function `increment`. The only unsafe site is `pair.get_unchecked_mut(S::index())`. There are no fields, unsafe traits/impls, macros, hidden items, callbacks, FFI, concurrency, custom allocation, or destruction behavior relevant to that site. + +There is no enforced invariant. The needed proposition `S::index() < 2` cannot be an invariant of every `S: Slot`: `Slot` is public, safe, and unsealed, and neither its type system nor a check constrains the return value. + +| ID | Exact obligation | Status | +|---|---|---| +| O-BOUNDS | At the unsafe call, `S::index()` indexes the two-element slice in bounds. | **Refuted** for the generic safe surface by `F-UB`; proved for `S=Tail`. | +| O-TAIL | On normal return for `Tail`, mutate only element 1 to its old value plus one modulo `2^32`. | **PROVED** by `P-TAIL`. | +| O-DOC | Adjacent proof must derive O-BOUNDS from enforceable facts. | **Missing**, and no truthful generic derivation exists. | + +### F-UB — complete existential certificate + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } + +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +`Slot` and `increment` are externally reachable public items under the Rust 1.82 [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy). Because `Bad` is downstream-local, this implementation satisfies the [trait-implementation coherence/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations). `Slot` is not an [unsafe trait](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), so neither implementation nor call accepts a safety obligation. + +The call reaches `get_unchecked_mut(2)` on a slice of length 2. Its exact 1.82.0 contract says: “Calling this method with an out-of-bounds index is undefined behavior” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)); it expressly applies even when the result is unused. Thus the executed unsafe operation's required proposition is false and Rust's contract entails UB. No earlier operation in the witness is unsafe. `2` and `[u32; 2]` exist in every `DOMAIN-R` case, and cfg/profile/optimization does not alter this path. + +### P-TAIL — reconstructed local proof + +`Tail::index()` is definitionally `1`; `[u32; 2]` has length 2, so `1 < 2`. The unsafe method therefore returns a mutable reference to element 1. There is no intervening call or escaped alias. Rust 1.82 documents `wrapping_add` as “Wrapping (modular) addition” ([`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Assigning that result through the reference changes element 1 to `(old + 1) mod 2^32`; element 0 is untouched. This material derivation is absent from the source, but it proves only the Tail case and cannot repair the generic contract. + +## Configuration closure and TCB + +The controlling expression is exactly `DOMAIN-R`; no normalization or exclusion was added. Actual axes are target, ordinary profile, and compiling Rust-1.82 edition. There is one handwritten, unconditional path. Fixed array length, index values, the UB witness, and modular arithmetic are independent of those axes, giving parametric coverage. There are no sampled configurations or tool-derived claims. + +TCB log `TCB-R016-r1` has no additional assumptions. Its accepted authoritative axioms are: `AX-GET`, the quoted Rust-1.82 `get_unchecked_mut` contract (consumer O-BOUNDS); `AX-WRAP`, the quoted Rust-1.82 modular-addition contract (O-TAIL); and `AX-TRAIT`, the linked Rust-1.82 visibility, implementation, and unsafe-trait rules (F-UB). Exact identities are the linked versioned pages; scope is `DOMAIN-R`. Re-audit on source/API changes, Rust or support-domain changes, or material changes to those pages. + +## Finding and required resolution + +`F-UB` is an implementation defect in the current safe generic API; severity critical. The proof artifact is also missing: there is no `SAFETY` comment. Adding prose such as “implementers return an in-bounds index” would leave a hidden safety precondition on a safe trait and would not fix the defect. A generic design would need enforcement (for example, checked indexing) or an unsafe/sealed implementer boundary. The stated requirement needs no genericity, making those larger contracts unnecessary. + +## Preferred redesign + +Remove `Slot`, `Tail`, the type parameter, and all unsafe code: + +```rust +/// Replaces `[a, b]` with `[a, b.wrapping_add(1)]`. +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Contract: every well-typed safe call has no safety precondition beyond the parameter type; on return element 0 equals its old value and element 1 equals its old value plus one modulo `2^32`. The array type makes index 1 in bounds, safe indexing enforces bounds regardless, and `wrapping_add` supplies the exact arithmetic. There is no invariant, unsafe boundary, implementer obligation, or additional TCB premise. + +Migration: `increment::(&mut pair)` becomes `increment(&mut pair)`. The `Slot` implementation surface, generic calls, and nominal `Tail` type disappear; the request expressly authorizes those breaking changes and says the abstraction is unreleased. Tail's observable required effect is unchanged. + +This sketch is **not implemented and has no audit verdict**. After implementation, freeze a new snapshot and freshly audit every remaining/reexported safe surface; verify removal of the trait, impls, and unsafe site; prove index 1 in bounds, element 0 unchanged, and the wrapping postcondition; redo `DOMAIN-R` configuration closure; and review the final documentation and migrated consumers. + +## Residual scope + +Binary/backend correctness, non-ordinary configurations, other Rust releases, and any source not supplied are excluded. No target was built, tested, executed, or macro-expanded. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/B.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/B.json new file mode 100644 index 0000000000..e131804e6a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/B.json @@ -0,0 +1,928 @@ +{ + "schema_version": 1, + "mode": "B", + "decisions": [ + { + "label": "A", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The six rows are stated exhaustive, but Result exhaustiveness and tuple-struct enum-pattern semantics are not verified." + }, + { + "label": "A", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "R,S and normal success are asserted, but successful println output, tuple-pattern handling of NotPresent, and implicit return are not authoritatively established." + }, + { + "label": "A", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena row has the right endpoint but lacks verified successful-output and implicit-function-return premises for the complete trace." + }, + { + "label": "A", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "The arena-stop row has the right panic/no-library result, but successful A-line completion is not verified by the cited println premise." + }, + { + "label": "A", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode rows are present, but successful R output and tuple-struct-pattern semantics are incomplete." + }, + { + "label": "A", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "It handles failed calls and incomplete bytes, but the completed R prefix used after second-write failure lacks a verified successful-println effect." + }, + { + "label": "A", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Exact TCB consumers are listed, but upstream successful traces and Rust all/not source selection are incomplete." + }, + { + "label": "A", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The freshness prose is exact, yet the prerequisite successful arena and completed-line local trace lacks full Rust authority." + }, + { + "label": "A", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The exclusion uses all(...) without verifying Rust all/key-value truth semantics, and depends on incomplete successful-selector closure." + }, + { + "label": "A", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "It calls the blocks complementary but never verifies all/not configuration semantics or complete build-to-source reachability." + }, + { + "label": "A", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The witness states all four ideas, but authoritative reachability through the successful arena build and selected block is incomplete." + }, + { + "label": "A", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M has the intended formula, but the positive and complement proofs consume the unproved body/build partition." + }, + { + "label": "A", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The not-C zero proof is conditional on an unproved current-source partition and therefore does not cover the required build relation." + }, + { + "label": "A", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "It gives the intended UNPROVED wording, but the underlying B12 and B14 derivations are incomplete." + }, + { + "label": "A", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "UNSOUND is issued without an authoritative complete reachability chain through normal build-script return and exact cfg selection." + }, + { + "label": "A", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "PROVED and UNSOUND conclusions necessarily rely on unchecked successful-println, function-return, Result-pattern, and all/not premises." + }, + { + "label": "A", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "The asserted witness lacks a validly established supported-current-library reachability link." + }, + { + "label": "A", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The TCB itself is kept narrow, but material Rust premises for build completion and cfg selection are not verified." + }, + { + "label": "B", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "Absent/system [RERUN,CS] normal return is asserted without verified println success or implicit function-return semantics." + }, + { + "label": "B", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "Arena [RERUN,CA] normal return lacks verified completed-line and implicit-return premises." + }, + { + "label": "B", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "Arena-stop's later panic is right, but successful CA completion is not verified because AX-EXIT covers only println failure." + }, + { + "label": "B", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Both rejection classes are partitioned correctly, but the completed RERUN prefix lacks verified successful println output semantics." + }, + { + "label": "B", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "It handles every failure and arbitrary partial bytes, but the required preceding completed [RERUN] is not supported by a verified successful-println proposition." + }, + { + "label": "B", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The TCB and cfg stages are explicit, but the successful/failure local relation remains incomplete through B3-B7." + }, + { + "label": "B", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "Freshness outcomes are enumerated, but the prior successful [RERUN,CA] trace lacks output/return authority." + }, + { + "label": "B", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The wasm/arena cfg proof is correct conditionally, but actual effective closure depends on incomplete B8 selector success." + }, + { + "label": "B", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "AX-CFG proves complementarity conditionally, but supported current-source selection depends on incomplete B4/B8." + }, + { + "label": "B", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The zero/NZ/UB links are correct, but current Q-library reachability is incomplete at successful script output/return." + }, + { + "label": "B", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "Smax and the four cases are exact algebraically, but every-complement UB reachability is not completely established." + }, + { + "label": "B", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The checked-body zero proof is correct conditionally, but complete Required-to-body coverage through B8 is absent." + }, + { + "label": "B", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The intended verdict is stated, but B12/B14 do not provide complete applicable certificates." + }, + { + "label": "B", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "The report issues UNSOUND without a fully verified successful-build reachability link." + }, + { + "label": "B", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND conclusions necessarily rely on unchecked successful-println and function-return semantics." + }, + { + "label": "B", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "Its A64/on/arena safe-call certificate is incomplete at println success and normal main return." + }, + { + "label": "B", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded correctly, but material successful-output and normal-return Rust premises are unverified." + }, + { + "label": "C", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The table lists all six classes, but exact Result/VarError variant exhaustiveness and literal/wildcard/tuple-pattern semantics are not verified." + }, + { + "label": "C", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The two system rows lack verified enum/literal pattern selection and implicit main-return semantics." + }, + { + "label": "C", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena row states R,A0 success but does not verify literal-pattern selection or normal function return." + }, + { + "label": "C", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "R,A0 then panic/no library is stated, but reaching the arena-stop arm is unsupported by applicable literal-pattern authority." + }, + { + "label": "C", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The rejection rows are correct textually, but wildcard and NotUnicode tuple-pattern selection are not verified." + }, + { + "label": "C", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Cargo effects are narrowly qualified, but the successful local traces and exact Rust cfg truth/selection relation remain incomplete." + }, + { + "label": "C", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The requested stale-build outcomes are enumerated, but prerequisite arena/arena-stop path selection and successful return are unverified." + }, + { + "label": "C", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "It asserts the wasm32/arena all predicate and converse without verifying all, option-truth, and false-cfg removal semantics." + }, + { + "label": "C", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "Q/not-Q are called complementary without verified all/not cfg rules and complete successful mapping." + }, + { + "label": "C", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The stated safe zero witness lacks a valid authoritative source-reachability derivation." + }, + { + "label": "C", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "The maximal formula and case split are correct, but rely on unproved cfg/build reachability and false-if behavior." + }, + { + "label": "C", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The regional panic assertion lacks a complete cfg/body and false/true conditional-semantics derivation over Required." + }, + { + "label": "C", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The verdict is worded correctly, but neither its complete UB certificate nor regional proof is established." + }, + { + "label": "C", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "The UNSOUND verdict rests on an incompletely authorized successful-selector and cfg-body reachability chain." + }, + { + "label": "C", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "The report necessarily relies on unchecked Result/pattern, function-return, and all/not semantics for its affirmative conclusions." + }, + { + "label": "C", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "The existential certificate's reachability link is not validly established from the cited Rust premises." + }, + { + "label": "C", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "Although BUILD-MAP-ORDERED is bounded, required Rust semantic leaves for exhaustive paths and cfg selection are missing." + }, + { + "label": "D", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The R,CS rows assert return success, but no versioned function-body premise establishes implicit normal return after the final println." + }, + { + "label": "D", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The R,CA arena row likewise lacks authoritative implicit-return completion despite correct order/output reasoning." + }, + { + "label": "D", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Cargo/cfg composition is otherwise exact, but the only-successful-return premise consumes unverified implicit main-return semantics from B3/B4." + }, + { + "label": "D", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The compile_error proof is exact conditionally, but effective build-to-source closure still depends on the incomplete successful-arena B8 derivation." + }, + { + "label": "D", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "The all/not body proof is exact conditionally, but current supported-source reachability depends on the incomplete B4/B8 success relation." + }, + { + "label": "D", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "Safe use, false NZ, and zero-UB are authoritative; current-library reachability remains incomplete at the build-script normal-return edge." + }, + { + "label": "D", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M/WIT are algebraically exact, but maximality consumes the incomplete supported reachability certificate." + }, + { + "label": "D", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The zero-source proof is correct conditionally, but Required-to-current-body coverage is incomplete through B8/B11." + }, + { + "label": "D", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The intended UNPROVED reasoning is present, but its prerequisite complete B12 and B14 certificates do not hold." + }, + { + "label": "D", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It issues UNSOUND although the current supported library reachability link omits verified implicit-return semantics." + }, + { + "label": "D", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its build/source and maximality affirmatives necessarily rely on unchecked function-return semantics." + }, + { + "label": "D", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "F-UB's raw-arena-to-current-library reachability certificate is incomplete at normal main return." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The exact TCB is carefully bounded, but normal build-script return is a material unverified Rust premise used by positive verdicts." + }, + { + "label": "F", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "It calls the partition exhaustive but explicitly lets BUILD.md supply it; Result/VarError exhaustiveness and exact pattern behavior are not verified as Rust semantics." + }, + { + "label": "F", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The system rows lack exact match/pattern and implicit-return authority despite showing the intended R,L_s endpoint." + }, + { + "label": "F", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena row shows R,L_a success but does not verify exact literal-arm selection or falling-through main return." + }, + { + "label": "F", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "Its arena-stop prefix/panic outcome is correct, but reaching that literal arm is not established by the cited vague match premise." + }, + { + "label": "F", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode outcomes are listed, but wildcard and tuple-struct pattern semantics are not verified." + }, + { + "label": "F", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Exact TCB use is described, but selector success/exhaustiveness and Rust cfg all/not source selection remain incomplete." + }, + { + "label": "F", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The three rerun failures are right, but the prior-success and arena-stop arm derivations rely on unchecked local Rust semantics." + }, + { + "label": "F", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "B-03 asserts all(...) and exact rejection without verifying all/key-value cfg semantics or complete B8 mapping." + }, + { + "label": "F", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "The C/not-C block split is asserted without version-matched all/not and false-cfg semantics, atop incomplete mapping." + }, + { + "label": "F", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "F-01 states four bullets, but supported current-source reachability is not validly established by the report's authorities." + }, + { + "label": "F", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "S has the intended formula, but its complement proof relies on the incomplete cfg/build reachability chain." + }, + { + "label": "F", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "S-01's zero panic proof is only conditional on an unproved complementary source selection." + }, + { + "label": "F", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "POST-01 gives the intended verdict, but B12/B14 are not complete applicable derivations." + }, + { + "label": "F", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "UNSOUND is issued without a valid authoritative reachability link through the accepted raw arena path and cfg body." + }, + { + "label": "F", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "The report expressly uses BUILD.md to supply a Rust-semantic raw partition and also omits material return/all-not authorities." + }, + { + "label": "F", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "F-01's current-library/source reachability link is incomplete despite correct zero and UB propositions." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "It treats BUILD.md as supplying the complete raw semantic partition and leaves other material Rust cfg/return premises unchecked." + }, + { + "label": "G", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The six classes are explicitly called exhaustive, but Result's two-way shape and tuple-struct enum matching are not verified." + }, + { + "label": "G", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "Absent/system R,Sline normal return lacks verified successful-println and implicit-return premises, with tuple matching also omitted for absence." + }, + { + "label": "G", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena success trace asserts a complete Aline and normal return without verifying println success or function-body return." + }, + { + "label": "G", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "The arena-stop ordering is stated, but completion of R/Aline on successful println calls is not verified." + }, + { + "label": "G", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The two R-only rejection rows lack verified successful-line and NotUnicode tuple-pattern premises." + }, + { + "label": "G", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "q correctly avoids atomicity assumptions, but the completed [R] premise after a later failure lacks verified println-success semantics." + }, + { + "label": "G", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The TCB is conspicuous and cfg rules are cited, but upstream successful return/output and exhaustive selector traces are incomplete." + }, + { + "label": "G", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The freshness sequence is exact textually, yet its successful prior [R,Aline] premise is not authoritatively established." + }, + { + "label": "G", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The conditional compile_error proof is correct in isolation, but effective build closure depends on the incomplete successful-arena mapping in B8." + }, + { + "label": "G", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "all/not semantics are stated, but the exact supported current-source partition still depends on the incomplete B4/B8 mapping." + }, + { + "label": "G", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "Valid use, false precondition, and UB are stated; the authoritative current-library reachability link is incomplete." + }, + { + "label": "G", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M and both set arguments are stated, but every excluded-case UB proof consumes the incomplete reachability certificate." + }, + { + "label": "G", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The not-K zero source argument is present, but the required build-to-body coverage remains incomplete." + }, + { + "label": "G", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "UNPROVED/not-CONTRACT-BROKEN is correct, but the report has not completed the prerequisite whole UB and regional coverage proofs." + }, + { + "label": "G", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It reports UNSOUND while the supported-current-library reachability link lacks verified successful-output and function-return semantics." + }, + { + "label": "G", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its PROVED/UNSOUND results necessarily rely on unchecked Result/tuple, println-success, and function-return premises." + }, + { + "label": "G", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "F-1's reachability certificate is incomplete even though its false-precondition and UB links are correct." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is not widened, but material Rust semantics needed for current selector success and exhaustiveness are unverified." + }, + { + "label": "H", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "Calls the six classes exhaustive, but AX-ENV omits Result's Ok/Err exhaustiveness and tuple-struct-pattern semantics needed to exclude another outcome." + }, + { + "label": "H", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The R,S success row lacks verified block sequencing, successful println line effect, and implicit main-return semantics." + }, + { + "label": "H", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The R,A success row asserts normal return without verified source-order, successful-output, or function-return premises." + }, + { + "label": "H", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "It states R,A then explicit panic/no library, but the completed-line and source-order premises are not verified by its authorities." + }, + { + "label": "H", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The R-only rejection rows lack tuple-pattern/source-order and successful-line authority sufficient for both raw classes." + }, + { + "label": "H", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "Although q models failed-call bytes, no block-order or successful-println premise verifies the prior completed R prefix at allocator-write failures." + }, + { + "label": "H", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The Cargo qualification is conspicuous, but the successful/failing local traces and exact Rust cfg selection needed for composition remain unproved." + }, + { + "label": "H", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "BUILD-2 states the requested sequence, but relies on unverified R-before-A successful and arena-stop local traces." + }, + { + "label": "H", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "CFG-1 asserts all(...) truth and cfg inclusion without verifying all, key/value-option truth, and true/false cfg-attribute rules." + }, + { + "label": "H", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "The U/not-U body partition is asserted without verified all/not, key/value, and true-versus-false cfg semantics." + }, + { + "label": "H", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The UNSOUND witness reaches the first body only through the incomplete build/cfg derivation, so authoritative reachability is missing." + }, + { + "label": "H", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "The formula is correct, but both containments rely on the unverified body/build partition and unverified false-if flow." + }, + { + "label": "H", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The regional zero argument relies on the unverified complementary cfg selection and build-to-source closure." + }, + { + "label": "H", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "UNPROVED is stated correctly, but its required UB and regional-panic certificates are incomplete because B12/B14 are unproved." + }, + { + "label": "H", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It issues UNSOUND while supported-Q reachability rests on unverified build-return and exact cfg-selection premises." + }, + { + "label": "H", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its positive build/source conclusions necessarily use unchecked Rust block, println-success, return, and all/not semantics." + }, + { + "label": "H", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "SOUND-1 lacks a valid authoritative reachability link from raw arena through the current library to the unchecked body." + }, + { + "label": "H", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but multiple material Rust premises supporting PROVED/UNSOUND claims are not verified by applicable versioned text." + }, + { + "label": "I", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The six classes are stated, but Result/VarError exact variants and literal/wildcard/tuple-pattern propositions are not verified." + }, + { + "label": "I", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "System-success rows lack verified pattern selection, successful println output, and implicit return semantics." + }, + { + "label": "I", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "Arena success asserts CFG(arena) and return without verified literal-pattern, completed-line, or function-return premises." + }, + { + "label": "I", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "arena-stop's complete line then panic is stated, but literal-arm reachability and successful-line semantics are unverified." + }, + { + "label": "I", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode R-only rejections lack verified wildcard/tuple patterns and successful stdout-line effect." + }, + { + "label": "I", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "It models failed-call byte prefixes and all sites, but the preceding complete RERUN relies on uncited println-success semantics." + }, + { + "label": "I", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "BUILD-MAP use is narrow, but successful raw traces and exact Rust all/not cfg source mapping remain incomplete." + }, + { + "label": "I", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The freshness outcomes are correct textually, but prerequisite successful-arena and arena-stop local traces lack full authority." + }, + { + "label": "I", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The exclusion asserts all truth/falsehood without verifying Rust all/key-value semantics and depends on incomplete B8." + }, + { + "label": "I", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "H/not-H selection is asserted without version-matched all/not and false-cfg authority or complete mapping." + }, + { + "label": "I", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "BAD has the right safe-zero and UB facts, but current-body reachability rests on incomplete build/cfg derivations." + }, + { + "label": "I", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "SOUND is algebraically right, but its positive and excluded-case proofs rely on unverified cfg and if/comparison behavior." + }, + { + "label": "I", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The not-H zero panic assertion has no verified if/equality semantics and lacks complete Required-to-body mapping." + }, + { + "label": "I", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The intended verdict is present, but B12/B14 do not supply complete applicable certificates." + }, + { + "label": "I", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "UNSOUND is issued while the current-source reachability link lacks verified pattern, output, return, and cfg semantics." + }, + { + "label": "I", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND claims necessarily rely on unchecked Result/pattern, println-success, function-return, all/not, and if/comparison premises." + }, + { + "label": "I", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "BAD's reachability chain is incomplete despite correct safe-use, false-precondition, and UB assertions." + }, + { + "label": "I", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED remains narrow, but numerous material Rust semantic premises are unverified." + }, + { + "label": "J", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "It states exact Result/VarError and literal/wildcard cases, but does not verify match-arm choice or tuple-struct enum-pattern semantics." + }, + { + "label": "J", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The [R,S] system returns lack verified match selection and implicit function-return semantics." + }, + { + "label": "J", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The [R,A] arena return lacks verified match-arm and falling-through-main return premises." + }, + { + "label": "J", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "The complete arena-stop prefix/panic is stated, but exact arm selection is unsupported without match semantics." + }, + { + "label": "J", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The R-only rows are stated, but NotUnicode tuple matching and match control are not verified." + }, + { + "label": "J", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The Cargo mapping is exact conditionally, but upstream selector partition/success traces lack match and return authority." + }, + { + "label": "J", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The stale sequence is complete textually, but the successful arena and arena-stop source paths are not validly established." + }, + { + "label": "J", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The compile_error argument is correct conditionally, but effective current-build mapping remains incomplete through B8." + }, + { + "label": "J", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "Cfg all/not semantics are supplied, but the supported current-source partition depends on incomplete B4/B8 reachability." + }, + { + "label": "J", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "Zero falsity and UB are authoritative, but the safe call's current-library reachability is incomplete." + }, + { + "label": "J", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M has the exact intended set shape, but inclusion/maximality also use unverified if/comparison behavior and incomplete reachability." + }, + { + "label": "J", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "It asserts zero enters the checked panic without verifying Rust if/comparison semantics or complete build-to-body coverage." + }, + { + "label": "J", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "UNPROVED is stated, but its UB and regional-panic prerequisite proofs are incomplete." + }, + { + "label": "J", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It reports UNSOUND without a valid authoritative match/return-supported current-library reachability link." + }, + { + "label": "J", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its affirmative conclusions necessarily rely on unchecked match, tuple-pattern, function-return, and if/comparison semantics." + }, + { + "label": "J", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "The stated aarch64/burst/arena certificate is incomplete at build-path and source reachability." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The Cargo TCB is bounded, but several material Rust control-flow and pattern premises are absent from its authority log." + } + ], + "ambiguities": [ + "The frozen rules do not quantify how much quotation is needed for an accurate proposition-level paraphrase. I credited precise version-matched proposition paraphrases, but not unsupported endpoint assertions that omit a material semantic premise or derivation.", + "Atom dependency failure is not mechanically transitive. A later listed atom fails here only where its own proof consumes the same omitted material premise." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/L.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/L.json new file mode 100644 index 0000000000..29bc9995f3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/L.json @@ -0,0 +1,227 @@ +{ + "schema_version": 1, + "mode": "L", + "decisions": [ + { + "label": "B", + "field": "atom:L2", + "decision": "PASS", + "evidence": "Steps 1-2 explicitly state that reaching this single-condition else means q is false and contrapose AX-EMPTY to bytes.len() != 0; the cited exact Rust 1.82 if page verifies the invoked branch proposition." + }, + { + "label": "B", + "field": "atom:L6", + "decision": "PASS", + "evidence": "The verdict quantifies every well-typed safe call, the proof covers both branches and connects the nonzero-length predecessor bound to AX-GET, and it closes all targets and ordinary profiles. The defective formal Required notation is recorded separately as G1." + }, + { + "label": "B", + "field": "hard_error:G1", + "decision": "PRESENT", + "evidence": "B says the request directly defines Required as only source x Rust/std x targets x profiles, omitting valid calls/inputs and executions, then certifies Covered = Required for its full PROVED result." + }, + { + "label": "B", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "The needed branch proposition is explicit, correct, and supported by the cited exact Rust 1.82 Reference page; the incomplete quoted implication is an extraction defect, not necessary reliance on invalid or inapplicable authority." + }, + { + "label": "B", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "B expressly inventories the branch proposition, its exact authority identity, consumer, and region, and the cited page supports it. Its quotation is insufficient for exact reconciliation, but the premise is neither silent nor supported only by an unexamined page identity." + }, + { + "label": "B", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "AX-IF quotes false-condition => else-executed but labels that excerpt as verifying the converse else-executed => false proposition; the report's claimed proposition-matched TCB entry is therefore not established by its extracted evidence." + }, + { + "label": "D", + "field": "atom:L2", + "decision": "PASS", + "evidence": "O2 explicitly states that reaching the else makes is_empty false and applies A3 to obtain n != 0; the exact cited Rust 1.82 if authority verifies that invoked fact for this one-condition if/else." + }, + { + "label": "D", + "field": "atom:L6", + "decision": "PASS", + "evidence": "O1-O3 cover every valid slice, derive representable n - 1 and index < n, discharge A1, and connect the exhaustive proof to the full-scope PROVED verdict and Required subset-of Covered certificate." + }, + { + "label": "D", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "D invokes the correct branch-selection proposition and cites the exact applicable Rust 1.82 page that supports it; the deficient excerpt does not make the proof necessarily rely on invalid or inapplicable authority." + }, + { + "label": "D", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "The branch premise is explicitly inventoried with proposition, consumer, version, and exact page, rather than silently consumed. The extraction mismatch is a reconciliation/TCB defect but does not establish the exact hard-error trigger." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "A4's quoted false => else sentence does not itself establish A4's asserted else => false proposition, so TCB-LAST-R1 is not proposition-matched as claimed." + }, + { + "label": "E", + "field": "atom:L2", + "decision": "PASS", + "evidence": "O2 explicitly places the unsafe call on the false is_empty path and contraposes A1 to n != 0; A3 cites the exact Rust 1.82 if section and invokes its same-paragraph branch rules, which verify that premise." + }, + { + "label": "E", + "field": "atom:L8", + "decision": "FAIL", + "evidence": "The proposed text states representability and the predecessor bound, but E has no checked entries for len's usize type/domain, built-in subtraction, or overflow, so it cannot unambiguously refer to checked authority for the full L2-L5 chain." + }, + { + "label": "E", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "The PROVED argument necessarily uses Rust integer typing, built-in subtraction, and overflow/profile semantics that its four-entry authority inventory never checks." + }, + { + "label": "E", + "field": "hard_error:LH4", + "decision": "PRESENT", + "evidence": "E calls its authority list complete and denies any unlisted premise while silently consuming the omitted usize/type, subtraction, and overflow propositions." + }, + { + "label": "E", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The asserted complete Rust-only authority inventory omits multiple materially consumed Rust numeric premises." + }, + { + "label": "F", + "field": "atom:L2", + "decision": "PASS", + "evidence": "Steps 1-2 explicitly split the true and false outcomes, place the unsafe path in the false case, and contrapose AX-EMPTY to L != 0; the cited exact if page verifies the invoked branch fact." + }, + { + "label": "F", + "field": "atom:L3", + "decision": "PASS", + "evidence": "AX-LEN explicitly states the verified proposition that len returns the element count as usize, and step 2 uses the equivalent exact nonnegativity fact that an element count is a natural count to derive L >= 1 from L != 0." + }, + { + "label": "F", + "field": "atom:L8", + "decision": "FAIL", + "evidence": "The replacement asserts representable subtraction but F has no checked usize-domain, subtraction, or overflow entries, and its text does not identify get_unchecked by name; it therefore lacks the required checked-authority linkage for the full chain." + }, + { + "label": "F", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "F's full PROVED result necessarily relies on unchecked Rust built-in subtraction and overflow/profile behavior, irrespective of its valid natural-count argument for positivity." + }, + { + "label": "F", + "field": "hard_error:LH4", + "decision": "PRESENT", + "evidence": "F claims no other Rust premise is consumed while its representability and every-profile closure require omitted subtraction and overflow semantics." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The claimed complete Rust 1.82 authority set has no proposition-matched entries for the materially consumed subtraction and overflow/profile semantics." + }, + { + "label": "G", + "field": "atom:L2", + "decision": "PASS", + "evidence": "OBL-1 explicitly states that the else case has is_empty false and contraposes A3 to n != 0; the invoked fact is verified by G's exact Rust 1.82 if-section citation." + }, + { + "label": "G", + "field": "atom:L3", + "decision": "PASS", + "evidence": "The proof explicitly states n: usize, applies A7's unsigned domain, and derives n >= 1. The report invokes the checked len/type signature, and its exact A2 page verifies len's usize return type without adding a missing premise." + }, + { + "label": "G", + "field": "atom:L6", + "decision": "PASS", + "evidence": "G connects the exhaustive branch split, nonzero usize bound, defined predecessor arithmetic, and index < len to A1, then reports PROVED over the exact valid-input, target, and profile domain with Covered = Required." + }, + { + "label": "G", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "The branch and len-type premises are explicit and true, and their exact applicable Rust 1.82 pages are cited; incomplete extraction or classification does not make the result necessarily depend on invalid or inapplicable authority." + }, + { + "label": "G", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "G explicitly states both contested premises and identifies checked exact pages that support them, so neither is silently consumed or necessarily based on an unexamined page. The classification/extraction defects remain authority-reconciliation defects below the hard-error trigger." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-LAST-1's A2 entry does not extract len's consumed usize return type and A4's excerpt supplies only false => else while claiming the converse, so the asserted proposition-matched inventory is defective." + }, + { + "label": "I", + "field": "atom:L2", + "decision": "PASS", + "evidence": "Steps 1-2 explicitly state that the unsafe-containing else means is_empty was false and contrapose A1 to L != 0; the exact cited Rust 1.82 if page verifies the invoked branch proposition." + }, + { + "label": "I", + "field": "atom:L6", + "decision": "PASS", + "evidence": "The report exhausts both boolean paths, derives nonoverflowing index = L - 1 < L, discharges A7, and closes the full valid-input, target, and ordinary-profile domain with PROVED and Required subset-of Covered." + }, + { + "label": "I", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "I invokes a correct branch premise and cites the exact applicable Rust 1.82 Reference page that supports it; its incomplete excerpt is not necessary reliance on invalid or inapplicable authority." + }, + { + "label": "I", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "A2 expressly gives the branch proposition, exact page, version, and consumer, and that page supports the proposition. The insufficient quoted direction defeats exact reconciliation but does not show silent consumption or an unexamined-page substitution." + }, + { + "label": "I", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "A2 quotes false => else but records else => false as the verified proposition, leaving TCB-LAST-1's consumed branch entry unsupported by its extracted text." + }, + { + "label": "J", + "field": "atom:L10", + "decision": "FAIL", + "evidence": "AX-IF's supplied excerpts say true => consequent executes and false => else executes, but omit the exact prose that true skips the subsequent else; they therefore do not supply O1's consumed true-arm exclusion as L10 requires." + }, + { + "label": "J", + "field": "atom:L11", + "decision": "FAIL", + "evidence": "J attests that every semantic leaf has a complete L10 entry, but O1 consumes true-condition exclusion of the else arm and AX-IF does not quote prose supplying that leaf." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R1 is claimed proposition-matched, yet AX-IF's extraction omits the true => skip-else proposition consumed by O1, so the report's own authority evidence does not establish the full branch entry." + } + ], + "ambiguities": [ + "The frozen rules do not expressly say whether an explicitly invoked, correct Rust proposition whose exact cited page supports it, but whose supplied quotation states only the opposite implication direction, must fail content/closure atoms L2 and L6 as well as exact-authority atoms. Applying the adjudication rule permitting external verification of invoked premises, I pass the content/closure atoms but do not repair L10/L11 or the TCB evidence defect.", + "The exact LH4/G11 threshold is ambiguous for a true, expressly inventoried premise on an applicable exact page whose excerpt or classification is incomplete. I treat that as below the hard-error threshold when the premise, identity, and consumer are explicit (B/D/G/I), while E/F trigger both errors because they omit materially consumed numeric Rust premises entirely.", + "L3 prescribes the usize nonnegative-domain bridge but also requires acceptance of equivalently exact derivations. I accept F's stated element-count-as-natural-number argument as an exact nonnegativity derivation after AX-LEN establishes the count and usize return type." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/P.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/P.json new file mode 100644 index 0000000000..e090156eff --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/P.json @@ -0,0 +1,46 @@ +{ + "schema_version": 1, + "mode": "P", + "decisions": [ + { + "label": "H", + "field": "atom:P1", + "decision": "FAIL", + "evidence": "H labels S0 itself the exact Scarlet configuration predicate, but S0 omits v in V and t in T and is true for !f outside those sets. The later DS := Base and S0 repairs the full-case domain, not the standalone P1 set." + }, + { + "label": "H", + "field": "atom:P2", + "decision": "FAIL", + "evidence": "H labels I0 itself the exact Indigo configuration predicate, but I0 omits v in V and t in T and is true for !f outside those sets. The later DI := Base and I0 repairs the full-case domain, not the standalone P2 set." + }, + { + "label": "H", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "H's affirmative rejection proof moves from two true cfg leaves to cfg(all(...)) without an exact-version all quotation or supplying URL, and its non-turbo coverage invokes a 'complementary cfg' without exact-version not semantics. Both unchecked Rust premises are necessary to its positive conclusions." + }, + { + "label": "H", + "field": "hard_error:PH4", + "decision": "PRESENT", + "evidence": "H claims whole-domain soundness and behavior PROVED, but its non-turbo Covered region depends on the unchecked not-predicate selection premise. Consequently its stated Required subset-of Covered_sound and Covered_post containments are not valid authority-closed full-case certificates." + }, + { + "label": "H", + "field": "hard_error:PH5", + "decision": "PRESENT", + "evidence": "H affirmatively claims every turbo/wasm32 compilation is rejected. It supplies BUILD-MAP-POLICY mapping, cfg-attribute inclusion text, and compile_error! text, but omits the applicable exact-version all implication required to establish that cfg(all(...)) is true." + }, + { + "label": "H", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The report scopes BUILD-MAP-POLICY itself correctly, but omits material exact-version Rust authority for all and not while using both in positive rejection and branch-coverage proofs. Its behavioral headline also does not explicitly carry the BUILD-MAP-POLICY qualification required by its branch-selection proof." + } + ], + "ambiguities": [ + "PH4 does not explicitly say whether a syntactically stated full-case containment that fails solely because Covered lacks a material authority premise triggers PH4 in addition to G11. I treat it as PH4 because valid Covered derivations are explicit dependencies of P19 and P23.", + "The behavioral headline's phrase 'on that same domain' clearly imports the audit domain but is grammatically ambiguous about importing the preceding soundness bullet's BUILD-MAP-POLICY qualification. This does not change the authority-defect decision, which independently follows from the omitted all/not authority." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/R.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/R.json new file mode 100644 index 0000000000..03f9f98f36 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/adjudications/R.json @@ -0,0 +1,127 @@ +{ + "schema_version": 1, + "mode": "R", + "decisions": [ + { + "label": "A", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "A correctly keeps the redesign conditional and demands a fresh audit, but R7 depends on R3. A's UNSOUND certificate does not establish R3 because it asserts that calling ordinary `increment` needs no unsafe context without verifying the required Rust 1.82 safe-versus-unsafe-function rule." + }, + { + "label": "A", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "A issues UNSOUND, but its valid-safe-use link asserts that `increment` needs no unsafe context without applicable version-matched function-safety authority; the four-link existential certificate is therefore incomplete." + }, + { + "label": "A", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "A necessarily relies on the unchecked Rust premise that an ordinary `fn` call carries no caller-side unsafe obligation; none of TCB-R182's cited authorities verifies that rule." + }, + { + "label": "A", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R182 claims the cited Rust 1.82 sources are the only semantic premises, yet omits the safe-versus-unsafe-function authority consumed by the witness's valid-call step." + }, + { + "label": "D", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "D explicitly leaves the sketch unaudited and requires fresh review, but R7 depends on R3. D's R3 is unestablished because its assertion that `increment` is safely callable lacks the required Rust 1.82 function-safety authority." + }, + { + "label": "D", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "D issues UNSOUND while the valid-safe-use link relies on its unsupported assertion that the ordinary `increment` call has no unsafe obligation, leaving the existential certificate incomplete." + }, + { + "label": "D", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "D necessarily consumes an unchecked safe-versus-unsafe-function rule; its cited visibility, implementation, unsafe-trait, slice, and wrapping authorities do not establish ordinary-function call safety." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-0 omits applicable Rust 1.82 authority for the ordinary-versus-unsafe-function premise used to classify the witness call as valid safe use." + }, + { + "label": "F", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "F says the proposal is not a verdict and requires implementation plus fresh audit, but R7 depends on R3. F's authority-incomplete valid-safe-call step leaves R3 unestablished." + }, + { + "label": "F", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "F issues UNSOUND without verifying the material premise that calling ordinary `increment` is valid safe use, so its otherwise explicit witness lacks one required existential link." + }, + { + "label": "F", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "F necessarily relies on unchecked Rust function-safety semantics when it states that `increment` is safe; TCB-R033 supplies no applicable safe-versus-unsafe-function authority." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R033 omits the Rust 1.82 ordinary-versus-unsafe-function rule consumed by the witness's valid-call step, despite claiming the linked authorities are the controlling axioms." + }, + { + "label": "G", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "G preserves current UNSOUND, labels the redesign nonverdictal, and requires fresh audit, but R7 depends on R3. AX-ACCESS does not verify ordinary-function call safety, so G's R3 remains unestablished." + }, + { + "label": "G", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "G issues UNSOUND although its valid-use step infers from public non-unsafe syntax that `increment` has no caller-side unsafe obligation without the required Rust 1.82 function authority." + }, + { + "label": "G", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "G necessarily relies on the unchecked premise that an ordinary `fn` is callable without an unsafe obligation; AX-ACCESS's cited visibility and implementation sources do not establish it." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-1 omits applicable Rust 1.82 safe-versus-unsafe-function authority even though FIND-1 consumes that premise to establish a valid safe call." + }, + { + "label": "J", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "J explicitly keeps the sketch unimplemented and requires a fresh snapshot audit, but R7 depends on R3. J's missing function-safety authority leaves the valid-safe-call link, and thus R3, unestablished." + }, + { + "label": "J", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "J issues UNSOUND without authority-complete proof that calling ordinary `increment` is valid safe use; the existential certificate therefore lacks a fully established link." + }, + { + "label": "J", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "J necessarily relies on unchecked ordinary-versus-unsafe-function semantics; TCB-R016-r1's cited authorities do not verify the caller-safety rule for `increment`." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R016-r1 omits the applicable Rust 1.82 safe-versus-unsafe-function authority material to classifying the witness call as safe." + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/PACKET.json new file mode 100644 index 0000000000..3a758b467f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/PACKET.json @@ -0,0 +1,26 @@ +{ + "allowlist_sha256": "7124ac918b5595c9eaa594511309d8ac1a2400456695cd3004db76f14d18ec21", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "B", + "raw_score_sha256": { + "s1": "68aa251dab96542fd092f97d4de606a072ff2e0f77f107c5ed25a91d01960d0d", + "s2": "f3be21eb3a23aca4f0f6fe5b50548fbbb7c7716734ecd31ae4f9b2ace2196b8c" + }, + "report_sha256": { + "A": "fad0c995d3639d93a74d17be5c17ee86615a76ffca5ae9b91756e8a77834b1fe", + "B": "ca2e2fe0e2096c3fb6629d6d97067dba5125aedf7d74c14710bdfe4f20953351", + "C": "481bdce1f650e4b9ffc1242fccb53adb23bd33ed200d6971ed40fb3e944e067f", + "D": "e3283ae8b81a126762ee59cdd8108681311618dc8b848256daa4c49cfd1ae78c", + "E": "79d94306111d77ca7b72fe0d5bc780e96009c10285753a0979c7e926977cefc8", + "F": "dfcd89377ba31227e0ed7bb9ae4926eca117678182f14ef3f26fe5e929b2b57d", + "G": "a556b26d30da7f48af3bdb4f1962a532142a7555215e6df0fb731896ecdcf164", + "H": "bea0082d313d7bc237a2b754a983410e62d437aecef9bec717b7014d0b618e41", + "I": "5b414f1c8097099ebfe625ec880d4aa0da01a46617e5712419912ed230ccffbe", + "J": "d3ed478991945f13610c6cf0b2dbde59dbe68b37afcf9c456e17a78197a8d6bf" + }, + "rubric_sha256": "13790584d0e5ede69cff8c2b1889be80c73df0722c4ea709c0e85ab82900a4bb", + "schema_sha256": "c7720030785e0d87c17d1a1ed44a9ecf260571a459be50b0fd2df15931ffa8e5", + "schema_version": 1, + "source_score_packet_sha256": "d2a2885dd9f9d4377d3aca40571a9429952662bf751033963b05eaf6b292515c", + "target_byte_tree_sha256": "7589027142112e387f990314df7eb1d08e5464448566fd68048eb2a748635bf3" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/RUBRIC.md new file mode 100644 index 0000000000..c5371528bf --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/RUBRIC.md @@ -0,0 +1,483 @@ +# Mode B Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material.** Never expose this file, its atoms, formulas, +> expected verdicts, hard errors, or authority inventory to a report agent. + +## Scoring Rules + +Score the proposition of each atom, not its notation or presentation. Accept an +explicit equivalent derivation. Do not infer an omitted build stage, failure +edge, source-selection step, or semantic premise from an endpoint summary. +Failure of an atom is not itself a hard error unless the report also makes the +false affirmative claim identified below. + +This fixture deliberately requests a maximal positive region. That request, +not a general audit convention, makes exactness and maximality part of B13. +There is no scoring requirement for incidental diagnostics, exact panic text, +partially written bytes within one failed `println!`, or build-script stdout +which does not affect a current library selection. + +## Intended Domain and Build Relation + +Let: + +```text +R = { Rust and Cargo 1.85.1 } +T = { X = x86_64-unknown-linux-gnu, + A = aarch64-unknown-linux-gnu, + W = wasm32-unknown-unknown } +F = { burst-off, burst-on } +L = { system, arena } +P = every Cargo profile supported by the fixture +D = { debug-assertions-off, debug-assertions-on } +I = { i | i is any u8 } + +Config(t,f,l,p,d) + iff t in T and f in F and l in L and p in P and d in D + and not (t = W and l = arena). + +Required = R cross Config cross I. +Q(t,f,l) iff t = A and f = burst-on and l = arena. +``` + +Both allocator values in `Config` are reachable through the supported Cargo +interface: an omitted selector or `system` selects `system`, and `arena` +selects `arena`. Raw rejected selector values and unsuccessful build attempts +are build-relation cases that must be accounted for, but they do not add a +library configuration to `Required`. + +For compactness, use these local operations: + +```text +RERUN = attempt println!("cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR") +READ = evaluate env::var("FIXTURE_ALLOCATOR") +SYS = attempt println!("cargo::rustc-cfg=fixture_allocator=\"system\"") +ARENA = attempt println!("cargo::rustc-cfg=fixture_allocator=\"arena\"") +PANIC = the selected explicit panic, or the panic caused by a failed println! +RETURN = successful return from main +``` + +The complete claim-relevant local relation is: + +```text +missing: RERUN -> READ(NotPresent) -> SYS -> RETURN +Unicode system: RERUN -> READ(Ok(system)) -> SYS -> RETURN +Unicode arena: RERUN -> READ(Ok(arena)) -> ARENA -> RETURN +Unicode arena-stop: + RERUN -> READ(Ok(arena-stop)) -> ARENA -> PANIC +other Unicode: RERUN -> READ(Ok(other)) -> PANIC +non-Unicode: RERUN -> READ(NotUnicode) -> PANIC +``` + +Every arrow after a `println!` assumes that write succeeds. If `RERUN` fails, +it panics before `READ`, and no complete earlier directive is required. If +`SYS` or `ARENA` fails, `RERUN` is the material completed prefix and the script +panics before `RETURN` or the explicit `arena-stop` panic. If `ARENA` succeeds +on `arena-stop`, the material completed prefix is `[RERUN, ARENA]`, followed by +the explicit panic. Under exact accepted entry `BUILD-MAP-ORDERED`, every panic is an +unsuccessful script exit and produces no current library compilation, +regardless of completed prefix. + +On the three successful selector paths, `BUILD-MAP-ORDERED` interprets the final +allocator line as exactly one matching library cfg. Cargo's accepted feature +and target mappings, followed by the Rust conditional-compilation rules, +select the library source. The `W`/`arena` combination selects +`compile_error!`, so it does not produce a library and is genuinely outside +`Config`. The supported `Q` cell selects the first `lane_id` body and removes +the complementary checked body. + +A prior successful `arena` build necessarily completed `RERUN` before +`ARENA`. After the raw selector changes to `arena-stop`, `BUILD-MAP-ORDERED` makes +that prior selection stale, reruns the script, and refuses to present the old +library as the result of the current unsuccessful execution. Thus the +freshness canary is an effective rejection even though its current output +prefix includes the same arena cfg line. + +## Expected Source Results + +The exact maximal sound region requested by the target is: + +```text +SoundRegion = { case in Required | not Q(case) or case.i != 0 }. +``` + +Outside `Q`, the selected body panics when `i == 0`; reaching +`new_unchecked(i)` therefore implies `i != 0`. Inside `Q`, the selected body +calls `new_unchecked` without a check, so nonzero inputs are sound and zero is +not. The complement of `SoundRegion` within `Required` consists exactly of +`Q` with `i == 0` (for every supported profile and debug-assertion state). + +The safe call `lane_id(0)` in any `Q` case reaches +`NonZeroU8::new_unchecked(0)`. Its exact safety proposition is false, and the +Rust 1.85.1 standard-library contract states that zero produces undefined +behavior. Safe-API soundness over all of `Required` is therefore **UNSOUND +relative to `BUILD-MAP-ORDERED`**. + +For the documented zero-input panic postcondition: + +```text +RequiredPanic = { case in Required | case.i = 0 } +CoveredPanic = { case in RequiredPanic | not Q(case) }. +``` + +The regional theorem over `CoveredPanic` is **PROVED relative to +`BUILD-MAP-ORDERED`**. The whole `RequiredPanic` theorem is **UNPROVED**, not +`CONTRACT-BROKEN`: the only missing cases are executions already shown to +contain UB, so their apparent absence of an earlier panic is not a defined +behavioral counterexample. + +## Atoms + +- **B1 — Exact supported case predicate:** The report states a predicate + equivalent to `Required`, including Rust/Cargo 1.85.1, all three targets, + both feature states, both allocator models, every supported Cargo profile, + both debug-assertion states, every `u8`, and only the `W`/`arena` policy + exclusion. + - `scope_basis`: `Cargo.toml`, `SUPPORT.md`, and `BUILD.md`. + - `dependencies`: none; this is the theorem root. + - `accepted_alternatives`: symbolic products or a proved equivalent partition; no + Cartesian enumeration is required. + - `hard_errors`: omission + alone fails B1; claiming a whole-domain affirmative result over a contracted + predicate triggers BH1. + +- **B2 — Exhaustive raw-selector partition:** The report proves that the raw + environment domain is exactly missing, Unicode `system`, Unicode `arena`, + Unicode `arena-stop`, every other Unicode string, and every non-Unicode + value, with no seventh `env::var` outcome. + - `scope_basis`: `BUILD.md`, the + exact `env::var`/`VarError` contracts, and the outer and inner matches. + - `dependencies`: independent of B1; it supplies the cases used + by B3–B7. + - `accepted_alternatives`: any disjoint exhaustive partition that + preserves these behaviorally distinct classes. + - `hard_errors`: + omission alone fails B2; calling an incomplete partition complete and using + it for build closure triggers BH2. + +- **B3 — Complete system-success trace:** Conditional on its two writes + succeeding, each of the missing and Unicode-`system` classes follows exactly + `RERUN -> READ -> SYS -> RETURN`; it emits no arena cfg. + - `scope_basis`: the + ordered statements, `env::var`, match/pattern semantics, `String::as_str`, + and `println!`. + - `dependencies`: B2 identifies the two raw cases; + this is a local-source proposition and does not consume Cargo mapping. + - `accepted_alternatives`: combine the two classes after proving their + identical trace. + - `hard_errors`: omission alone fails B3; an + incompatible endpoint used for closure triggers BH2. + +- **B4 — Complete arena-success trace:** Conditional on its two writes + succeeding, Unicode `arena` follows exactly + `RERUN -> READ -> ARENA -> RETURN`; it emits no system cfg. + - `scope_basis`: + the same local Rust contracts as B3. + - `dependencies`: B2; this + trace is the reachability root for B8–B12. + - `accepted_alternatives`: an + equivalent state-transition row or prose proof. + - `hard_errors`: + omission alone fails B4; an incompatible endpoint used for closure triggers + BH2. + +- **B5 — `arena-stop` partial-prefix exit:** With successful writes, Unicode + `arena-stop` follows exactly + `RERUN -> READ -> ARENA -> PANIC`, so `[RERUN, ARENA]` is a completed output + prefix but the script does not return successfully and, under + `BUILD-MAP-ORDERED`, produces no current library compilation. + - `scope_basis`: + `BUILD.md`, local match/`println!`/`panic!` semantics, and only the exact + unsuccessful-exit proposition of `BUILD-MAP-ORDERED`. + - `dependencies`: + B2; this is distinct from a failed allocator write in B7. + - `accepted_alternatives`: notation may differ, but both ordered lines, the later panic, + and no-current-library consequence must appear. + - `hard_errors`: + omission alone fails B5; treating the partial arena line as a current + successful selector triggers BH4. + +- **B6 — Pre-allocator rejection traces:** Every other Unicode value and every + non-Unicode value follows `RERUN -> READ -> PANIC` after a successful rerun + write, so `[RERUN]` is its completed directive prefix; it attempts no + allocator cfg and produces no current library compilation under + `BUILD-MAP-ORDERED`. + - `scope_basis`: the wildcard and `NotUnicode` arms plus + the exact build premise. + - `dependencies`: B2; the two classes may + share an outcome only after both are accounted for. + - `accepted_alternatives`: + separate rows or one proved union. + - `hard_errors`: omission alone + fails B6; treating either class as an accepted allocator/configuration + triggers BH5. + +- **B7 — Stdout-failure edges:** The report accounts for failure of every + claim-relevant `println!`: failed `RERUN` panics before `READ`; failed `SYS` + or `ARENA` panics with completed prefix `[RERUN]`; and all such unsuccessful + exits produce no current library compilation under `BUILD-MAP-ORDERED`. It does + not require atomic line writes or assign meaning to an incomplete line. + - `scope_basis`: the exact `println!` Panics section, source order, + `panic!`'s main-thread result, and the accepted process-status proposition. + - `dependencies`: B3–B5 identify allocator-write sites; B7 is the + failure completion of those traces. + - `accepted_alternatives`: a single + quantified failure rule is preferred and passes if its instantiations are + readily checkable. + - `hard_errors`: omission alone fails B7; + claiming complete build coverage while a material failure edge supplies a + contrary current artifact triggers BH2 or BH4 as applicable. + +- **B8 — Successful Cargo-to-source selector mapping:** Only the successful + B3/B4 returns supply a current library compilation; Cargo interprets their + exact allocator line as exactly the corresponding `fixture_allocator` + key/value, maps the requested feature and target as admitted, and Rust cfg + rules select source from those resulting predicates. The report keeps + `BUILD-MAP-ORDERED` conspicuous and does not infer local output or Rust semantics + from it. + - `scope_basis`: B3/B4, exact `BUILD-MAP-ORDERED`, the reviewed Cargo + directive contracts, and versioned Rust cfg semantics. + - `dependencies`: B3 through B7. + - `accepted_alternatives`: a relational composition + or explicit stage-by-stage prose. + - `hard_errors`: silently + widening the accepted mapping triggers BH3; treating an unsuccessful prefix + as successful triggers BH4. + +- **B9 — Rerun/freshness theorem:** A prior successful `arena` build completed + `RERUN` before `ARENA`; changing the same target directory's raw selector to + `arena-stop` makes that selection stale, causes a new script run, and yields + no library for the current rejected build rather than reusing the prior arena + library. + - `scope_basis`: local B4/B5 order and precisely the rerun/staleness + proposition accepted in `BUILD-MAP-ORDERED`, reviewed against Cargo's + `rerun-if-env-changed` contract. + - `dependencies`: B4, B5, and the + no-library exit consequence. + - `accepted_alternatives`: a more general proof + for every accepted-to-rejected value change passes if it includes this + requested sequence. + - `hard_errors`: omission alone fails B9; + claiming this current build succeeds from the stale or partial arena output + triggers BH4. + +- **B10 — Effective wasm32/arena exclusion:** For either feature state and all + profiles/debug states, accepted `arena` selection plus the admitted wasm32 + target mapping makes both predicates of the library's first cfg true; Rust + `all` and cfg-attribute semantics therefore retain `compile_error!`, whose + contract makes compilation fail. No `W`/`arena` case is in `Required` or is + used as the UB witness. + - `scope_basis`: `SUPPORT.md`, B8, exact configuration + predicate and attribute semantics, and `compile_error!`. + - `dependencies`: B8. + - `accepted_alternatives`: any parametric proof covering both + feature states and all `P x D`. + - `hard_errors`: calling this pair + supported, using it as a valid-use witness, or asserting rejection without + the selected `compile_error!` proof triggers BH5. + +- **B11 — Exact library-body partition:** The report proves that the unchecked + first body is retained and the complementary checked body removed exactly in + `Q`, while the checked body is retained and the first body removed exactly + outside `Q`. In `Q`, B8 supplies `target_arch="aarch64"`, + `feature="burst"`, and `fixture_allocator="arena"`; Rust's key/value, `all`, + `not`, and cfg-attribute rules establish both directions of the partition. + - `scope_basis`: B8 and the exact versioned cfg propositions. + - `dependencies`: B4 and B8; this is the source-reachability edge for B12/B13. + - `accepted_alternatives`: expansion of the two cfg predicates or an + equivalent Boolean proof. + - `hard_errors`: omission alone fails + B11; declaring the supported unsafe branch unreachable by ignoring generated + cfgs triggers BH6. + +- **B12 — Existential UB certificate and verdict:** The report identifies the + well-typed safe call `lane_id(0)` in a supported `Q` case, uses B11 to reach + `NonZeroU8::new_unchecked(0)`, states that its exact nonzero safety + proposition is false, applies the Rust 1.85.1 zero-UB consequence, and reports + whole-`Required` soundness **UNSOUND relative to `BUILD-MAP-ORDERED`**. + - `scope_basis`: the public safe API, B1, B11, and the exact std contract. + - `dependencies`: B1 and B11. + - `accepted_alternatives`: any one supported + profile/debug state is enough for the existential certificate; proving all + such states is also correct. + - `hard_errors`: an incomplete + certificate followed by `UNSOUND`, or failure to issue `UNSOUND` after giving + every link, triggers BH7. + +- **B13 — Exact maximal sound region:** The report proves both containments for + `SoundRegion = { case in Required | !Q or i != 0 }`: every included case is + sound (the checked body dominates its unsafe call outside `Q`, and nonzero + directly satisfies the unsafe precondition inside `Q`), while every excluded + Required case is exactly `Q`/zero and has B12's UB execution. It labels this + the exact maximal source-level region relative to `BUILD-MAP-ORDERED`. + - `scope_basis`: the user-requested maximal theorem, B1, B11/B12, `if`/comparison/ + panic semantics, and `new_unchecked`. + - `dependencies`: B1, B8, + B11, B12. + - `accepted_alternatives`: an algebraically equivalent formula or + disjoint partition; a correct non-maximal remainder does not pass this + explicitly requested atom. + - `hard_errors`: omission or refusal to + maximize alone fails B13; calling a region maximal while including Q/zero, + excluding sound Q/nonzero cases, or excluding all of `Q` triggers BH8. + +- **B14 — Regional zero-panic theorem:** For every zero-input case outside + `Q`, cfg selection retains the checked body, `value == 0` makes the `if` + consequent execute, and `panic!` prevents reachability of the later unsafe + call. Thus `CoveredPanic = RequiredPanic intersect !Q` is **PROVED relative + to `BUILD-MAP-ORDERED`** across every applicable target/allocator/feature, + profile, and debug state. + - `scope_basis`: B1/B8/B11 and exact comparison, + `if`, cfg, and panic contracts. + - `dependencies`: B1, B8, and the + complement of B11. + - `accepted_alternatives`: a parametric proof or exact + finite configuration partition. + - `hard_errors`: incomplete + regional coverage alone fails B14; falsely claiming the region contains + Q/zero triggers BH9 or BH10 depending on the verdict. + +- **B15 — Whole-domain panic-postcondition verdict:** The report states that + the documented zero-input panic guarantee over all `RequiredPanic` is + **UNPROVED**, not `CONTRACT-BROKEN` and not `PROVED`: Q/zero contains UB, so + its apparent source prefix supplies neither a defined non-panic witness nor a + guaranteed observation, while B14 proves every other zero case. + - `scope_basis`: the exact behavioral quantifier, B12, B14, and whole-execution UB + reasoning. + - `dependencies`: B12 and B14. + - `accepted_alternatives`: + equivalent theorem-specific wording that keeps this verdict separate from + soundness. + - `hard_errors`: using the UB-containing case to claim + `CONTRACT-BROKEN` or an observation before UB triggers BH9; claiming the + universal panic theorem `PROVED` triggers BH10. + +## Hard Errors + +- **BH1:** Claims a whole-domain affirmative result after omitting a supported + release, target, feature, allocator, profile, debug state, or valid `u8` + input, or treats the supported `Q` cell as excluded. +- **BH2:** Claims the build relation or a dependent theorem complete while + replacing the requested ordered/fallible relation with an endpoint summary + that omits a material raw-selector class, failure edge, partial-prefix exit, + or necessary stage. +- **BH3:** Invents, silently widens, or treats as Rust authority any Cargo, + freshness, process-status, feature, or target proposition beyond exact + `BUILD-MAP-ORDERED`. +- **BH4:** Treats a cfg line emitted by an unsuccessful script, or a stale + artifact from an earlier selector, as the library selected for the current + failed build. +- **BH5:** Treats a rejected raw selector as an accepted allocator model; + treats wasm32/arena as supported; uses it as the safe-use UB witness; or + claims its effective rejection without the selected `compile_error!` proof. +- **BH6:** Ignores build-script output or exact Cargo/cfg interpretation and + consequently declares the supported `Q` unsafe branch unreachable. +- **BH7:** Reports `UNSOUND` without the valid safe use, reachability, false + exact safety proposition, and applicable UB consequence, or reports only + `UNPROVED` after explicitly establishing all four links. +- **BH8:** Claims an exact or maximal sound region that includes Q/zero or + excludes any sound Required case, including Q/nonzero. +- **BH9:** Reports `CONTRACT-BROKEN` for the zero-panic promise using only the + UB-containing Q/zero execution, or claims an observation is guaranteed + because it appears before that UB in source order. +- **BH10:** Reports the whole-`RequiredPanic` zero-panic theorem `PROVED` + despite leaving Q/zero without a defined proof. + +## Checked Authorities + +The evaluator must open each exact page, confirm the quoted proposition, and +confirm applicability to Rust/Cargo 1.85.1. The quotation is included to make +the semantic leaf explicit; punctuation-only rendering differences are +irrelevant. + +- `https://doc.rust-lang.org/1.85.1/std/env/fn.var.html` — “Fetches the + environment variable key from the current process”; returns + `VarError::NotPresent` when the variable is not set and + `VarError::NotUnicode` when its value is not valid Unicode. +- `https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html` — the enum is + exactly `NotPresent` or `NotUnicode(OsString)`; the variant descriptions + distinguish absence from a present value without valid Unicode data. +- `https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html` — `Result` is + exactly `Ok(T)` or `Err(E)` and “represents either success (`Ok`) or failure + (`Err`).” +- `https://doc.rust-lang.org/1.85.1/std/primitive.u8.html` — `u8` is “The 8-bit + unsigned integer type,” with `MIN` equal to zero and `MAX` equal to 255; zero + is therefore an ordinary valid safe-call input. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html` — a + scrutinee value is “sequentially compared to the patterns in the arms until + a match is found,” and the first matching arm is chosen and entered. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html` — a + block sequentially executes its non-item statements and optional final + expression; its type is `()` when the final operand is omitted. +- `https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body` + — an omitted function output is unit, and the body is conceptually wrapped + so that its body value is returned; an explicit `return`, if reached, + short-cuts that implicit return. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html` — “A + call expression calls a function”; if the function eventually returns, the + expression completes. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns` + — tuple-struct patterns match tuple-struct and enum values satisfying all + their subpatterns and destructure that value. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns` — + literal patterns “match exactly the same value as what is created by the + literal.” +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern` — + the wildcard pattern “matches any value.” +- `https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str` + — `as_str` “Extracts a string slice containing the entire `String`.” +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html` — `println!` + “Prints to the standard output, with a newline,” supplying the successful + completed-line effect used by B3–B6. +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics` — `println!` + “Panics if writing to `io::stdout` fails.” +- `https://doc.rust-lang.org/1.85.1/std/macro.panic.html` — `panic!` “Panics the + current thread.” The process-status consequence consumed by this fixture is + separately and explicitly admitted by `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation` + — a set configuration option is true; `all(...)` is true exactly when all + operands are true; and `not(p)` is true exactly when `p` is false. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute` + — a true cfg predicate retains the attached thing without the cfg attribute, + while a false predicate removes it from the source. +- `https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html` — + `compile_error!` “Causes compilation to fail with the given error message + when encountered.” +- `https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators` + — `==` means equal via `PartialEq::eq`; for the primitive `u8` comparison in + this source it tests whether `value` equals zero. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html` — if the + Boolean condition is true the consequent executes; if false it is skipped. +- `https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked` + — the function creates a nonzero without checking, “results in undefined + behavior if the value is zero,” and its Safety section says, “The value must + not be zero.” +- `https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html` + — Rust programs “must never cause undefined behavior”; unsafe code that no + safe client can trigger to exhibit UB is called sound, and code that safe + code can misuse to exhibit UB is unsound. The whole-execution conclusion is + a logical consequence of classifying the execution as undefined, not a + purported quotation from a source-order or “time travel” subsection. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script` + — after a build script “successfully finishes executing, the rest of the + package will be compiled”; a nonzero exit halts the build. This reviews, but + does not replace, `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script` + — Cargo interprets each stdout line beginning with `cargo::` as an instruction + affecting package compilation, and instruction order can matter. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg` + — the directive tells Cargo to pass its value to rustc's `--cfg` flag for + conditional compilation. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed` + — the directive tells Cargo to rerun the script if that environment + variable's value changes. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/features.html` — Cargo sets + enabled package features with rustc's `--cfg`, and source can test them with + the cfg attribute or macro. + +Cargo pages are evidence used to review the explicit human trust entry; they +are not Rust abstract-semantics axioms and do not silently enlarge that entry. +No test run, CI result, compiler experiment, prior report, evaluator oracle, or +unversioned documentation closes any atom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/allowlist.txt new file mode 100644 index 0000000000..b425cc1918 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/allowlist.txt @@ -0,0 +1,27 @@ +https://doc.rust-lang.org/1.85.1/std/env/fn.var.html +https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html +https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html +https://doc.rust-lang.org/1.85.1/std/primitive.u8.html +https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html +https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html +https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body +https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html +https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern +https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str +https://doc.rust-lang.org/1.85.1/std/macro.println.html +https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics +https://doc.rust-lang.org/1.85.1/std/macro.panic.html +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators +https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html +https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked +https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed +https://doc.rust-lang.org/1.85.1/cargo/reference/features.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/consistency.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/consistency.schema.json new file mode 100644 index 0000000000..04f2f75ba5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/consistency.schema.json @@ -0,0 +1,72 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-consistency-review-v1", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "mode", + "atom_family_attestations", + "defect_family_attestations", + "challenges", + "ambiguities" + ], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "atom_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["atom_id", "all_ten_reports_compared", "evidence"], + "properties": { + "atom_id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "defect_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["field", "all_ten_reports_compared", "evidence"], + "properties": { + "field": { + "type": "string", + "pattern": "^(hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "challenges": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "recommended_decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "recommended_decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/raw-scores/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/raw-scores/s1.json new file mode 100644 index 0000000000..321da00d31 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/raw-scores/s1.json @@ -0,0 +1,298 @@ +{ + "schema_version": 1, + "mode": "B", + "scorer_id": "s1", + "reports": [ + { + "label": "H", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Defines the three targets, both burst and allocator states, all profiles, both debug states, every u8, and only wasm32/arena excluded under Rust/Cargo 1.85.1."}, + {"id": "B2", "decision": "FAIL", "evidence": "Calls the six classes exhaustive, but AX-ENV omits Result's Ok/Err exhaustiveness and tuple-struct-pattern semantics needed to exclude another outcome."}, + {"id": "B3", "decision": "FAIL", "evidence": "The R,S success row lacks verified block sequencing, successful println line effect, and implicit main-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The R,A success row asserts normal return without verified source-order, successful-output, or function-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "It states R,A then explicit panic/no library, but the completed-line and source-order premises are not verified by its authorities."}, + {"id": "B6", "decision": "FAIL", "evidence": "The R-only rejection rows lack tuple-pattern/source-order and successful-line authority sufficient for both raw classes."}, + {"id": "B7", "decision": "FAIL", "evidence": "Although q models failed-call bytes, no block-order or successful-println premise verifies the prior completed R prefix at allocator-write failures."}, + {"id": "B8", "decision": "FAIL", "evidence": "The Cargo qualification is conspicuous, but the successful/failing local traces and exact Rust cfg selection needed for composition remain unproved."}, + {"id": "B9", "decision": "FAIL", "evidence": "BUILD-2 states the requested sequence, but relies on unverified R-before-A successful and arena-stop local traces."}, + {"id": "B10", "decision": "FAIL", "evidence": "CFG-1 asserts all(...) truth and cfg inclusion without verifying all, key/value-option truth, and true/false cfg-attribute rules."}, + {"id": "B11", "decision": "FAIL", "evidence": "The U/not-U body partition is asserted without verified all/not, key/value, and true-versus-false cfg semantics."}, + {"id": "B12", "decision": "FAIL", "evidence": "The UNSOUND witness reaches the first body only through the incomplete build/cfg derivation, so authoritative reachability is missing."}, + {"id": "B13", "decision": "FAIL", "evidence": "The formula is correct, but both containments rely on the unverified body/build partition and unverified false-if flow."}, + {"id": "B14", "decision": "FAIL", "evidence": "The regional zero argument relies on the unverified complementary cfg selection and build-to-source closure."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED is stated correctly, but its required UB and regional-panic certificates are incomplete because B12/B14 are unproved."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It issues UNSOUND while supported-Q reachability rests on unverified build-return and exact cfg-selection premises."}, + {"id": "BH7", "evidence": "SOUND-1 lacks a valid authoritative reachability link from raw arena through the current library to the unchecked body."}, + {"id": "G11", "evidence": "Its positive build/source conclusions necessarily use unchecked Rust block, println-success, return, and all/not semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly future work requiring re-audit and is not used for any current verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is bounded, but multiple material Rust premises supporting PROVED/UNSOUND claims are not verified by applicable versioned text."}, + "visible_scope_defect": {"present": false, "evidence": "The report describes only supplied target files/policies and allowed source-level authorities; it evidences no prohibited evaluator material."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Supported names every target, feature/allocator state, profile, debug state, u8 value, Rust/Cargo 1.85.1, and only the wasm32/arena exclusion."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six rows are stated exhaustive, but Result exhaustiveness and tuple-struct enum-pattern semantics are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "R,S and normal success are asserted, but successful println output, tuple-pattern handling of NotPresent, and implicit return are not authoritatively established."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row has the right endpoint but lacks verified successful-output and implicit-function-return premises for the complete trace."}, + {"id": "B5", "decision": "FAIL", "evidence": "The arena-stop row has the right panic/no-library result, but successful A-line completion is not verified by the cited println premise."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode rows are present, but successful R output and tuple-struct-pattern semantics are incomplete."}, + {"id": "B7", "decision": "FAIL", "evidence": "It handles failed calls and incomplete bytes, but the completed R prefix used after second-write failure lacks a verified successful-println effect."}, + {"id": "B8", "decision": "FAIL", "evidence": "Exact TCB consumers are listed, but upstream successful traces and Rust all/not source selection are incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness prose is exact, yet the prerequisite successful arena and completed-line local trace lacks full Rust authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The exclusion uses all(...) without verifying Rust all/key-value truth semantics, and depends on incomplete successful-selector closure."}, + {"id": "B11", "decision": "FAIL", "evidence": "It calls the blocks complementary but never verifies all/not configuration semantics or complete build-to-source reachability."}, + {"id": "B12", "decision": "FAIL", "evidence": "The witness states all four ideas, but authoritative reachability through the successful arena build and selected block is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M has the intended formula, but the positive and complement proofs consume the unproved body/build partition."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-C zero proof is conditional on an unproved current-source partition and therefore does not cover the required build relation."}, + {"id": "B15", "decision": "FAIL", "evidence": "It gives the intended UNPROVED wording, but the underlying B12 and B14 derivations are incomplete."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued without an authoritative complete reachability chain through normal build-script return and exact cfg selection."}, + {"id": "BH7", "evidence": "The asserted witness lacks a validly established supported-current-library reachability link."}, + {"id": "G11", "evidence": "PROVED and UNSOUND conclusions necessarily rely on unchecked successful-println, function-return, Result-pattern, and all/not premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The suggested repair is not treated as implemented or as support for the current verdicts."}, + "tcb_authority_defect": {"present": true, "evidence": "The TCB itself is kept narrow, but material Rust premises for build completion and cfg selection are not verified."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing in the report establishes inspection beyond the supplied crate/policies and versioned documentation."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "F/C include Rust and Cargo 1.85.1, the three supported targets, both feature/allocator/debug states, every profile/u8, and only W/arena excluded."}, + {"id": "B2", "decision": "FAIL", "evidence": "The table lists all six classes, but exact Result/VarError variant exhaustiveness and literal/wildcard/tuple-pattern semantics are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "The two system rows lack verified enum/literal pattern selection and implicit main-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row states R,A0 success but does not verify literal-pattern selection or normal function return."}, + {"id": "B5", "decision": "FAIL", "evidence": "R,A0 then panic/no library is stated, but reaching the arena-stop arm is unsupported by applicable literal-pattern authority."}, + {"id": "B6", "decision": "FAIL", "evidence": "The rejection rows are correct textually, but wildcard and NotUnicode tuple-pattern selection are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Explicitly covers first-write failure, every allocator-write failure, prior [R], incomplete failed-call bytes, panic, and no library under the exact TCB."}, + {"id": "B8", "decision": "FAIL", "evidence": "Cargo effects are narrowly qualified, but the successful local traces and exact Rust cfg truth/selection relation remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The requested stale-build outcomes are enumerated, but prerequisite arena/arena-stop path selection and successful return are unverified."}, + {"id": "B10", "decision": "FAIL", "evidence": "It asserts the wasm32/arena all predicate and converse without verifying all, option-truth, and false-cfg removal semantics."}, + {"id": "B11", "decision": "FAIL", "evidence": "Q/not-Q are called complementary without verified all/not cfg rules and complete successful mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "The stated safe zero witness lacks a valid authoritative source-reachability derivation."}, + {"id": "B13", "decision": "FAIL", "evidence": "The maximal formula and case split are correct, but rely on unproved cfg/build reachability and false-if behavior."}, + {"id": "B14", "decision": "FAIL", "evidence": "The regional panic assertion lacks a complete cfg/body and false/true conditional-semantics derivation over Required."}, + {"id": "B15", "decision": "FAIL", "evidence": "The verdict is worded correctly, but neither its complete UB certificate nor regional proof is established."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "The UNSOUND verdict rests on an incompletely authorized successful-selector and cfg-body reachability chain."}, + {"id": "BH7", "evidence": "The existential certificate's reachability link is not validly established from the cited Rust premises."}, + {"id": "G11", "evidence": "The report necessarily relies on unchecked Result/pattern, function-return, and all/not semantics for its affirmative conclusions."} + ], + "proposal_laundering": {"present": false, "evidence": "Its repair is explicitly prospective and not used to certify the supplied implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "Although BUILD-MAP-ORDERED is bounded, required Rust semantic leaves for exhaustive paths and cfg selection are missing."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences review only of supplied target material and versioned allowed authorities."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "S exactly states all target, burst, allocator, profile/debug, and u8 axes under 1.85.1, excluding only wasm32/arena."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six classes are explicitly called exhaustive, but Result's two-way shape and tuple-struct enum matching are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "Absent/system R,Sline normal return lacks verified successful-println and implicit-return premises, with tuple matching also omitted for absence."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena success trace asserts a complete Aline and normal return without verifying println success or function-body return."}, + {"id": "B5", "decision": "FAIL", "evidence": "The arena-stop ordering is stated, but completion of R/Aline on successful println calls is not verified."}, + {"id": "B6", "decision": "FAIL", "evidence": "The two R-only rejection rows lack verified successful-line and NotUnicode tuple-pattern premises."}, + {"id": "B7", "decision": "FAIL", "evidence": "q correctly avoids atomicity assumptions, but the completed [R] premise after a later failure lacks verified println-success semantics."}, + {"id": "B8", "decision": "FAIL", "evidence": "The TCB is conspicuous and cfg rules are cited, but upstream successful return/output and exhaustive selector traces are incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness sequence is exact textually, yet its successful prior [R,Aline] premise is not authoritatively established."}, + {"id": "B10", "decision": "FAIL", "evidence": "The conditional compile_error proof is correct in isolation, but effective build closure depends on the incomplete successful-arena mapping in B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "all/not semantics are stated, but the exact supported current-source partition still depends on the incomplete B4/B8 mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "Valid use, false precondition, and UB are stated; the authoritative current-library reachability link is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M and both set arguments are stated, but every excluded-case UB proof consumes the incomplete reachability certificate."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-K zero source argument is present, but the required build-to-body coverage remains incomplete."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED/not-CONTRACT-BROKEN is correct, but the report has not completed the prerequisite whole UB and regional coverage proofs."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It reports UNSOUND while the supported-current-library reachability link lacks verified successful-output and function-return semantics."}, + {"id": "BH7", "evidence": "F-1's reachability certificate is incomplete even though its false-precondition and UB links are correct."}, + {"id": "G11", "evidence": "Its PROVED/UNSOUND results necessarily rely on unchecked Result/tuple, println-success, and function-return premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed check is clearly a future repair followed by re-audit, not current evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is not widened, but material Rust semantics needed for current selector success and exhaustiveness are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "No report text evidences access to prohibited evaluation, sibling, oracle, or condition material."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q/U include Rust/Cargo 1.85.1, exact targets, both feature/allocator/debug states, every profile and u8, with only wasm32/arena removed."}, + {"id": "B2", "decision": "FAIL", "evidence": "It calls the partition exhaustive but explicitly lets BUILD.md supply it; Result/VarError exhaustiveness and exact pattern behavior are not verified as Rust semantics."}, + {"id": "B3", "decision": "FAIL", "evidence": "The system rows lack exact match/pattern and implicit-return authority despite showing the intended R,L_s endpoint."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row shows R,L_a success but does not verify exact literal-arm selection or falling-through main return."}, + {"id": "B5", "decision": "FAIL", "evidence": "Its arena-stop prefix/panic outcome is correct, but reaching that literal arm is not established by the cited vague match premise."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode outcomes are listed, but wildcard and tuple-struct pattern semantics are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Covers failed first and every applicable second write, earlier complete R, arbitrary failed-call bytes, panic exits, and exact TCB no-library consequences."}, + {"id": "B8", "decision": "FAIL", "evidence": "Exact TCB use is described, but selector success/exhaustiveness and Rust cfg all/not source selection remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The three rerun failures are right, but the prior-success and arena-stop arm derivations rely on unchecked local Rust semantics."}, + {"id": "B10", "decision": "FAIL", "evidence": "B-03 asserts all(...) and exact rejection without verifying all/key-value cfg semantics or complete B8 mapping."}, + {"id": "B11", "decision": "FAIL", "evidence": "The C/not-C block split is asserted without version-matched all/not and false-cfg semantics, atop incomplete mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "F-01 states four bullets, but supported current-source reachability is not validly established by the report's authorities."}, + {"id": "B13", "decision": "FAIL", "evidence": "S has the intended formula, but its complement proof relies on the incomplete cfg/build reachability chain."}, + {"id": "B14", "decision": "FAIL", "evidence": "S-01's zero panic proof is only conditional on an unproved complementary source selection."}, + {"id": "B15", "decision": "FAIL", "evidence": "POST-01 gives the intended verdict, but B12/B14 are not complete applicable derivations."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued without a valid authoritative reachability link through the accepted raw arena path and cfg body."}, + {"id": "BH7", "evidence": "F-01's current-library/source reachability link is incomplete despite correct zero and UB propositions."}, + {"id": "G11", "evidence": "The report expressly uses BUILD.md to supply a Rust-semantic raw partition and also omits material return/all-not authorities."} + ], + "proposal_laundering": {"present": false, "evidence": "No proposed repair is used to narrow or certify the current artifact; it calls for re-audit."}, + "tcb_authority_defect": {"present": true, "evidence": "It treats BUILD.md as supplying the complete raw semantic partition and leaves other material Rust cfg/return premises unchecked."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no access outside supplied source/policy material and allowed documentation."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C/S/U recover all exact release, target, feature, allocator, profile/debug, and u8 cases with only W/arena excluded."}, + {"id": "B2", "decision": "PASS", "evidence": "Explicitly gives the six disjoint raw classes and verifies Result, VarError, as_str, first-match, literal, tuple, and wildcard exhaustiveness."}, + {"id": "B3", "decision": "FAIL", "evidence": "The R,CS rows assert return success, but no versioned function-body premise establishes implicit normal return after the final println."}, + {"id": "B4", "decision": "FAIL", "evidence": "The R,CA arena row likewise lacks authoritative implicit-return completion despite correct order/output reasoning."}, + {"id": "B5", "decision": "PASS", "evidence": "Shows arena-stop as [R,CA], then explicit panic, unsuccessful exit, and no current library; allocator-write failure is separately distinguished."}, + {"id": "B6", "decision": "PASS", "evidence": "Both other-Unicode and non-Unicode reach explicit panic with exactly prior complete [R], no allocator attempt, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "Enumerates common and all class-specific println failures, prior successful prefixes, arbitrary failed-call bytes, no later steps, and exact TCB rejection."}, + {"id": "B8", "decision": "FAIL", "evidence": "Cargo/cfg composition is otherwise exact, but the only-successful-return premise consumes unverified implicit main-return semantics from B3/B4."}, + {"id": "B9", "decision": "PASS", "evidence": "Conditioning on a prior successful arena build, it proves R preceded CA; the exact TCB then stales arena, forces the arena-stop rerun, and rejects every rerun exit without reuse."}, + {"id": "B10", "decision": "FAIL", "evidence": "The compile_error proof is exact conditionally, but effective build-to-source closure still depends on the incomplete successful-arena B8 derivation."}, + {"id": "B11", "decision": "FAIL", "evidence": "The all/not body proof is exact conditionally, but current supported-source reachability depends on the incomplete B4/B8 success relation."}, + {"id": "B12", "decision": "FAIL", "evidence": "Safe use, false NZ, and zero-UB are authoritative; current-library reachability remains incomplete at the build-script normal-return edge."}, + {"id": "B13", "decision": "FAIL", "evidence": "M/WIT are algebraically exact, but maximality consumes the incomplete supported reachability certificate."}, + {"id": "B14", "decision": "FAIL", "evidence": "The zero-source proof is correct conditionally, but Required-to-current-body coverage is incomplete through B8/B11."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended UNPROVED reasoning is present, but its prerequisite complete B12 and B14 certificates do not hold."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It issues UNSOUND although the current supported library reachability link omits verified implicit-return semantics."}, + {"id": "BH7", "evidence": "F-UB's raw-arena-to-current-library reachability certificate is incomplete at normal main return."}, + {"id": "G11", "evidence": "Its build/source and maximality affirmatives necessarily rely on unchecked function-return semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "F-UB's remediation is future code requiring re-audit, not evidence for this snapshot."}, + "tcb_authority_defect": {"present": true, "evidence": "The exact TCB is carefully bounded, but normal build-script return is a material unverified Rust premise used by positive verdicts."}, + "visible_scope_defect": {"present": false, "evidence": "No prohibited evaluation or sibling material is mentioned or otherwise evidenced."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "R names 1.85.1, all three support targets, both feature/allocator/debug states, every profile/u8, and removes exactly Wasm/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The six raw classes are exhaustive via explicitly verified env::var, Result, VarError, match, tuple/literal/wildcard, and as_str propositions."}, + {"id": "B3", "decision": "FAIL", "evidence": "Absent/system [RERUN,CS] normal return is asserted without verified println success or implicit function-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "Arena [RERUN,CA] normal return lacks verified completed-line and implicit-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "Arena-stop's later panic is right, but successful CA completion is not verified because AX-EXIT covers only println failure."}, + {"id": "B6", "decision": "FAIL", "evidence": "Both rejection classes are partitioned correctly, but the completed RERUN prefix lacks verified successful println output semantics."}, + {"id": "B7", "decision": "FAIL", "evidence": "It handles every failure and arbitrary partial bytes, but the required preceding completed [RERUN] is not supported by a verified successful-println proposition."}, + {"id": "B8", "decision": "FAIL", "evidence": "The TCB and cfg stages are explicit, but the successful/failure local relation remains incomplete through B3-B7."}, + {"id": "B9", "decision": "FAIL", "evidence": "Freshness outcomes are enumerated, but the prior successful [RERUN,CA] trace lacks output/return authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The wasm/arena cfg proof is correct conditionally, but actual effective closure depends on incomplete B8 selector success."}, + {"id": "B11", "decision": "FAIL", "evidence": "AX-CFG proves complementarity conditionally, but supported current-source selection depends on incomplete B4/B8."}, + {"id": "B12", "decision": "FAIL", "evidence": "The zero/NZ/UB links are correct, but current Q-library reachability is incomplete at successful script output/return."}, + {"id": "B13", "decision": "FAIL", "evidence": "Smax and the four cases are exact algebraically, but every-complement UB reachability is not completely established."}, + {"id": "B14", "decision": "FAIL", "evidence": "The checked-body zero proof is correct conditionally, but complete Required-to-body coverage through B8 is absent."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended verdict is stated, but B12/B14 do not provide complete applicable certificates."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "The report issues UNSOUND without a fully verified successful-build reachability link."}, + {"id": "BH7", "evidence": "Its A64/on/arena safe-call certificate is incomplete at println success and normal main return."}, + {"id": "G11", "evidence": "PROVED/UNSOUND conclusions necessarily rely on unchecked successful-println and function-return semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "Repair options are explicitly prospective and do not certify the current implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is bounded correctly, but material successful-output and normal-return Rust premises are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences no inspection of prohibited oracle, evaluator, sibling, or condition material."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C exactly includes Rust/Cargo 1.85.1, all listed target/feature/allocator/profile/debug/u8 cases, and only the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "Verifies env::var, both Result/VarError variants, as_str, match, tuple/literal/wildcard rules and states the exact six-class exhaustive partition."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent and Unicode system are traced R then READ then S then normal main return, with exactly [R,S] and no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena is traced R then READ then A then normal return, with exactly [R,A] and no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "arena-stop yields [R,A] then explicit panic after successful writes and no current compilation under exact BUILD-MAP-ORDERED."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode each leave only completed [R], attempt no allocator line, explicitly panic, and produce no library."}, + {"id": "B7", "decision": "PASS", "evidence": "Covers first-write and every applicable allocator-write failure, prior complete prefixes, no later operation, and no current library without consuming failed bytes."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful system/arena returns feed exact allocator cfgs; admitted feature/target mappings plus verified cfg semantics select source, with TCB scope conspicuous."}, + {"id": "B9", "decision": "PASS", "evidence": "Proves prior arena wrote R before A, present-to-present change stales it, exhaustive rerun failures yield no current or reused library."}, + {"id": "B10", "decision": "PASS", "evidence": "For all feature/profile/debug fibers, wasm32 plus arena retains compile_error and fails; all other pairs remove it, and E is outside C."}, + {"id": "B11", "decision": "PASS", "evidence": "Defines B as the exact three-leaf conjunction and proves the first block versus not(B) checked block are exhaustive and complementary."}, + {"id": "B12", "decision": "PASS", "evidence": "A supported aarch64/burst/arena lane_id(0) safe use reaches new_unchecked(0), falsifies nonzero, invokes the exact zero-UB contract, and yields UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND = C×u8 minus B/zero; proves all included cases sound and every excluded case UB, establishing exact maximality relative to the TCB."}, + {"id": "B14", "decision": "PASS", "evidence": "Every zero case outside B selects the checked body, equality reaches panic before unsafe, covering all target/allocator/feature/profile/debug fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "States whole zero-panic theorem UNPROVED, not CONTRACT-BROKEN/PROVED, because B/zero has UB while every other zero case is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The report treats repair as future implementation followed by re-audit, never as current evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "It identifies exact BUILD-MAP-ORDERED identity/consumers/exclusions and verifies material Rust propositions with applicable versioned authorities."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing indicates inspection beyond the supplied target and exact versioned documentation."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q/L/U include Rust/Cargo 1.85.1, exact targets, both feature/allocator/debug states, every profile/u8, and sole wasm32/arena exclusion."}, + {"id": "B2", "decision": "FAIL", "evidence": "It states exact Result/VarError and literal/wildcard cases, but does not verify match-arm choice or tuple-struct enum-pattern semantics."}, + {"id": "B3", "decision": "FAIL", "evidence": "The [R,S] system returns lack verified match selection and implicit function-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The [R,A] arena return lacks verified match-arm and falling-through-main return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "The complete arena-stop prefix/panic is stated, but exact arm selection is unsupported without match semantics."}, + {"id": "B6", "decision": "FAIL", "evidence": "The R-only rows are stated, but NotUnicode tuple matching and match control are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Defines prefixes as earlier successful complete lines, leaves failed-call bytes unconstrained, and covers every write failure, later-step cutoff, and no-library result."}, + {"id": "B8", "decision": "FAIL", "evidence": "The Cargo mapping is exact conditionally, but upstream selector partition/success traces lack match and return authority."}, + {"id": "B9", "decision": "FAIL", "evidence": "The stale sequence is complete textually, but the successful arena and arena-stop source paths are not validly established."}, + {"id": "B10", "decision": "FAIL", "evidence": "The compile_error argument is correct conditionally, but effective current-build mapping remains incomplete through B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "Cfg all/not semantics are supplied, but the supported current-source partition depends on incomplete B4/B8 reachability."}, + {"id": "B12", "decision": "FAIL", "evidence": "Zero falsity and UB are authoritative, but the safe call's current-library reachability is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M has the exact intended set shape, but inclusion/maximality also use unverified if/comparison behavior and incomplete reachability."}, + {"id": "B14", "decision": "FAIL", "evidence": "It asserts zero enters the checked panic without verifying Rust if/comparison semantics or complete build-to-body coverage."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED is stated, but its UB and regional-panic prerequisite proofs are incomplete."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It reports UNSOUND without a valid authoritative match/return-supported current-library reachability link."}, + {"id": "BH7", "evidence": "The stated aarch64/burst/arena certificate is incomplete at build-path and source reachability."}, + {"id": "G11", "evidence": "Its affirmative conclusions necessarily rely on unchecked match, tuple-pattern, function-return, and if/comparison semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed repair is prospective and accompanied by a re-audit requirement."}, + "tcb_authority_defect": {"present": true, "evidence": "The Cargo TCB is bounded, but several material Rust control-flow and pattern premises are absent from its authority log."}, + "visible_scope_defect": {"present": false, "evidence": "No report evidence shows access to prohibited evaluation or sibling artifacts."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C/U recover all exact release, target, feature, allocator, profile/debug, and u8 cases and remove only wasm32/arena."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six classes are stated, but Result/VarError exact variants and literal/wildcard/tuple-pattern propositions are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "System-success rows lack verified pattern selection, successful println output, and implicit return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "Arena success asserts CFG(arena) and return without verified literal-pattern, completed-line, or function-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "arena-stop's complete line then panic is stated, but literal-arm reachability and successful-line semantics are unverified."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode R-only rejections lack verified wildcard/tuple patterns and successful stdout-line effect."}, + {"id": "B7", "decision": "FAIL", "evidence": "It models failed-call byte prefixes and all sites, but the preceding complete RERUN relies on uncited println-success semantics."}, + {"id": "B8", "decision": "FAIL", "evidence": "BUILD-MAP use is narrow, but successful raw traces and exact Rust all/not cfg source mapping remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness outcomes are correct textually, but prerequisite successful-arena and arena-stop local traces lack full authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The exclusion asserts all truth/falsehood without verifying Rust all/key-value semantics and depends on incomplete B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "H/not-H selection is asserted without version-matched all/not and false-cfg authority or complete mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "BAD has the right safe-zero and UB facts, but current-body reachability rests on incomplete build/cfg derivations."}, + {"id": "B13", "decision": "FAIL", "evidence": "SOUND is algebraically right, but its positive and excluded-case proofs rely on unverified cfg and if/comparison behavior."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-H zero panic assertion has no verified if/equality semantics and lacks complete Required-to-body mapping."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended verdict is present, but B12/B14 do not supply complete applicable certificates."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued while the current-source reachability link lacks verified pattern, output, return, and cfg semantics."}, + {"id": "BH7", "evidence": "BAD's reachability chain is incomplete despite correct safe-use, false-precondition, and UB assertions."}, + {"id": "G11", "evidence": "PROVED/UNSOUND claims necessarily rely on unchecked Result/pattern, println-success, function-return, all/not, and if/comparison premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly a future change requiring re-audit and does not support a current positive verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED remains narrow, but numerous material Rust semantic premises are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of prohibited oracle, condition, sibling, or evaluator access."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "The frozen rules do not define how much quotation is required for a proposition correctly paraphrased beside an exact versioned URL. I credited explicit, accurate paraphrases tied to the applicable page, but not a bare page identity or a citation that states only a different clause.", + "The atom dependency lists do not explicitly prescribe mechanical failure propagation. I evaluated later atoms on whether their needed dependency propositions were actually established; an earlier atom failing only an unrelated clause did not automatically force failure.", + "B7 says failed-call byte details are not required. I treated E's empty/list prefixes as lists of earlier successfully completed directives, not as an assertion that a failing write emitted zero bytes." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/raw-scores/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/raw-scores/s2.json new file mode 100644 index 0000000000..258e9aca47 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/raw-scores/s2.json @@ -0,0 +1,258 @@ +{ + "schema_version": 1, + "mode": "B", + "scorer_id": "s2", + "reports": [ + { + "label": "C", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain section fixes Rust/Cargo 1.85.1 and all target, burst, allocator, profile, debug, and u8 cases, excluding only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered-relation table explicitly calls omitted, system, arena, arena-stop, other Unicode, and non-Unicode exhaustive."}, + {"id": "B3", "decision": "PASS", "evidence": "Its first two table rows give R then READ then the system line and normal return when both writes succeed, with no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R then READ then the arena line and normal return on successful writes, with no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "The arena-stop row gives completed R,A followed by explicit panic and states that BUILD-MAP-ORDERED produces no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other-Unicode and non-Unicode rows leave only R, panic before any allocator attempt, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It treats failed R before READ and failed system/arena writes after completed R, permits incomplete bytes, and assigns every failure no library."}, + {"id": "B8", "decision": "PASS", "evidence": "It limits cfg consumption to successful selector returns, names exact allocator, feature, and target mappings, applies Rust cfg rules, and conspicuously qualifies BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness challenge derives prior R,A, present-to-present arena-stop invalidation, rerun, exhaustive failed exits, and no stale result."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32 plus arena retains compile_error! for either feature and all profile/debug fibers, while that pair has no API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines Q as exactly aarch64/burst-on/arena and proves the two cfg bodies are the exhaustive disjoint Q and not-Q selections."}, + {"id": "B12", "decision": "PASS", "evidence": "It gives a supported safe lane_id(0) in Q, reaches new_unchecked(0), falsifies nonzero, applies the 1.85.1 UB contract, and says UNSOUND relative to BUILD-MAP-ORDERED."}, + {"id": "B13", "decision": "PASS", "evidence": "It states M = C×U minus Q/zero, proves checked and Q/nonzero sufficiency, and proves every excluded Q/zero point has UB, establishing exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every zero-input not-Q case takes the checked branch and panics before unsafe code, parametrically over profiles and debug assertions."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately reports the whole zero-panic postcondition UNPROVED, not CONTRACT-BROKEN, because Q/zero has UB while all other zero cases are proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "Repairs are explicitly future changes requiring re-audit and are not used to certify the current snapshot."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is identified and narrowly consumed only for its accepted Cargo/freshness/status mappings; Rust premises use versioned official authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied snapshot and explicitly disclaims builds, tests, prior audits, and out-of-scope binary/backend evidence."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The exact-domain section fixes 1.85.1 and defines L×U over all targets, burst states, allocators, profiles, debug states, and u8, subtracting only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "Step 2 proves the exact absent, three named Unicode, other-Unicode, and non-Unicode partition from Result, VarError, as_str, literals, and wildcard."}, + {"id": "B3", "decision": "PASS", "evidence": "Step 3 gives omitted/system as R,S then successful return when both writes succeed, and exactly the system cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "Step 3 gives Unicode arena as R,A then successful return on successful writes, and exactly the arena cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Step 4 gives arena-stop either allocator-write failure after R or completed R,A followed by explicit panic, with no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Step 4 gives other Unicode and non-Unicode explicit panic after R, no allocator line, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "Steps 1, 3, and 4 cover first and every second-write failure, preserve only earlier complete lines, allow failed-call bytes, and assign no library."}, + {"id": "B8", "decision": "PASS", "evidence": "Step 5 restricts downstream consumption to successful R,S/R,A, then maps exact allocator, burst, target cfgs, and Rust-selected source under qualified BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "Its freshness proof uses the prior R,A run, arena-to-arena-stop staleness, forced rerun, three failed outcomes, and prohibition on prior-artifact reuse."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves the wasm32/arena predicate retains compile_error! independently of burst, profile, and debug assertions and excludes that pair from L and the witness."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines C as exactly aarch64/burst-on/arena and proves cfg selects the immediate unchecked block there and the complementary checked block elsewhere."}, + {"id": "B12", "decision": "PASS", "evidence": "The opening certificate gives supported safe lane_id(0), selected unchecked reachability, false nonzero condition, exact zero-UB consequence, and an UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "M excludes exactly C/zero; the report proves every included checked or nonzero case sound and every complement fiber UB, hence exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves zero enters the checked branch and panics before unsafe code for every supported not-C configuration, with profile/debug fibers covered."}, + {"id": "B15", "decision": "PASS", "evidence": "It states the global panic promise is UNPROVED rather than CONTRACT-BROKEN or PROVED because the only uncovered zero executions contain UB."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The suggested repairs are not implemented or used as evidence for any current-snapshot verdict."}, + "tcb_authority_defect": {"present": false, "evidence": "The report names BUILD-MAP-ORDERED exactly, confines its consumers, and separately supports Rust semantics with versioned Reference/std authority."}, + "visible_scope_defect": {"present": false, "evidence": "It describes only the supplied files and expressly says no build, run, expansion, modification, prior material, or tool evidence was used."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Required is defined as Rust/Cargo 1.85.1, C×all u8, with all T×B×A×P×D fibers and exactly the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "BUILD-1 explicitly proves absent, system, arena, arena-stop, other Unicode, and non-Unicode are the exhaustive raw classes."}, + {"id": "B3", "decision": "PASS", "evidence": "The table gives omitted/system successful R,S and normal return, with exactly system selected and no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "The table gives Unicode arena successful R,A and normal return, with exactly arena selected and no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop with successful writes leaves R,A and explicitly panics; the same row and TCB qualification say no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave R, panic before an allocator print, and have no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "The table covers first-write and every class-specific second-write failure, models arbitrary failed-call fragment q, and gives no library on all failures."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selector rows feed exact allocator cfgs; BUILD-1 and the projection apply admitted feature/target mappings and Rust cfg selection with explicit TCB boundaries."}, + {"id": "B9", "decision": "PASS", "evidence": "BUILD-2 derives prior R,A, present-to-present invalidation, mandatory rerun, all three failed outcomes, and no current or stale arena library."}, + {"id": "B10", "decision": "PASS", "evidence": "CFG-1 proves wasm32/arena includes compile_error! for both feature states and all profile/debug fibers and yields no supported library."}, + {"id": "B11", "decision": "PASS", "evidence": "The source projection and U definition prove the unchecked body exactly for aarch64/burst-on/arena and the checked complementary body everywhere else."}, + {"id": "B12", "decision": "PASS", "evidence": "SOUND-1 supplies a supported safe zero call, exact selected reachability, false nonzero precondition, documented UB, and whole-domain UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "S is not-U or nonzero; the positive proof covers every member and SOUND-1 applies to every omitted U/zero fiber, proving exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "The panic section proves every supported not-U zero input executes panic before unsafe, with the domain proof retaining all profiles and debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "It gives the full panic theorem UNPROVED, not CONTRACT-BROKEN, because U/zero is UB while every other zero case is regionally proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The minimum repair is presented only as future remediation followed by re-audit, not as current evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is conspicuously limited to its exact accepted build propositions, while material Rust leaves cite 1.85.1 authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report says it used the supplied crate/policies only and no build, test, prior audit, dependency, generated material, or tool result."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "It defines S×U from Rust/Cargo 1.85.1 and the full target, feature, allocator, profile, debug, and u8 product, removing only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered table and preceding Result/VarError proof explicitly exhaust omitted, system, arena, arena-stop, other Unicode, and non-Unicode."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted and Unicode system rows give R,CS then normal success if both writes succeed, with no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R,CA then normal success if both writes succeed, with no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "The arena-stop row gives completed R,CA then explicit panic, or prior R on write failure, and TCB-ORDERED supplies no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode rows give completed R, no allocator attempt, explicit panic, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It enumerates common line 4 and class-specific lines 8, 12, 15, 18 failures, allows arbitrary partial bytes, and rejects every exit."}, + {"id": "B8", "decision": "PASS", "evidence": "Exactly the accepted successful classes feed current allocator cfgs; the report then applies admitted burst/target leaves and Rust cfg semantics under an explicit TCB alias."}, + {"id": "B9", "decision": "PASS", "evidence": "The same-directory proof derives prior R,CA, arena-stop staleness, rerun, all write/panic exits, and no reuse of the old library."}, + {"id": "B10", "decision": "PASS", "evidence": "The exact-exclusion section proves both directions of wasm32/arena compile_error! rejection for every feature/profile/debug fiber and no API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines K exactly as aarch64/burst-on/arena and proves the first and not-all blocks select K and its complement over all P×D."}, + {"id": "B12", "decision": "PASS", "evidence": "F-UB gives a supported safe lane_id(0), K reachability, false NZ, exact new_unchecked zero UB, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "M removes exactly WIT=K/zero; all M cases discharge NZ or panic, and each complement point has UB, proving equality and maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "The report proves every not-K zero case executes the equality branch and panic before unsafe across the supported configuration fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "It reports the universal panic contract UNPROVED, not CONTRACT-BROKEN or PROVED, because K/zero has UB and the complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed checked-constructor repair is clearly future work and does not alter the current UNSOUND/UNPROVED judgments."}, + "tcb_authority_defect": {"present": false, "evidence": "TCB-ORDERED is explicitly defined as the exact BUILD-MAP-ORDERED entry and is not widened; Rust claims use versioned official sources."}, + "visible_scope_defect": {"present": false, "evidence": "It confines the audit to supplied files and expressly excludes builds, tests, prior audits, external dependencies, backend, and binary evidence."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Its normalization gives exactly all 1.85.1 T×F×A×P×D×u8 cases except wasm32/arena, with both policy containments explicit."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered relation exhausts absent, system, arena, arena-stop, every other Unicode string, and non-Unicode using exact Result/VarError and match facts."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent and Unicode system attempt R then S and, on both successful writes, return normally with exactly system and no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena attempts R then A and, on both successful writes, returns normally with exactly arena and no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop either fails its A write after R or completes R,A then explicitly panics; the report states no current compilation follows."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode explicitly panic after R, attempt no allocator line, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers R failure before READ and every second-write failure after R, counts only complete earlier lines, and gives every failure no library."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selector runs supply exactly one allocator cfg; the report applies exact admitted feature/target cfgs and checked Rust selection without widening BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness paragraph derives prior R,A, arena-stop staleness and rerun, all three unsuccessful outcomes, and no current or earlier arena artifact."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena makes all(...) true and compile_error! fail for both feature states and all P,D, while every other tuple removes the item."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines B exactly as aarch64/burst-on/arena and proves the source cfg predicates are B and not-B, selecting exactly one corresponding body."}, + {"id": "B12", "decision": "PASS", "evidence": "The certificate chooses supported aarch64/burst-on/arena lane_id(0), reaches the unchecked call, falsifies NZ, applies exact UB text, and declares UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND excludes exactly B/zero; all included cases are proved safe or panic before unsafe, and every complement point has UB, establishing unique maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It states the exact proved panic region is every supported not-B zero case and derives equality, if, and panic before unsafe across all P,D."}, + {"id": "B15", "decision": "PASS", "evidence": "The report separately says the full postcondition is UNPROVED, not CONTRACT-BROKEN, because B/zero has UB while the exact complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "F-1's proposed repair is not implemented or used to narrow or certify the current artifact."}, + "tcb_authority_defect": {"present": false, "evidence": "It records the exact accepted BUILD-MAP-ORDERED identity and consumers, explicitly denies widening, and checks Rust leaves against 1.85.1 authority."}, + "visible_scope_defect": {"present": false, "evidence": "It identifies the supplied snapshot and says no build, execution, expansion, test, tool evidence, or additional assumptions were used."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain R and surrounding prose fix 1.85.1 and the full T×burst×allocator×P×D×u8 product, subtracting all wasm32/arena fibers only."}, + {"id": "B2", "decision": "PASS", "evidence": "The complete relation expressly exhausts absent, system, arena, arena-stop, all other Unicode, and non-Unicode via Result/VarError and pattern semantics."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent/system success is exactly RERUN,CS then normal return and the system cfg; no arena line is present."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena success is exactly RERUN,CA then normal return and the arena cfg; no system line is present."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop with successful writes leaves RERUN,CA then explicit panic, and the report states the completed selector cannot produce a current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave only RERUN, explicitly panic without allocator output, and produce no library."}, + {"id": "B7", "decision": "PASS", "evidence": "It models partial(L), covers first-write and every second-write failure, preserves only earlier complete RERUN, and rejects every failed execution."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful RERUN,CS/CA is consumed; exact allocator, burst, and target cfgs then select source under conspicuously bounded BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness witness derives prior RERUN,CA, present-value change, forced rerun, three unsuccessful cases, and no stale/current arena result."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena alone activates compile_error! independent of burst, profile, and debug assertions, with no library or witness from that pair."}, + {"id": "B11", "decision": "PASS", "evidence": "The source closure defines F exactly as aarch64/burst-on/arena and selects only the unchecked body there and only the checked body elsewhere."}, + {"id": "B12", "decision": "PASS", "evidence": "It supplies supported A64/burst-on/arena lane_id(0), safe-use validity, selected reachability, false NZ, authoritative zero UB, and UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "Smax is not-F or nonzero; three included cases prove soundness and F/zero proves every complement point UB, establishing maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-F zero case takes the equality branch and panics before unsafe, with all P×D fibers retained."}, + {"id": "B15", "decision": "PASS", "evidence": "It reports the global zero-panic theorem UNPROVED rather than CONTRACT-BROKEN because only UB cases remain after the proved not-F region."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The minimum repair is future remediation and is not used as support for the current artifact's verdicts."}, + "tcb_authority_defect": {"present": false, "evidence": "The exact BUILD-MAP-ORDERED entry and its narrow consumers are recorded; Cargo is not used as Rust authority and Rust claims cite 1.85.1 sources."}, + "visible_scope_defect": {"present": false, "evidence": "It states that only the supplied snapshot was audited and that no build, execution, expansion, test, prior audit, or external result was used."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain section fixes exact 1.85.1 C0×u8, every target, burst, allocator, profile, and debug fiber, with only wasm32/arena removed."}, + {"id": "B2", "decision": "PASS", "evidence": "The build section calls absent, system, arena, arena-stop, other Unicode including empty, and non-Unicode an exact exhaustive partition."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent/system successful writes give exactly R,Sline and normal return, selecting system only."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena successful writes give exactly R,Aline and normal return, selecting arena only."}, + {"id": "B5", "decision": "PASS", "evidence": "Successful arena-stop writes completed R,Aline then explicitly panics, and BUILD-MAP-ORDERED is used to derive no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode panic with completed R before any allocator attempt and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers failed R before READ and all second-write failures after R, permits an arbitrary fragment q, and assigns no source effect or library."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selectors supply exact allocator cfgs; admitted burst/target leaves and Rust cfg then select source under explicit BUILD-MAP-ORDERED limits."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness certificate derives prior completed R, arena-stop invalidation, rerun, all failed outcomes, and no old library as current."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena exactly retains compile_error! for both feature states and every profile/debug fiber and is rejected before any API use."}, + {"id": "B11", "decision": "PASS", "evidence": "K is exactly aarch64/burst-on/arena; cfg semantics are used to prove the first body on K and the complementary checked body on not-K."}, + {"id": "B12", "decision": "PASS", "evidence": "F-1 gives a supported successful arena build and safe lane_id(0), reaches new_unchecked(0), falsifies its contract, applies UB, and says UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "M is not-K or nonzero; the report proves each included case safe and every omitted K/zero point UB, so the region is exact and maximal."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-K zero execution takes the check and panics before unsafe, parametrically over profiles and debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately concludes the whole panic postcondition is UNPROVED, not CONTRACT-BROKEN, because K/zero is UB and not-K is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly prospective and no design change is used to affect the current-snapshot verdicts."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is accepted only at its stated identity and consumers; Cargo pages are corroboration only and Rust premises use versioned authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied files and expressly says no prior audit, test, dependency, tool result, generated source, or backend evidence was used."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Supported fixes Rust/Cargo 1.85.1 and all T×B×A×P×D×V cases, with V all u8 and only wasm32/arena excluded."}, + {"id": "B2", "decision": "PASS", "evidence": "The relation explicitly says its omitted, system, arena, arena-stop, other Unicode, and non-Unicode rows are all raw classes."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted/system rows give R,S and normal success when both writes succeed, with system as the exact mapping and no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R,A and normal success when both writes succeed, with arena as the exact mapping and no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop gives completed R,A then explicit panic when writes succeed and is explicitly excluded from any successful current execution/library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other-Unicode and non-Unicode give completed R, explicit panic, no allocator attempt, and no current library under the accepted premise."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers failed R before classification and each allocator-write failure after R, allows incomplete failing bytes, and gives every failed exit no library."}, + {"id": "B8", "decision": "PASS", "evidence": "The successful mapping is limited to accepted returns; exact allocator, burst, and target cfgs feed Rust source selection with BUILD-MAP-ORDERED conspicuously bounded."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness proof derives prior R,A, present-to-present arena-stop invalidation, rerun, every failed outcome, and no prefix or old artifact as current."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves successful wasm32/arena sets both cfg leaves, retains compile_error! for all feature/profile/debug cases, and yields no library."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines C exactly as aarch64/burst-on/arena and proves the cfg blocks form an exhaustive complementary C/not-C source partition."}, + {"id": "B12", "decision": "PASS", "evidence": "It gives supported safe zero use in C, exact unchecked reachability, false nonzero proposition, versioned zero-UB consequence, and whole-domain UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "M is Supported×V with C/zero removed; the report proves all M cases safe and all excluded points UB, hence both containment and exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every not-C zero call takes the equality branch and panics before the unsafe call across all profile/debug fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "It says the whole panic promise is UNPROVED, not CONTRACT-BROKEN, because C/zero contains UB while not-C/zero is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The suggested validation change is clearly a future repair and is not used to certify the current source."}, + "tcb_authority_defect": {"present": false, "evidence": "The report identifies BUILD-MAP-ORDERED and restricts it to exact accepted Cargo/status/freshness leaves; Rust claims use 1.85.1 official sources."}, + "visible_scope_defect": {"present": false, "evidence": "It describes the complete supplied snapshot and explicitly disclaims dependencies, generated files, tool results, builds, tests, and prior audits."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q and U cover exact Rust/Cargo 1.85.1 T×F×A×P×D×u8, subtracting every wasm32/arena feature/profile/debug fiber and no other case."}, + {"id": "B2", "decision": "PASS", "evidence": "B-01 explicitly labels omitted, system, arena, arena-stop, every other Unicode, and non-Unicode as the exhaustive remaining relation."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted/system successful R,L_s writes end in normal return and exactly system; no arena selector occurs."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena successful R,L_a writes end in normal return and exactly arena; no system selector occurs."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop completes R,L_a then explicitly panics when writes succeed, and both its exits are assigned no current result."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave R, panic before any selector attempt, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It quantifies arbitrary failed-write bytes p(X), covers first and every applicable second write, preserves only prior R, and rejects all failures."}, + {"id": "B8", "decision": "PASS", "evidence": "Only normal accepted exits supply the exact current allocator cfg; admitted feature/target mappings and Rust cfg select source under explicit BUILD-MAP-ORDERED limits."}, + {"id": "B9", "decision": "PASS", "evidence": "B-02 derives prior successful R,L_a, present arena-stop staleness, forced rerun, three failed outcomes, and no stale/current library."}, + {"id": "B10", "decision": "PASS", "evidence": "B-03 proves every wasm32/arena fiber retains compile_error! and fails compilation, while this pair is outside Q and no API is produced."}, + {"id": "B11", "decision": "PASS", "evidence": "B-03 defines C exactly as aarch64/burst-on/arena and states cfg selects only the immediate unchecked body on C and only the checked body on not-C."}, + {"id": "B12", "decision": "PASS", "evidence": "F-01 gives a supported safe lane_id(0), C reachability, false nonzero requirement, exact standard-library UB, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "S is not-C or nonzero; S-01/S-02 prove every included case sound and every excluded C/zero case UB, establishing exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "S-01 proves every supported not-C zero input executes panic before unsafe and explicitly covers all profile/debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "POST-01 declares the universal panic theorem UNPROVED rather than CONTRACT-BROKEN, because C/zero has UB and the complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "F-01's code repair is only a recommendation followed by re-audit, never evidence for present soundness or postconditions."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is named, scoped to its exact accepted Cargo propositions and consumers, and not substituted for cited Rust 1.85.1 semantics."}, + "visible_scope_defect": {"present": false, "evidence": "The report limits itself to supplied files and says no build, execution, test, expansion, dependency, tool result, or extra premise was used."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain fixes Rust/Cargo 1.85.1 and C×U over all T×B×A×P×D and u8, with exactly the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "It explicitly defines the disjoint exhaustive raw set as absent, three named Unicode values, other Unicode, and non-Unicode."}, + {"id": "B3", "decision": "PASS", "evidence": "The table and failure prose give absent/system as successful RERUN then READ then CFG(system) then return, with no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "They give Unicode arena as successful RERUN then READ then CFG(arena) then return, with no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop completes RERUN,CFG(arena) then explicitly panics when writes succeed, and BUILD-MAP-ORDERED makes the prefix inert with no library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave RERUN, attempt no allocator write, explicitly panic, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers first-write failure before READ and each later CFG failure after RERUN, permits byte prefixes, and assigns no library to every failed exit."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful current CFG(a) reaches compilation; exact admitted allocator, feature, and target mappings feed Rust cfg source selection under qualified BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness witness derives prior RERUN,CFG(arena), registered present-value change, mandatory rerun, exhaustive failed exits, and no stale artifact."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena makes the compile_error! cfg true regardless of burst and rejects all such current compilations, with no excluded API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines H exactly as aarch64/burst-on/arena and states admitted mappings plus all/not cfg semantics select the first body on H and the checked complement otherwise."}, + {"id": "B12", "decision": "PASS", "evidence": "BAD supplies supported safe lane_id(0), H-selected reachability, false nonzero condition, exact zero-UB consequence, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND removes exactly H/zero; the positive bullets cover every member and BAD applies to every complement profile/debug fiber, proving maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-H zero input executes the check and panic before the unsafe call, with profiles and debug states retained."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately reports the full panic postcondition UNPROVED, not CONTRACT-BROKEN, because H/zero has UB while all not-H zero cases are proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The recommended dominating check is prospective remediation and is not used to certify or narrow current obligations."}, + "tcb_authority_defect": {"present": false, "evidence": "The TCB log names BUILD-MAP-ORDERED, exact identity and consumers, denies widening, and uses official versioned Rust pages for semantic premises."}, + "visible_scope_defect": {"present": false, "evidence": "It confines the audit to the supplied manifest, policies, TCB, build script, and library and disclaims tests, prior audits, generated files, and tool results."}, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/A.md new file mode 100644 index 0000000000..4a7e4846af --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/A.md @@ -0,0 +1,194 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits the complete supplied crate snapshot: `Cargo.toml`, `build.rs`, +`src/lib.rs`, and `BUILD.md`, `SUPPORT.md`, and `TCB.md`. The theorem is +source-level Rust 1.85.1/edition 2021 freedom from undefined behavior for every +well-typed safe call to `lane_id`, plus the requested build/rejection and panic +contracts. It is relative only to accepted entry `BUILD-MAP-ORDERED`; no +backend or binary correctness is claimed. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {burst off, burst on}`, `A = {system, arena}`; +- `P` be every Cargo profile, `D = {debug assertions off, on}`, and + `V = {0,...,255}` (the complete `u8` domain); +- `Supported(t,b,a,p,d) := t in T && b in B && a in A && p in P && d in D + && !(t=wasm32-unknown-unknown && a=arena)`; and +- `C(t,b,a) := t=aarch64-unknown-linux-gnu && b=burst-on && a=arena`. + +`SUPPORT.md` states exactly the product above and exactly its wasm/arena +exclusion. `Cargo.toml` fixes Rust 1.85.1, edition 2021, the empty/default or +enabled `burst` feature, and this build script/library. `BUILD.md` makes the +allocator a generated cfg from an accepted raw selector. These sources agree; +normalizing their conjunction gives `Supported` in both directions. Rejected +raw values are required build-interface cases, not extra library +configurations. Profiles and debug assertions do not occur in either library +cfg predicate or in its value test, so the proofs below are parametric in +`p,d`. There are no dependencies or other generated files. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered raw-selector/build relation, including freshness | **PROVED**, relative to `BUILD-MAP-ORDERED` | Complete path partition below | +| Required wasm32/arena exclusion | **PROVED** | `cfg` plus `compile_error!` proof below | +| Safe-API soundness over `Supported x V` | **UNSOUND** | Every `C && value=0` safe call reaches documented UB | +| Soundness on `M := {(q,value): Supported(q) && (!C(q) || value!=0)}` | **PROVED** | Exhaustive cfg/input partition below | +| “Panics when `value` is zero” over all `Supported` | **UNPROVED**, not `CONTRACT-BROKEN` | Proved for `!C`; the only remaining executions have UB, so they cannot be postcondition counterexamples | + +Thus the combined full-domain result is **UNSOUND** for soundness and +**UNPROVED** for the documented panic postcondition. + +## Exact ordered build relation + +Write `R` for the complete line +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, `S` for +`cargo::rustc-cfg=fixture_allocator="system"`, and `A` for the analogous +`"arena"` line. + +The function body executes its statements in order. First it attempts `R`. +If that write fails, `println!` panics: for every raw environment class the +script exits unsuccessfully before reading/classifying the variable, with no +successfully written complete directive guaranteed (an incomplete byte prefix +of the failing line is immaterial). If `R` succeeds, the complete relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Classification and next action | Complete emitted prefix and exit | +|---|---|---| +| omitted | `Err(NotPresent)`; attempt `S` | `R,S`, normal success if the write succeeds; otherwise `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `system` | `Ok`; `as_str`; `"system"` arm; attempt `S` | same two outcomes as omitted | +| Unicode `arena` | `Ok`; `"arena"` arm; attempt `A` | `R,A`, normal success; or `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `arena-stop` | `Ok`; matching arm; attempt `A`, then explicit `panic!` | if write succeeds: `R,A`, explicit panic; if it fails: `R` and `println!` panic before the explicit panic | +| every other Unicode value | `Ok`; wildcard arm | `R`, explicit panic; no allocator write attempted | +| every non-Unicode value | `Err(NotUnicode(_))` | `R`, explicit panic; no allocator write attempted | + +These are all raw classes, both stdout sites, all successful paths, all +explicit rejections, and all material complete prefixes. The successful +mapping is exactly `omitted|system -> system` and `arena -> arena`. The +`arena-stop` emitted allocator line never belongs to a successful execution. + +The accepted `BUILD-MAP-ORDERED` premise is consumed only as follows: a +successfully written current `R` makes any later raw-value change stale; a +successfully written allocator line is passed as that exact cfg only when the +current script succeeds; current success receives no retained old selector; +any write panic or explicit panic is an unsuccessful process and yields no +current library; Cargo does not substitute an old library after a stale failed +build; and `burst`/the three target triples set the exact named cfgs. Emitted +text and ordering above are proved from source, not assumed by that entry. + +Consequently, after a successful `arena` build, `R` necessarily was written. +Changing the same target directory to present value `arena-stop` is the +entry's present-to-present change: Cargo reruns before selecting a library. +The rerun fails at `R`, at `A`, or after successful `A`; every case is +unsuccessful, and neither its prefix nor the prior arena artifact is a result +of the current build. The freshness canary is therefore **PROVED**. + +## Version-matched Rust axioms + +The following are the material Rust 1.85.1 propositions; Cargo behavior above +comes only from the separately accepted project TCB entry. + +- [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says: + “Returns an `Err` if the variable is not present, or if it is not valid + Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + distinguishes `NotPresent` from `NotUnicode(OsString)`. +- [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” The + [match-expression rule](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + says: “The first arm with a matching pattern is chosen as the branch target + of the match.” [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + match the literal's value; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” +- [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially execute their component non-item declaration statements.” + [`println!` failure](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +- A [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + includes its attached form iff its predicate is true; if false, “the thing + is removed from the source code.” [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” +- The [`if` rule](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes the consequent when its Boolean condition is true; the + [comparison rule](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + makes `==` a value equality test. The [`u8` page](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + records `MIN = 0` and `MAX = 255`. +- Most importantly, [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + states: “This results in undefined behavior if the value is zero.” Its + Safety clause is: “The value must not be zero.” + +## Configuration exclusion and selected source + +On target `wasm32-unknown-unknown` after a successful arena selector, +`BUILD-MAP-ORDERED` supplies `target_arch="wasm32"` and exactly +`fixture_allocator="arena"`. Both operands of the source `all(...)` are true, +so the `compile_error!` item is included and compilation fails. This is +independent of `burst`, profile, and debug assertions. Hence the excluded pair +cannot produce a current library. For system on wasm32, and for either +allocator on the two other targets, that predicate is false and this error item +is removed. The project's sole exclusion is exactly enforced. + +## API, obligations, and maximal sound region + +The only language-reachable crate API is safe free function +`pub fn lane_id(u8) -> NonZeroU8`. There are no public fields, crate-owned +representation, traits/impls, methods, statics, macros, reexports, hidden +items, callbacks, or FFI. There is no persistent invariant; each unsafe call +locally consumes the sole obligation `value != 0`. + +The two complementary cfg blocks form an exhaustive partition: + +1. If `C`, the first block is included and the `not(all(...))` block removed. + Every input immediately reaches `new_unchecked(value)`. For `value in + 1..=255`, its sole safety precondition holds. For `value=0`, it is false and + the cited standard-library contract entails UB. +2. If `!C`, the first block is removed and the second included. At `value=0`, + equality is true and `panic!` executes before the unsafe call. At every + `value in 1..=255`, that branch is not taken and the exact same value reaches + `new_unchecked`, satisfying its safety clause. + +This proves every point of +`M = Supported x V intersect (!C or value!=0)`. Conversely, +`(Supported x V) \ M` is exactly `C && value=0`, for every profile and debug +assertion state. Calling this public safe function with zero is a valid +well-typed in-scope use; cfg selection reaches the unsafe call; its required +proposition is false; and the version-matched contract states the UB +consequence. Every omitted point is therefore unsound, proving both the +full-domain **UNSOUND** certificate and the exact maximality of `M`. + +For the documented postcondition, every `!C,value=0` execution reaches +`panic!`, so that region is proved. At `C,value=0` the whole execution has UB. +It cannot be a `CONTRACT-BROKEN` witness, which must be UB-free; absent an +independent UB-free witness, the full postcondition is **UNPROVED**. + +## Finding and proof-artifact quality + +**F-1 (critical, UNSOUND).** The special-path comment, “Burst-mode lane +identifiers are never zero,” is not derived from a check, type, invariant, or +unsafe caller contract. `value` is an unrestricted public `u8`, so zero is a +counterexample. The minimum repair is to validate zero on that path (or remove +the specialization and use the already checked path), then replace the comment +with a proof citing that dominating check and exact value. Changing prose alone +cannot repair the safe API. The ordinary-path comment correctly identifies the +dominating zero branch, though the derivation above supplies its complete +versioned contract basis. Any code repair is a new snapshot requiring re-audit. + +## TCB, residual scope, and triggers + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, accepted +for Cargo 1.85.1 and only its stated freshness, process-status, feature, target, +and cfg propositions. Its exclusions (emitted source text/order, Rust +semantics, source correctness, backend, binary) were not widened. No other +assumption, dependency, tool result, test, build, or prior audit was consumed. + +Excluded from the theorem are manual `rustc`, invented cfgs, build-script +override, unsupported targets, and binary/backend correctness. Re-audit is +required for any source/policy/manifest change; Cargo/Rust or documentation +change; target, feature, allocator, profile, or environment-interface change; +generated-cfg/build-order change; or altered TCB disposition. + +**Final attestation:** every source/API/build/configuration/postcondition +obligation has a disposition; `Required` and `M` are symbolic and closed; the +unsoundness witness is complete; no testing or absence-of-counterexample claim +is used. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/B.md new file mode 100644 index 0000000000..c17b23805f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/B.md @@ -0,0 +1,84 @@ +# Unsafe-code audit: supplied ordered-build crate + +## Claims, snapshot, and verdicts + +Audit cutoff: 2026-08-01. The audited identity is the complete supplied snapshot: `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`; Rust/Cargo/stdlib are exactly 1.85.1, edition 2021. There are no dependencies or generated files. No build, execution, expansion, or test evidence was used. + +Let `T={X86,A64,Wasm}` denote the three triples in `SUPPORT.md`; `B={off,on}` the `burst` cfg state; `A={system,arena}`; `P` every Cargo profile; and `D={debug_assertions off,on}`. The exact supported library domain is + +`R = {1.85.1} × T × B × A × P × D \ {(1.85.1,Wasm,b,arena,p,d)}`. + +The allocator coordinate must arise from a successful current build-script run: raw absent or `system` maps to `system`, and raw `arena` maps to `arena`. Rejected raw values and write-failing executions are part of the audited build interface but create no library configuration. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered selector, rejection, freshness, and wasm/arena exclusion | **PROVED**, relative to `BUILD-MAP-ORDERED` | Exhaustive relation and exclusion proof below | +| Build script and `lane_id` are UB-free for every current library in `R` and every `u8` input | **UNSOUND** | Supported `A64,on,arena,p,d`, input `0`, reaches `new_unchecked(0)` | +| “Panics when `value` is zero” for every `c in R` | **UNPROVED** | Proved when `F(c)` is false; the remaining executions contain UB, so they cannot certify a defined contract refutation | + +Here `F(c) := (target=A64 && burst=on && allocator=arena)`. The **exact maximal sound region** over the requested product is + +`Smax = {(c,x) in R × u8 | !F(c) || x != 0}`. + +Its complement is exactly `{(c,0) | c in R && F(c)}` (all profiles and both debug-assertion states). Thus this is maximal, not merely a positive subset. + +## Version-matched Rust axioms + +These are the only material Rust propositions consumed: + +* AX-ENV: [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “Returns an Err if the variable is not present, or if the current value is not valid Unicode.” [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) represents success as `Ok` or failure as `Err`; [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) distinguishes `NotPresent` and `NotUnicode`. +* AX-ORDER: the [block-expression Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) says statements are “executed sequentially.” The [match Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) says values are sequentially compared with arm patterns and the first match is chosen. [Tuple-struct patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns) match tuple-struct and enum-variant values. [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) “Extracts a string slice containing the entire String.” Literal patterns [match the literal's value](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), while the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) “matches any value.” +* AX-EXIT: [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the current thread.” `BUILD-MAP-ORDERED` supplies the process-status consequence. +* AX-CFG: the [conditional-compilation Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) defines `all` as true exactly when all predicates are true and `not` as negation. The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) includes its attachment when true and removes it when false. [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) “causes compilation to fail with the given error message when encountered.” +* AX-NZ: Rust 1.85.1 [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) requires: “The value must not be zero”; creating it with zero is undefined behavior. The [UB Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) confirms that unsafe blocks remain subject to the UB rules. +* AX-IF: the [`if` Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) executes the consequent exactly when its Boolean condition is true; the [comparison-operator Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) gives `==` equality for the `u8` comparison. + +## Complete ordered build relation + +Write `RERUN`, `CS`, and `CA` for the complete lines at `build.rs:4`, `:8/:12`, and `:15/:18`. `partial(L)` means any bytes produced by a failing attempt to write `L`, possibly none or even a complete-looking line. This deliberately does not assume line-write atomicity. + +1. For **every** raw environment state, the first operation attempts `RERUN`. If it fails, the only output is `partial(RERUN)`; `println!` panics before `env::var`, the process is unsuccessful, and no current library is compiled. +2. If `RERUN` succeeds, `env::var` is evaluated and its exhaustive `Result`/match partition is: + * absent or Unicode `system`: attempt `CS`. Failure yields `[RERUN]+partial(CS)`, panic, and no library. Success yields `[RERUN,CS]`, normal return, and exactly `fixture_allocator="system"` for the current library; + * Unicode `arena`: the identical two outcomes with `CA`, selecting exactly `arena` only after success; + * Unicode `arena-stop`: attempt `CA`. A write failure yields `[RERUN]+partial(CA)` and no library. A successful write yields `[RERUN,CA]`, then the explicit panic at `build.rs:19`; despite the complete allocator line, no current library is compiled; + * every other Unicode value: output `[RERUN]`, then the wildcard-arm panic at `:21`; no allocator write and no library; + * every non-Unicode value: output `[RERUN]`, then the `NotUnicode` panic at `:24`; no allocator write and no library. + +This exhausts the first-write outcome, all three `env::var` result classes, all literal/wildcard subdivisions of `Ok`, and every second-write outcome. Local sequential execution plus AX-ENV/ORDER/EXIT proves the source-side order and exits. Accepted TCB entry `BUILD-MAP-ORDERED` supplies only these consumed Cargo facts: a successfully written rerun line tracks any raw-value change; a cfg line affects the current library only after that script exits successfully; only the current successful run's exact directives are used; an unsuccessful script (including uncaught panic or either write failure) produces no current library and cannot surface a stale one; enabled `burst` and the three target triples set the named cfgs. No source-correctness or Rust-semantic proposition is imported from that entry. + +**Freshness witness sequence.** A successful raw `arena` run writes `[RERUN,CA]`, returns, and may produce the arena library. In the same target directory, changing the present raw value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly the three unsuccessful cases above: first write fails; first succeeds and `CA` fails; or both writes succeed and `:19` panics. Therefore the current build is rejected in every case, and the prior arena library is not its result. + +## Configuration/source closure and exclusion + +For a successful selector run, Cargo supplies exactly one of `system` or `arena`. AX-CFG makes the two `lane_id` bodies complementary: + +* `system`, or any X86 configuration, or `burst=off`: only the checked body at `lib.rs:27-32` is selected; +* `A64 + arena + burst=on`: only the unchecked-return body at `:17-20` is selected; +* `Wasm + arena`: independently of `burst`, the cfg on `:3` is true and `compile_error!` makes the current library compilation fail, producing no library artifact; +* `Wasm + system` remains in the checked class. + +Thus the required exclusion is effectively and exactly rejected: successful arena selection plus the accepted Wasm target-cfg entails the compile error. No rejected raw class bypasses it, because none creates a current library. Conversely, this source error's predicate is precisely `Wasm && arena`, so it does not enlarge the stated exclusion. Profiles and debug assertions do not occur in any selector or source predicate, giving a parametric proof over `P×D`. Hence the build/exclusion `Covered` predicate contains the complete build-interface domain, and the successful-library projection is exactly `R`. + +## API, obligations, and maximal-region proof + +The only public surface is safe `lane_id(u8) -> NonZeroU8`; there are no public fields, traits/impls, callbacks, macros, statics, FFI, or hidden APIs. The only unsafe sites are its two cfg-complementary `new_unchecked` calls. The build script contains no unsafe code. + +* If `!F(c)` and `x=0`, `value == 0` is true, so `panic!` executes before the unsafe call. This is UB-free and proves the documented panic behavior. +* If `!F(c)` and `x!=0`, the zero branch is skipped; that dominating fact discharges AX-NZ before `lib.rs:32`. +* If `F(c)` and `x!=0`, the direct call at `:19` satisfies AX-NZ. +* If `F(c)` and `x=0`, cfg selection reaches `new_unchecked(0)`. The safe signature imposes no caller precondition, so this is a valid supported safe use; AX-NZ's required proposition is false and the operation has undefined behavior. This proves **UNSOUND**, for every `p,d` in this complement. + +The four cases are exhaustive (`F`/`!F`, zero/nonzero). The first three prove every member of `Smax`; the fourth proves every member of its complement unsound, establishing maximality. The existing fast-path comment—“Burst-mode lane identifiers are never zero”—is a false, unenforced premise; the parameter comes directly from adversarial safe code. The checked-path comment is adequate. + +For the panic contract, coverage is exactly `{(c,0) | c in R && !F(c)}`. In the uncovered `F(c),0` cases the whole execution contains UB. Consequently there is no UB-free witness here for `CONTRACT-BROKEN`; the strongest contract verdict is **UNPROVED**, alongside the independently certified **UNSOUND** verdict. + +## TCB audit, findings, and residual scope + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, disposition accepted by the authorized reviewer. Its exact consumed fragments and consumers are recorded above; its Cargo/toolchain identity is 1.85.1. AX-ENV through AX-IF are versioned Rust authorities, not extra implementation assumptions. No pending, unsafe-dependency, tool, backend, binary, platform-runtime, or probabilistic premise is consumed. + +**Finding F-1 (UNSOUND; proof comment deficient):** `src/lib.rs:18-19`, precisely `F(c) && value=0`. Minimum repair is to check zero before every `new_unchecked`, use `NonZeroU8::new(value).expect(...)`, or remove the special unsafe branch. Merely strengthening prose would add an invalid hidden precondition to a safe API. Re-audit all cfg cases and the panic guarantee after repair. + +**Finding F-2 (postcondition UNPROVED):** the same region prevents a universal panic proof, but supplies no defined contract-breaking witness. Repair F-1 while retaining a zero-input panic on the fast path. + +This is a source-level Rust theorem only. Compiler/backend correctness, produced binaries, manually invented cfgs, direct `rustc`, build-script override, targets/toolchains outside the stated set, and future source or policy are excluded. Re-audit on any source, Rust/Cargo, support domain, raw interface, feature/target cfg, TCB disposition, or cited semantic-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/C.md new file mode 100644 index 0000000000..0276c50b7c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/C.md @@ -0,0 +1,78 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits exactly the supplied `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and accepted `TCB.md`, under Rust/standard library 1.85.1 and Cargo 1.85.1. No generated file, dependency, test, build, macro expansion, backend, or binary claim is used. Audit cutoff: 2026-08-01. + +Write `X`, `A`, and `W` for the three supported targets (x86_64-linux-gnu, aarch64-linux-gnu, and wasm32-unknown-unknown); `b in {0,1}` for `burst`; `a in {system,arena}`; `p in P` for every Cargo profile; and `d in {0,1}` for debug assertions. The controlling full product is + +`F = {1.85.1} x {X,A,W} x {0,1} x {system,arena} x P x {0,1}`. + +`SUPPORT.md` makes the compilable-library domain + +`C = {c in F | not(c.target=W and c.allocator=arena)}`. + +No finite enumeration of `P` is inferred. The proofs below are parametric in `p,d`; neither selects inspected source. Build-domain coverage additionally quantifies over every raw environment class and success/failure of each stdout write described below. `BUILD.md` excludes manual rustc, invented cfgs, and build-script override; that exclusion is controlling, not inferred from successful compilation. + +* **Whole-crate safe-API soundness: UNSOUND**, relative to accepted `BUILD-MAP-ORDERED` and the quoted Rust axioms below. A supported safe call reaches UB. +* **Documented `lane_id(0)` panic postcondition: UNPROVED** over `C`. It is proved outside the defective configuration, but the only refutation found in that configuration contains UB, so it cannot certify `CONTRACT-BROKEN`. +* **Build mapping/freshness and W/arena rejection: PROVED** for the stated source domain relative to exactly `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `S`/`A0` the complete `cargo::rustc-cfg=fixture_allocator="system"`/`"arena"` lines. Rust blocks execute statements sequentially ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html): “a block sequentially executes its component non-item declaration statements and then its final optional expression”). Thus every path first attempts `R`, then calls `env::var`, then (only where shown) attempts one allocator line. + +`env::var` “Fetches the environment variable `key` from the current process”; it returns `NotPresent` when unset and `NotUnicode` when its value is not valid Unicode ([std](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)). The fixed name contains neither `=` nor NUL. `as_str` “Extracts a string slice containing the entire `String`” ([std](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)); match selects the first matching arm after evaluating the scrutinee ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). These facts make the following raw partition exhaustive. + +| Raw class, after successful `R` | Next events in exact order | Completed stdout prefix and exit | Current library | +|---|---|---|---| +| omitted | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `system` | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `arena` | attempt `A0`; success returns | `R,A0`, success | cfg `arena`, subject to source rejection | +| Unicode `arena-stop` | attempt `A0`; after success explicit panic | `R,A0`, unsuccessful | none | +| every other Unicode string | explicit panic; no allocator attempt | `R`, unsuccessful | none | +| every non-Unicode value | explicit panic; no allocator attempt | `R`, unsuccessful | none | + +There are exactly two write-failure sites. If the `R` write fails, execution panics there: no complete directive is guaranteed (only a possibly incomplete byte prefix) and no environment read occurs. If `S` or `A0` fails, complete prefix `R` (plus a possibly incomplete suffix of that attempted line) precedes the panic; there is no return. On `arena-stop`, failure of `A0` gives the latter prefix; success gives `R,A0` followed by the explicit panic. `println!` “Prints to the standard output, with a newline” and “Panics if writing to `io::stdout` fails” ([std](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([std](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). These panics are safe behavior. + +The accepted TCB supplies, and this proof consumes only, these propositions: a completed `R` records raw-value freshness; a successful current execution's completed cfg line becomes that exact library cfg, with no retained earlier selector; any write failure or uncaught main-thread panic is unsuccessful and produces/presents no current library; enabling `burst` sets its feature cfg; and the three triples set the named `target_arch` values. Cargo documentation corroborates but does not replace that accepted premise: `rustc-cfg` “tells Cargo to pass the given value to the `--cfg` flag” ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)), while `rerun-if-env-changed` causes rerun when the named value changes ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). + +**Freshness challenge.** After successful `arena` in one target directory, changing the raw value to `arena-stop` is a present-to-present change covered by `R`. `BUILD-MAP-ORDERED` therefore forces a rerun before selection. That rerun either fails at `R`, fails at `A0`, or writes both then explicitly panics. Every case is unsuccessful; neither its partial output nor the old arena artifact is a result of the current build. The advertised canary works. + +## Directive-to-source closure and exclusion + +Conditional compilation compiles parts according to conditions, and a cfg attribute “conditionally includes the thing it is attached to based on a configuration predicate” ([Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)). Consequently a successful accepted build supplies exactly one allocator cfg, the selected feature state, and the target architecture. + +For `W and arena`, the first predicate in `lib.rs` is true for either feature/profile/debug state, so `compile_error!`, which “Causes compilation to fail with the given error message when encountered” ([std](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)), rejects compilation. For every other member of `F` it is false, so it rejects nothing. Therefore the source enforces exactly `F ∖ C`; `arena-stop` never reaches this stage. There is no current API for the rejected pair. + +For each `c in C`, define + +`Q(c) = (burst enabled) and (target=A) and (allocator=arena)`. + +The two function-body cfgs are `Q` and `not(Q)`, hence form an exhaustive, disjoint partition. In `Q`, source selects the unconditional `return new_unchecked(value)` block. In `not(Q)`, it selects the block which first compares with zero, panics on equality, and otherwise calls `new_unchecked`. An `if` is a conditional branch and executes its consequent when its Boolean condition is true ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is the equality comparison operator ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). + +## Unsafe obligation, witness, and exact maximal sound region + +The complete language-reachable crate API surface is the safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, constructors besides it, traits/impls, callbacks, statics, FFI, exported macros, or hidden APIs. `compile_error!` is configuration control. The two `new_unchecked` calls are the only unsafe sites. The owned invariant/obligation is `NZ(value): value != 0` immediately before either call. No caller obligation is permitted because `lane_id` is safe. + +`u8` is “The 8-bit unsigned integer type” ([std](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)); let `U={0,...,255}`. `NonZeroU8::new_unchecked` “Creates a non-zero value without checking whether the value is non-zero” and “The value must not be zero”; zero “results in undefined behavior” ([std](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +The exact maximal sound region of compiled API cases is + +`M = {(c,x) in C x U | not(Q(c) and x=0)}`. + +**Sufficiency:** if `not Q` and `x=0`, the comparison reaches `panic!` before unsafe code. If `not Q` and `x!=0`, the false branch itself establishes `NZ(x)`. If `Q` and `x!=0`, the input establishes `NZ(x)`. Thus every unsafe call in `M` satisfies its complete safety precondition. Profiles and debug assertions do not alter this derivation. + +**Necessity/maximality:** choose any profile/debug state with `(target=A, burst=1, allocator=arena, x=0)`. This configuration belongs to `C`, raw `arena` successfully selects it, and `lane_id(0)` is a well-typed safe use. `Q` selects the first block; it reaches `new_unchecked(0)`, its required proposition is false, and the quoted contract entails UB. Hence every point in `(C x U) ∖ M` is unsound, while every point in `M` was proved sound. This proves both maximality and the existential `UNSOUND` certificate. Over all of `F x U`, `W/arena` has no compiled API; every other case is classified by `M` or its complement. + +The special-path comment, “Burst-mode lane identifiers are never zero,” is false for caller-controlled `u8` and supplies neither a check nor an invariant. The ordinary-path comment is adequate: the dominating zero branch makes reaching its unsafe call imply nonzero. Minimal repair: perform the zero check before both cfg branches (or use checked `NonZeroU8::new(value)` and panic on `None`) and replace the false comment with that dominating fact. + +For the documented postcondition, zero reaches `panic!` in every `c in C` with `not Q`; it is therefore proved exactly there. In `Q`, the zero execution contains UB. There is no independent UB-free zero execution or equivalent existence proof, so the whole-domain result is `UNPROVED`, not `CONTRACT-BROKEN`. + +## TCB log, residual scope, and triggers + +* **BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo/freshness/process-status/feature/target propositions enumerated above; consumers are build reachability and exclusion only. No source correctness is imported. +* **AXIOM-CTRL/CFG/NZ (accepted Rust authority):** only the linked, versioned 1.85.1 propositions quoted above. Rust's UB rule applies inside unsafe blocks too ([Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). +* No dependency, allocator implementation, generated-code, tool, test, FFI, backend, binary, or deployment premise is consumed. “Allocator” is only this crate's cfg model. + +Re-audit on any supplied source/policy/manifest change; Cargo/Rust/stdlib version or TCB disposition change; target, feature, allocator, profile/debug scope change; changed build-output/freshness semantics; or a new API/cfg. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/D.md new file mode 100644 index 0000000000..12235d2ff6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/D.md @@ -0,0 +1,107 @@ +# Unsafe-code audit: `ordered-build-target` supplied snapshot + +## Claim, domain, and verdicts + +Audit cutoff: 2026-08-01. Scope is every supplied crate file, Cargo 1.85.1/Rust 1.85.1, the build interface and freshness contract, generated cfgs, selected `src/lib.rs`, its sole public safe API, and its documented panic condition. This is a Rust-abstract-semantics source claim, not a backend or binary claim. No build, execution, expansion, test, prior audit, or external dependency result was used. + +Write `X`, `A`, and `W` for the three listed target triples (x86_64 GNU/Linux, aarch64 GNU/Linux, and wasm32-unknown-unknown), `F={off,on}` for `burst`, `L={system,arena}`, `P` for every Cargo profile, `D={off,on}` for debug assertions, and `U={0,...,255}`. The full policy product is + +`C={X,A,W} x F x L x P x D`. + +`SUPPORT.md:9-16` says exactly those members are supported except + +`E={c in C | target(c)=W and allocator(c)=arena}`, + +so current library configurations are `S=C\E`. Both containments for this normalization follow literally: every tuple admitted by the “every other combination” clause is in `C\E`, and every member of `C\E` has listed axis values and is not the sole exclusion. No enumeration of `P` is assumed. + +Full `Required` is the union of (1) all supported Cargo build attempts over the six raw-environment classes below, every possible applicable stdout-success/failure path and relevant prior target-directory state, and (2) every call `lane_id(v)` with `c in S` and `v in U` after a current successful build. `E` and rejected selector attempts have no current API case. Manual rustc, invented cfgs, and build-script override are expressly excluded by `BUILD.md:31-34`. + +| Claim | Verdict | Certificate | +|---|---|---| +| Whole-crate safe-API freedom from UB over `S x U` | **UNSOUND** | `F-UB` below supplies a valid supported safe call, reachability, false safety condition, and explicit UB consequence. | +| “`lane_id(value)` panics when `value` is zero” over `S x {0}` | **UNPROVED** | Proved on `S\K`; the remaining `K` executions have UB, so they cannot establish `CONTRACT-BROKEN` and do not prove the postcondition. | +| Exact maximal realized library sound region | **PROVED relative to TCB-ORDERED** | `M=(S x U)\WIT`, proved below; every point in its complement within `S x U` is an UB witness. | +| Ordered build mapping, freshness canary, and target/allocator rejection | **PROVED relative to TCB-ORDERED** | Exhaustive staged relation and exact cfg derivation below. | + +Thus the combined mandatory result is **UNSOUND; documented postcondition UNPROVED**, not `PROVED` and not `CONTRACT-BROKEN`. + +## Boundary, surfaces, and invariants + +`Cargo.toml` selects only `build.rs` and `src/lib.rs`; all supplied files were read. `build.rs::main` is private and contains no unsafe operation. The complete downstream surface is the public **safe** free function `lane_id(u8) -> NonZeroU8`; there are no crate-defined public fields, constructors, traits/impls, statics, callbacks, FFI, reexports, hidden items, or exported/generated macros. Its caller has no safety precondition. The only invariant consumed is `NZ`: the argument to `NonZeroU8::new_unchecked` is nonzero, thereby producing a valid nonzero result. The function boundary must establish `NZ`; `lib.rs:18` does not. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `CS`/`CA` the complete system/arena `cargo::rustc-cfg` lines. Block statements execute sequentially, and a value scrutinee is evaluated then patterns are compared sequentially until the first match. These checked semantics make the source order literal, not inferred from endpoint output. + +1. Cargo runs `build.rs`; `build.rs:4` first attempts `println!(R)`. If it succeeds, complete prefix `[R]` exists and only then is `env::var` called. If it fails, `println!` panics there: no classification or later write is reached and no earlier complete line is guaranteed. +2. With `[R]`, `env::var` and the two matches produce the exhaustive raw partition below. The key literal itself contains neither `=` nor NUL. `Result` has only `Ok`/`Err`; `VarError` has only `NotPresent`/`NotUnicode`; `as_str` preserves the entire Unicode string; literal patterns select exactly their values and `_` every remainder. + +| Raw `FIXTURE_ALLOCATOR` class | Reached operation after `[R]` | If that operation succeeds | Explicit/failure exit | +|---|---|---|---| +| omitted | `build.rs:8` attempts `CS` | return success with `[R,CS]` | write failure panics with prior complete prefix `[R]` | +| Unicode `system` | line 12 attempts `CS` | return success with `[R,CS]` | same failure prefix/exit | +| Unicode `arena` | line 15 attempts `CA` | return success with `[R,CA]` | same failure prefix/exit | +| Unicode `arena-stop` | line 18 attempts `CA` | prefix `[R,CA]`, then line 19 explicitly panics | line-18 failure panics first with prior prefix `[R]`; line 19 is not reached | +| every other Unicode value | no allocator write | none | line 21 explicitly panics with `[R]` | +| every non-Unicode value | no allocator write | none | line 24 explicitly panics with `[R]` | + +This includes every dynamic stdout failure site: common line 4 and the class-specific lines 8, 12, 15, and 18. A failed `println!` may have written an unspecified byte prefix (possibly a complete-looking attempted line); the table states only already successful complete lines. TCB-ORDERED makes all such executions unsuccessful and prevents any prefix from producing a current library, so no atomic-write premise is consumed. Explicit `panic!` writes no Cargo stdout directive. + +3. On exactly the three accepted successful classes, TCB-ORDERED interprets the current two complete lines: `R` establishes freshness tracking and exactly one of `CS`/`CA` passes the corresponding exact `fixture_allocator` key/value cfg to this library, with no selector retained from an earlier run. Every write failure, explicit panic, and `arena-stop` exit is unsuccessful; no current library compilation occurs. +4. TCB-ORDERED also supplies the exact `burst` and target-architecture leaf cfgs. Rust cfg semantics then select source. Define + +`K(c) := burst(c)=on and target(c)=A and allocator(c)=arena`. + +The first `lane_id` block is present exactly on `K`; the second is present exactly on `not K`, because its predicate is the literal `not(all(...))`. Profiles and debug assertions occur in no selector or safety check, so this partition is parametric over `P x D`. + +### Exact exclusion + +For a current successful arena selector on `W`, TCB-ORDERED sets both `target_arch="wasm32"` and `fixture_allocator="arena"`; `all` is true, the `cfg` attribute retains `compile_error!`, and that macro fails compilation. Conversely, encountering this source error requires both leaves true, hence exactly `E`; feature state is irrelevant. System-on-`W` and arena on `X`/`A` make at least one leaf false and remove the item. Therefore `Rejected_source=E` in both directions, not merely `E` contained in a sampled rejection. A failed current compilation is no current library/API case. Over the total `C x U`, `E x U` is precisely the no-library region. + +### Freshness sequence in one target directory + +Take any successful prior arena library build, necessarily on `X` or `A`. Its successful script emitted `[R,CA]`; TCB-ORDERED says a present-to-present raw change from `arena` to `arena-stop` stales that selection and reruns the script before a current library can be selected. On the rerun: line 4 failure rejects immediately; otherwise line 18 failure rejects with `[R]`; otherwise `[R,CA]` is followed by the explicit panic. TCB-ORDERED says every case supplies no current library and never presents the old arena library as this rejected build's result. The freshness canary is therefore effective. + +## Unsafe obligations and exact maximal region + +Rust 1.85.1 documents `NonZero::new_unchecked`: “The value must not be zero” and “undefined behavior if the value is zero.” Thus each site has exactly obligation `NZ`. + +* On `not K`, cfg removes the early-return block. If `v=0`, `==` is equality, the `if` consequent executes `panic!`, and control never reaches line 32. If `v!=0`, the consequent is skipped; reaching line 32 itself proves `NZ`, so the call is permitted and returns a nonzero. This reconstructs and completes the terse line-31 comment. +* On `K`, cfg removes the checked block. Line 19 is reached for every `v`. `v!=0` satisfies `NZ`; `v=0` falsifies it. The line-18 comment's “never zero” is neither type-enforced nor checked and is false for a caller-supplied `u8`. + +Let + +`WIT={(c,0) | c in S and K(c)}` and `M=(S x U)\WIT`. + +`WIT` is nonempty: `A`, burst on, arena is listed and not the wasm exclusion, for every `P,D`; an accepted arena build with successful writes selects it. Calling the public safe `lane_id(0)` is a valid safe use. Cfg makes line 19 reachable; zero falsifies `NZ`; the exact standard-library contract entails UB. This is the complete **UNSOUND** certificate (`F-UB`). + +For every member of `M`, either `not K` (the checked proof above covers every `u8`) or `K` and `v!=0` (the unsafe precondition holds); no other unsafe operation exists. Hence `M` is sound. Conversely, every member of `(S x U)\M` is by definition in `WIT` and has the proved UB certificate. Both containments establish equality and maximality, rather than a non-maximal remainder. The complete product partition is therefore: rejected `E x U`, realized-sound `M`, and realized-unsound `WIT`. + +For the panic contract, `(S\{c:K(c)}) x {0}` is proved: the equality is true and `panic!` “Panics the current thread.” On `WIT`, the whole execution contains UB, so it cannot be an UB-free postcondition counterexample. No independent UB-free witness exists in this source. The strongest global postcondition verdict is consequently **UNPROVED**, with no `CONTRACT-BROKEN` certificate. + +## Obligation ledger and findings + +| ID | Obligation | Coverage/status | +|---|---|---| +| O-BUILD | Exhaust raw classes, ordered effects/exits, partial prefixes, Cargo interpretation | All cases proved above relative to TCB-ORDERED | +| O-FRESH | stale arena then arena-stop cannot select old/current library | proved above relative to TCB-ORDERED | +| O-EXCL | reject exactly wasm32/arena | proved in both directions | +| O-NZ-NORMAL | line 32 argument nonzero | proved on `not K` for every `u8` | +| O-NZ-BURST | line 19 argument nonzero | proved only for `K and v!=0`; **UNSOUND** at `v=0` | +| O-PANIC | every zero call panics | proved on `not K`; **UNPROVED** on `K` | + +**F-UB (critical implementation defect; deficient proof artifact).** The safe `u8` input is treated as if “burst mode” enforced nonzero. Minimal resolution is to perform the zero check before every cfg-dependent unsafe call, or replace both calls with a checked safe constructor while preserving the documented panic. A valid replacement proof would say: “`new_unchecked` requires nonzero; if `value==0` the preceding `panic!` diverges, so reaching this call proves `value!=0`.” Re-audit all `K`, postcondition, and maximal-region proofs after repair. + +## Authority and TCB audit log + +**TCB-ORDERED (accepted human decision):** supplied `TCB.md` entry `BUILD-MAP-ORDERED`, Cargo 1.85.1, exact supplied manifest/script/interface/library. Consumed propositions only: required script execution; successful `R` freshness including present-to-present raw changes; exact current successful cfg and no retained selector; no compilation/old-result presentation after unsuccessful script even with complete prefixes; panic as unsuccessful exit; and exact feature/target leaves. No local emission, Rust semantics, source correctness, backend, binary, or compiler-correctness proposition is imported. Owner is the unidentified authorized human; triggers are exactly `TCB.md:43-45`. Cargo's versioned documentation corroborates that Cargo will [“execute it just before building”](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script), treats [stdout `cargo::` lines as instructions](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script), and [`rustc-cfg` passes its value to `--cfg`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg); the stronger failure/staleness clauses remain only the expressly accepted TCB proposition. + +Checked Rust 1.85.1 axioms, all accepted as version-matched authoritative text: + +* Environment/classification: `env::var` says [“The variable is not set” and `NotUnicode` means its “value is not valid Unicode”](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html); [`VarError` has exactly `NotPresent` and `NotUnicode`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html); [`Result` is `Ok(T)` or `Err(E)`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html); [`as_str` contains the entire `String`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str). +* Order/partition: blocks [“sequentially execute”](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html); match uses the [“first arm with a matching pattern”](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html); literal patterns [“match exactly the same value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), tuple patterns match enum values, and `_` [“matches any value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern). +* Effects: `println!` [prints stdout with newline and “Panics if writing ... fails”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics); [`panic!` “Panics the current thread”](https://doc.rust-lang.org/1.85.1/std/macro.panic.html). +* Cfg: the [conditional-compilation clauses](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) say an “option is set,” “all ... predicates are true,” `not` inverts, and false cfg means the “thing is removed from the source code.” [`compile_error!` “Causes compilation to fail”](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html). +* API: `u8::MIN=0` and [`u8::MAX=255`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html); `==` means [“Equal”](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators); a true `if` condition [executes its consequent](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html); and [`new_unchecked` “Creates a non-zero,” requires nonzero, and expressly makes zero UB](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked). + +No other TCB entry, dependency contract, tool-derived evidence, environment restriction, or compatibility premise was consumed. Rust/Cargo/toolchain, target/feature policy, script/source/docs, TCB disposition, or panic-contract changes trigger full re-audit. Review attestation is complete except that the audited artifact itself fails O-NZ-BURST and O-PANIC as reported. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/E.md new file mode 100644 index 0000000000..f826f01b97 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/E.md @@ -0,0 +1,78 @@ +# Unsafe Rust audit: complete supplied crate + +## Claim, snapshot, and verdicts + +Audited snapshot: the supplied `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and `TCB.md`; Rust, std, and Cargo 1.85.1; edition 2021; no dependencies or generated source. Audit cutoff: 2026-08-01. No build, execution, expansion, or test evidence was used. + +Let `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`, `F={off,on}` for `burst`, `A={system,arena}`, `P` be every Cargo profile, and `D={off,on}` for debug assertions. The controlling support expression in `SUPPORT.md` normalizes exactly to + +`C = {(t,f,a,p,d) in T×F×A×P×D | not(t=wasm32-unknown-unknown and a=arena)}`. + +Both containments are direct: every policy-supported tuple has listed values and is not the sole stated exclusion, hence is in `C`; every member of `C` is one of the expressly supported Cartesian combinations and is not excluded, hence is policy-supported. `P` and `D` remain symbolic; no sampled inventory substitutes for them. + +The full required domain is (i) every supported-Cargo build attempt over every raw `FIXTURE_ALLOCATOR` class and every stdout-success/failure path described below, and (ii) every well-typed safe call `lane_id(x)` for `c in C` and every `x:u8`. Build rejection cases do not become library configurations. + +Verdicts, relative only to accepted `TCB.md` entry `BUILD-MAP-ORDERED` and the Rust 1.85.1 axioms quoted below: + +* **Build-interface contract: PROVED.** The raw partition, operation order, partial prefixes, current-build rejection, selector mapping, and arena-to-arena-stop freshness guarantee hold. +* **Target/allocator exclusion: PROVED.** Every wasm32/arena library attempt fails compilation, independently of feature, profile, and debug assertions; no such tuple is in `C`. +* **Safe-library soundness: UNSOUND.** A supported safe call reaches documented undefined behavior. +* **Documented panic postcondition: UNPROVED overall**, and PROVED on its exact positive region stated below. There is no UB-free counterexample establishing `CONTRACT-BROKEN`. + +## Checked authority and TCB + +The following are the material Rust axioms, all scoped to 1.85.1. + +* `std::env::var` “Fetches the environment variable `key` from the current process” and returns `NotPresent` or `NotUnicode` in the two stated error cases ([`var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); `VarError` has exactly those variants ([`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html)). `Result` “represents either success (`Ok`) or failure (`Err`)” ([`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html)). `String::as_str` “Extracts a string slice containing the entire `String`” ([`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). +* A block “sequentially executes its component non-item declaration statements” ([blocks](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html)); a match compares arms until a match and chooses the first matching arm ([match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). Tuple-struct patterns select the named enum variant, literal patterns match equal values, and `_` matches any value ([tuple-struct](https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns), [literal](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern)). +* `println!` “Prints to the standard output, with a newline” and “Panics if writing to `io::stdout` fails” ([macro](https://doc.rust-lang.org/1.85.1/std/macro.println.html), [failure](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)). `panic!` “Panics the current thread” ([`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). Function calls execute their called body ([calls](https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html), [function body](https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body)). +* A `cfg` attribute conditionally includes its attached form; a false predicate removes it, while `all` and `not` have their literal Boolean meanings ([conditional compilation](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation), [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)). `compile_error!` “Causes compilation to fail with the given error message when encountered” ([`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). An `if` executes its consequent when its Boolean condition is true ([if](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is the equality comparison used here ([comparisons](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). `u8` is the 8-bit unsigned integer type, so every input is exactly zero or nonzero ([`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)). +* `NonZeroU8::new_unchecked` “Creates a non-zero without checking whether the value is non-zero”; critically, “This results in undefined behavior if the value is zero” and its Safety clause says “The value must not be zero” ([`new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). The general UB inventory also includes producing invalid values ([undefined behavior](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). + +`BUILD-MAP-ORDERED` is accepted exactly as written: current successful directive interpretation; freshness after a successfully written rerun directive; no current or stale library after an unsuccessful build script; feature and listed-target cfg mapping; and uncaught-main-panic status. It does **not** supply emitted strings/order or Rust/source correctness; those are derived here. Cargo documentation independently agrees that `rustc-cfg` passes a value to `--cfg` and `rerun-if-env-changed` reruns when the named value changes ([outputs](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script), [`rustc-cfg`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg), [`rerun-if-env-changed`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)); these checks do not widen the accepted premise. Cargo feature interpretation is likewise confined to the entry ([features](https://doc.rust-lang.org/1.85.1/cargo/reference/features.html)). + +## Complete ordered build relation + +Write `R` for `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, `S` for `cargo::rustc-cfg=fixture_allocator="system"`, and `A` for the analogous `"arena"` line. Blocks execute in source order and every `println!` either completes or panics on its write. + +1. Every execution first attempts `R`. Failure exits by panic with emitted prefix `[]`; environment classification and all later operations are unreachable. Success leaves prefix `[R]`, then `env::var` is called and the exhaustive `Result`/`VarError` matches classify the raw value. +2. Raw absent: attempt `S`. Raw Unicode `system`: `as_str` yields the whole string, the literal arm matches, and it attempts `S`. Raw Unicode `arena`: analogously attempt `A`. At any such allocator-write failure, the exit is a `println!` panic with prefix `[R]`. At success, the exact prefix is respectively `[R,S]` or `[R,A]`, `main` returns normally, and `BUILD-MAP-ORDERED` passes exactly that allocator cfg to the current library compilation. +3. Raw Unicode `arena-stop`: attempt `A`. Write failure exits unsuccessfully with `[R]`. Write success leaves `[R,A]`; the following explicit `panic!` is necessarily reached and exits unsuccessfully. The emitted allocator prefix is not interpreted into a current compilation under `BUILD-MAP-ORDERED`. +4. Every Unicode value outside `{system,arena,arena-stop}` reaches `_` and explicitly panics with `[R]`; every non-Unicode value reaches `Err(NotUnicode(_))` and explicitly panics with `[R]`. No allocator write is attempted. + +Thus the successful outputs are exactly `[R,S]` for absent or `system`, and `[R,A]` for `arena`; unsuccessful prefixes are exactly `[]`, `[R]`, and (only for a fully written `arena-stop` allocator line) `[R,A]`. This accounts for both stdout failure points on every path where the second exists; a write failure is an exit, so no later fact is consumed. + +Freshness is ordered, not inferred from an endpoint. A successful `arena` run necessarily wrote `R` before `A`. By the accepted entry, changing the same target directory's raw value to `arena-stop` makes that selection stale and reruns the script before current selection. The rerun either fails writing `R`, fails writing `A`, or writes both then explicitly panics. Every case is unsuccessful, and the entry forbids both a current compilation and presentation of the earlier arena library as the current result. The canary therefore rejects. + +## Configuration selection and exclusion + +On a successful selector run, the TCB gives exactly one allocator cfg; it also gives `feature="burst"` iff enabled and the exact `target_arch` for each listed target. For wasm32/arena, `all(target_arch="wasm32", fixture_allocator="arena")` is true, so the `cfg` attribute includes `compile_error!`; compilation fails for both feature states and all `P,D`. For every other tuple, that conjunction is false and the item is removed. Partial `arena-stop` output never reaches this stage. This proves effective rejection, rather than merely assuming the policy exclusion. + +## API, invariant, and obligation coverage + +The only crate public surface is safe `pub fn lane_id(u8)->NonZeroU8`. There are no fields, constructors beyond that function, traits/impls, statics, FFI, callbacks, exported macros, hidden APIs, dependencies, or mutable state. The only unsafe sites are its two configuration-complementary calls to `new_unchecked`. The required local proposition at either call is `NZ(value): value != 0`. + +Let `B(c) = (f=on and t=aarch64-unknown-linux-gnu and a=arena)`. The two `cfg` predicates are literally `B` and `not(B)`, so exactly one block exists for every `c in C`; profile and debug state occur in neither selection nor proof. + +* If `B(c)`, source calls `new_unchecked(value)` without a check. `NZ` holds exactly when `value!=0`. The comment “Burst-mode lane identifiers are never zero” is false as an invariant: the safe signature admits every `u8`, and no producer or boundary restricts it. +* If `not B(c)`, `value==0` reaches `panic!` before the unsafe call. Otherwise the exhaustive complement is `value!=0`, establishing `NZ`; `new_unchecked` is then permitted. The adjacent second safety comment states the controlling local fact and is correct. + +### Exact maximal sound region + +Over the requested complete product and inputs, define + +`SOUND = {(c,x) in C×u8 | not(B(c) and x=0)}`. + +`SOUND` is sound: partition on `B`; in `B`, its formula gives `x!=0`, and outside `B`, zero panics before unsafe while nonzero proves `NZ`. These cases exhaust `SOUND`. It is exact: its complement within `C×u8` is exactly `{(c,0) | c in C and B(c)}` by Boolean algebra. Every such tuple reaches `new_unchecked(0)`, whose checked contract says that is UB. Consequently any strict superset of `SOUND` within `C×u8` contains an unsound tuple; `SOUND` is the unique maximal region. This proof is parametric over every `p in P` and both `d in D`. + +The universal soundness claim is therefore **UNSOUND**. A certificate is any supported `c` with aarch64 target, burst on, arena allocator, arbitrary profile/debug state, plus the well-typed safe call `lane_id(0)`: the first cfg block is selected, the unchecked call is executed, its required `value!=0` proposition is false, and its version-matched contract expressly entails UB. + +For the documented “Panics when `value` is zero” postcondition, the exact proved region is `{c in C | not B(c)}`: the equality is true and `panic!` is reached before unsafe. In `B`, zero reaches UB instead. An execution containing UB cannot certify `CONTRACT-BROKEN`, and no independent UB-free non-panicking zero execution is established; hence the full postcondition is **UNPROVED**, not `CONTRACT-BROKEN`. + +## Findings and remediation + +**F-1 — UNSOUND, critical.** `src/lib.rs`'s aarch64/burst/arena safe branch has an unenforced nonzero precondition and a false safety comment. Minimum repair: perform the same zero check on that branch, or use checked `NonZeroU8::new(value)` and panic on `None`; then replace the comment with the actual dominating derivation. Making the safe function unsafe would be a breaking and unnecessary alternative. Re-audit the new snapshot and the panic claim. + +**F-2 — postcondition UNPROVED.** The same region prevents a universal panic proof. F-1's checked repair also resolves it; wording alone cannot repair either result. + +No tool-derived evidence or additional assumptions were used. Residual scope excludes manual rustc invocation, invented cfgs, overridden build scripts, unlisted targets/toolchains, and binary/backend correctness exactly as the policies require. Re-audit on any source, support product, Cargo/Rust/std identity, build interface, cfg, TCB disposition, or documentation-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/F.md new file mode 100644 index 0000000000..5578f5219e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/F.md @@ -0,0 +1,203 @@ +# Unsafe Rust audit: `ordered-build-target` + +## Claim, snapshot, and verdicts + +This is a source-only audit of the complete supplied snapshot: `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`. +No build, execution, test, or expansion was used. The theorem is for Rust/Cargo +1.85.1, edition 2021, at the 2026-08-01 cutoff; it makes no backend or binary +claim. `BUILD-MAP-ORDERED` in the supplied `TCB.md` is the accepted TCB +revision. No dependency, tool-result, or additional implementation premise is +consumed. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe call to `lane_id` in every supported current library is free of Rust UB | **UNSOUND** | F-01 gives a valid safe call, reachability, false unsafe precondition, and authoritative UB consequence. | +| Documented postcondition “Panics when `value` is zero” over every supported library configuration | **UNPROVED** | Proved outside the exceptional configuration; its only zero execution has UB, so it cannot prove `CONTRACT-BROKEN`. | +| Ordered selector mapping, rejection, and `arena`→`arena-stop` freshness | **PROVED relative to `BUILD-MAP-ORDERED`** | B-01/B-02 below. | +| Required wasm32/arena exclusion | **PROVED** | B-03: the selected source necessarily fails compilation. | + +The combined mandatory result is therefore **UNSOUND** for soundness and +**UNPROVED** for the panic postcondition, not `CONTRACT-BROKEN`. + +## Exact theorem domain + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `F={off,on}` be `burst`; `A={system,arena}`; `P` be every Cargo profile; and + `D={off,on}` be debug assertions; +* `Q = T×F×A×P×D \ { (wasm32-unknown-unknown,f,arena,p,d) }`; and +* `U` be every value of type `u8`. + +This is an equality normalization of `SUPPORT.md`: it states exactly those +three targets, both feature and allocator states, every profile and both debug +assertion states, then removes exactly wasm32/arena for either feature. The +manifest fixes Rust 1.85.1/edition 2021 and declares only `burst`. `BUILD.md` +defines allocator selection. There is no policy conflict and no release +interval to extrapolate. Raw environment classes rejected below are build +interface cases, not extra members of `A`. Profiles/debug assertions do not +occur in the source predicates or arithmetic, so the proofs are parametric in +`P,D`. + +Write +`C(q) := (F=on ∧ T=aarch64-unknown-linux-gnu ∧ A=arena)`. +The **exact maximal sound region** over the requested full product is + +`S = { (q,v) ∈ Q×U | ¬C(q) ∨ v≠0 }`. + +The proof of both inclusion and maximality appears under S-01/S-02. + +## B-01: complete ordered build relation + +Let `R`, `L_s`, and `L_a` denote the newline-terminated rerun, system-cfg, and +arena-cfg lines literally present in `build.rs`. Let `p(X)` mean whatever bytes, +if any, a failed attempt to print `X` emitted; it may be empty or include a +complete line. Its exact bytes are immaterial because the accepted TCB says any +stdout-write failure is an unsuccessful script and supplies no current library. + +For **every** raw class, the first event is an attempt to print `R`. If it +fails, execution stops by `println!` panic with output `p(R)`; the environment +is not read, and there is no library. If it succeeds, the remaining exhaustive +relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Events after `R`, in order | Output/exit | Current result | +|---|---|---|---| +| omitted | `env::var` gives `NotPresent`; attempt `L_s` | failure: `R+p(L_s)`, write panic; success: `R+L_s`, normal return | none on failure; exactly cfg `fixture_allocator="system"` and library attempt on success | +| Unicode `system` | `Ok`; `as_str`; literal arm; attempt `L_s` | same two outcomes | same | +| Unicode `arena` | `Ok`; `as_str`; literal arm; attempt `L_a` | failure: `R+p(L_a)`, write panic; success: `R+L_a`, normal return | none on failure; exactly cfg `fixture_allocator="arena"` and library attempt on success | +| Unicode `arena-stop` | `Ok`; literal arm; attempt `L_a`; if successful, explicit `panic!` | `R+p(L_a)`, write panic, or `R+L_a`, explicit panic | none in either case | +| every other Unicode value | `Ok`; wildcard arm; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | +| every non-Unicode value | `NotUnicode`; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | + +Thus the only normal exits are omitted/system→system and arena→arena, each +after exactly two successful stdout writes. `BUILD-MAP-ORDERED` is consumed +literally: a successful current script gives the library exactly its current +selector directive and no retained selector; an unsuccessful script gives no +current compilation or stale result. It also supplies the requested feature +and target cfg mapping. The source-level ordering/partition follows from the +arms at `build.rs:4-25`; no endpoint-only inference is used. + +## B-02: freshness certificate + +Assume a successful `arena` build in target directory `X`. Its successful `R` +records the raw variable dependency and its `L_a` selects arena. Changing the +present value to `arena-stop` makes that result stale under +`BUILD-MAP-ORDERED`, so Cargo reruns the script before current selection. The +rerun has exactly three possibilities: first write failure (`p(R)`), second +write failure (`R+p(L_a)`), or both writes followed by the explicit panic +(`R+L_a`). Every possibility exits unsuccessfully. The accepted premise says +none compiles a current library or presents the earlier arena library as this +build's result. The requested reuse sequence therefore rejects exactly as +documented. + +## B-03: source exclusion and source selection + +On target wasm32 with a successful arena selector, the accepted TCB supplies +both `target_arch="wasm32"` and `fixture_allocator="arena"`. The first cfg in +`src/lib.rs` therefore includes `compile_error!` for either feature, profile, +or debug state, and compilation fails. Hence every and only listed +target/allocator exclusion is effectively rejected; no current library API is +produced. + +For every `q∈Q`, cfg processing selects exactly one `lane_id` body: + +* if `C(q)`, lines 13-22 include the immediate unchecked return and lines + 24-37 are absent; +* if `¬C(q)`, the first block is absent and the second checks zero before its + unchecked constructor. + +The public safe surface is exactly `pub fn lane_id(u8)->NonZeroU8`. There are no +public fields, unsafe APIs/traits/impls, callbacks, exported macros, hidden +items, FFI, dependencies, or invariant-bearing stored state. The standard +macros are consumers of documented standard behavior, not generated public +surface. + +## Unsafe-operation and postcondition ledger + +**S-01 (`¬C`).** If `v=0`, the equality test enters `panic!` before unsafe code. +If `v≠0`, the dominating test establishes the sole precondition of +`NonZeroU8::new_unchecked(v)`; it returns a valid nonzero value. The adjacent +safety comment is an adequate local proof. This proves UB freedom for all +`P,D` and proves the zero-panic postcondition. + +**S-02 (`C`).** If `v≠0`, the unsafe constructor's sole precondition holds, so +this region is sound. If `v=0`, F-01 proves UB. Since zero/nonzero and +`C/¬C` are exhaustive, every point of `S` is proved sound and every point of +`(Q×U)\S` is proved unsound. Consequently no strict superset of `S` within +`Q×U` is sound: this establishes exact maximality, not merely a positive +remainder. + +**POST-01.** The documented implication `v=0 ⇒ lane_id(v) panics` is proved for +`¬C`. For `C,v=0`, the execution reaches UB before a defined return or panic +can be certified. Under the required whole-execution rule, that execution +cannot witness `CONTRACT-BROKEN`; no independent UB-free refutation exists in +this source. The full-product postcondition is therefore `UNPROVED`. + +## F-01 — unchecked zero behind a safe API + +* **Status:** soundness **UNSOUND**; proof artifact deficient. +* **Valid use:** choose any `p∈P,d∈D`, target aarch64, `burst=on`, allocator + arena, and call the public safe `lane_id(0)`. This point belongs to `Q×U` and + requires no caller safety obligation. +* **Reachability:** `C` includes lines 13-22 and the function immediately calls + `NonZeroU8::new_unchecked(0)`. +* **False proposition:** that unsafe function requires a nonzero argument; zero + falsifies it. +* **UB consequence:** the exact standard-library contract states that zero + causes UB, independently confirmed by the Reference invalid-value rule. +* **Proof defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced constructor invariant and is false for caller-controlled `u8`. +* **Minimum repair:** make a dominating `value==0` panic check apply to the + exceptional block (or remove that block), then re-audit all cfg cases. Merely + editing the comment cannot repair the safe API. + +## Rust axioms and TCB audit + +The material Rust 1.85.1 propositions were checked against these narrowly +scoped authorities: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “returns an + error if the environment variable is not set, or if the value is not valid + Unicode”; [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” +* [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + sequentially execute component statements; [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + “branches on a pattern.” These ground the source order, while `BUILD.md` + supplies the claimed complete raw partition. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) “Prints + to the standard output, with a newline,” and its [panic contract](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + says it panics if stdout writing fails. [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached construct according to its predicate; + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” + The [equality operators](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + are equality/inequality tests, and an [if expression](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes its consequent when its boolean condition is true. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and “This results in undefined behavior if the + value is zero.” The [Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) + says producing an invalid value is immediate UB and names `NonZero` as a type + with a custom valid range. + +`BUILD-MAP-ORDERED` is accepted only for: Cargo 1.85.1 execution; successful +rerun-line freshness including present-to-present changes; exact current +successful cfg-line interpretation with no retained selector; no library/stale +result after unsuccessful script exit; main-thread panic as unsuccessful; and +the named feature/target cfgs. Consumers are B-01–B-03 and source reachability. +No claim about emitted strings, source correctness, Rust semantics, backend, or +binary is imported. Its stated trigger—any Cargo/toolchain, manifest, script, +environment, target, source-cfg, or disposition change—requires re-audit; +source/API/docs/support changes likewise do. + +## Residual scope and attestation + +Manual rustc, invented cfgs, build-script override, unsupported targets, and +rejected raw values producing a library are outside the theorem exactly as +`BUILD.md` states. Rejected build executions and wasm32/arena have no API point +and are not counted as vacuously sound members of `S`. Every discovered build, +configuration, safe-surface, unsafe-operation, and requested postcondition +obligation has a status above; there is no sampled evidence or unresolved +supported configuration remainder. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/G.md new file mode 100644 index 0000000000..b70a0f21ac --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/G.md @@ -0,0 +1,208 @@ +# Source-only unsafe-code audit: supplied crate + +**Cutoff:** 2026-08-01. **Snapshot:** the complete supplied `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and `TCB.md`; no generated +source, dependencies, lockfile, tests, or prior audit were supplied or used. +Rust, standard library, edition, and Cargo are exactly 1.85.1, 1.85.1, 2021, +and 1.85.1. This is a Rust-abstract-semantics result, not a compiler-binary or +platform theorem. + +## Claims and verdicts + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the compiled public library is free of Rust UB over the supported domain | **UNSOUND** | F-1 gives a valid supported safe call, reaches `new_unchecked(0)`, falsifies its safety condition, and its contract says the result is UB. | +| `lane_id(value)` “Panics when `value` is zero” | **UNPROVED** | Proved on `not(K)` below. The only failing region executes UB, so it is not a UB-free `CONTRACT-BROKEN` witness. | +| Exact maximal sound API region | **PROVED** relative to `BUILD-MAP-ORDERED` | Both containments and maximality are proved below. | +| Ordered selector/rejection/freshness relation and wasm/arena source exclusion | **PROVED** relative to `BUILD-MAP-ORDERED` | Exhaustive staged relation below. | + +The combined mandatory result is therefore **soundness UNSOUND; panic +postcondition UNPROVED**. No design change affects these current-snapshot +verdicts. + +## Domain recovery + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `B={off,on}` be `burst`, `A={system,arena}`, `P` any Cargo profile, `D` either + debug-assertion state, and `v:u8` any safe API input; +* `C0=T×B×A×P×D`; +* `E(c) := target=wasm32-unknown-unknown ∧ allocator=arena`; +* `S := C0 ∖ E`, the supported compiled-library configurations; and +* `K(c) := burst=on ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena`. + +This is an equality, not a sample: `SUPPORT.md` says “these target triples,” +“both states,” “both allocator models,” “exactly one exclusion,” and “every +other combination,” and explicitly quantifies every profile and both `D` +states. Thus every member of `S` is promised and every promised library +configuration is in `S`; there is no policy conflict. `Cargo.toml` independently +fixes the sole feature and toolchain. Profiles and `D` do not occur in a source +predicate or arithmetic operation, so every proof below is parametric over +their fibers. + +The full required cases are (i) every supported Cargo build attempt for each +raw environment class and every possible relevant stdout success/failure +sequence, including required rejection outcomes, and (ii) every safe +`lane_id(v)` execution for `c∈S`. Manual `rustc`, invented cfgs, and build-script +overrides are expressly outside `BUILD.md`. + +## Checked semantic authority + +These are Rust 1.85.1 axioms, not extra project assumptions: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says it + returns `NotPresent` when “The variable is not set” and `NotUnicode` when the + value “is not valid Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + has exactly those two variants. The fixed key contains neither `=` nor NUL. +* A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements,” and a + [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + compares arm patterns sequentially and chooses the first match. [Literal + patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the value created by the literal”; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” [`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + extracts a slice containing the entire `String`. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached form from its predicate; [`all`/`not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + are true when all operands are true / their operand is false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message.” +* The [comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + and [`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + rules make `value == 0` select its consequent exactly for zero. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + says: “The value must not be zero,” and “This results in undefined behavior + if the value is zero.” + +Cargo's 1.85.1 documentation corroborates, but does not replace, the accepted +Cargo premise: build scripts communicate by `cargo::` lines on stdout +([life cycle](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script)); +`rustc-cfg` passes the value to compiler `--cfg` +([outputs](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)); +and `rerun-if-env-changed` reruns when the named value changes +([freshness](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). +Process failure, current-output identity, and stale-artifact non-presentation +are consumed only in the narrower wording of accepted `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Write `R` for the complete rerun line, `Sline` for the system cfg line, and +`Aline` for the arena cfg line. A failed `println!` may have emitted an +unspecified fragment `q` of that attempted output; no proof consumes `q`. + +1. Every path first attempts `R`. Failure exits by uncaught panic with output + `q`, performs no environment read, and produces no current library. + Success leaves the complete prefix `[R]` and only then calls `env::var`. +2. The result partition is exhaustive: absent; Unicode `system`; Unicode + `arena`; Unicode `arena-stop`; every other Unicode string (including empty); + and non-Unicode. Absence and `system` next attempt `Sline`; `arena` and + `arena-stop` next attempt `Aline`. Failure at any such second write exits by + uncaught panic with `[R]·q` and no current library. +3. Successful absent/`system` writes yield exactly `[R,Sline]`, normal return, + and exactly cfg `fixture_allocator="system"`. Successful `arena` yields + exactly `[R,Aline]`, normal return, and exactly cfg + `fixture_allocator="arena"`. These are the only successful selectors. +4. Successful `arena-stop` writes `[R,Aline]` and then explicitly panics. + Other-Unicode and non-Unicode explicitly panic with exactly the completed + directive prefix `[R]`, before attempting any allocator line. By + `BUILD-MAP-ORDERED`, every unsuccessful process produces no current library + even if a complete selector line was emitted; no prior selector is retained. + +This includes every stdout failure point and every claim-relevant partial +prefix. The raw partition is exact by `env::var`/`VarError`, the four literal +arms, and the wildcard; it creates only the two allocator models. + +On a successful selector, `BUILD-MAP-ORDERED` supplies exactly that allocator +cfg, maps `burst` and the three target triples to the named leaf cfgs, and +supplies no old selector. For `E`, the crate-level `all(wasm32,arena)` is true +for both feature states and `compile_error!` fails compilation. Conversely, +within `C0`, that conjunction is true only on `E`; hence the enforced exclusion +equals, rather than merely contains, the policy exclusion. All `S` cases reach +`lane_id` source. + +**Freshness certificate.** A successful `arena` build necessarily completed +`R`. In the same target directory, changing the raw value to `arena-stop` is a +present-to-present change. The exact accepted premise therefore makes the old +selection stale and reruns the script before current selection. The rerun +either fails a write or completes `[R,Aline]` and panics; all alternatives are +unsuccessful, compile no current library, and cannot present the old arena +library as the current result. + +## API, obligations, and exact maximal sound region + +The boundary inventory is complete: the crate exports only the safe free +function `lane_id(u8)->NonZeroU8`. There are no public fields, constructors, +traits/impls, callbacks, FFI, reexports, hidden items, or generated APIs. Its +only unsafe operations are the two cfg-complementary `new_unchecked` calls. +There is no persistent invariant-bearing representation. + +Cfg semantics makes the first block present exactly on `K` and the second +present exactly on `not(K)`; these predicates are complements, so exactly one +unsafe call exists in every `S` compilation. + +Define + +`M := {(c,v) ∈ S×u8 | ¬K(c) ∨ v≠0}`. + +**`M` is sound.** If `¬K` and `v=0`, the equality is true and `panic!` is +executed before the unsafe call; panic is not UB. If `¬K` and `v≠0`, that +branch is skipped and the dominating comparison establishes the exact +`new_unchecked` precondition. If `K` and `v≠0`, the input itself establishes +that precondition. These cases exhaust `M`; profile, debug assertions, and +panic strategy do not alter selection or the precondition. + +**Maximality/equality.** Inside `S×u8`, Boolean and integer case splitting gives +`(S×u8) ∖ M = {(c,0) | c∈S ∧ K(c)}`. Every such case reaches +`new_unchecked(0)`, whose required proposition is false and whose applicable +contract entails UB. Thus every point in `M` is sound and no point outside it +can be added: `M` is the exact maximal sound region. Over the pre-exclusion +product `C0×u8`, `E×u8` is rejected rather than a compiled API region; the +exact sound-or-rejected region is `(E×u8) ∪ M`. + +For the panic postcondition, all `¬K,v=0` cases execute `panic!`. The +`K,v=0` cases instead enter UB. Under whole-execution classification they prove +neither that a panic occurs nor a UB-free failure to panic, so the universal +postcondition is **UNPROVED**, not `CONTRACT-BROKEN`. + +## Finding F-1: unchecked zero in the special branch + +* **Implementation:** **UNSOUND**; **proof artifact:** false/deficient. +* **Valid use:** successfully build supported `aarch64-unknown-linux-gnu` with + raw `arena`, `burst` enabled, any profile/debug state, then safe-call + `lane_id(0)`. Safe callers have no precondition. +* **Reachability:** all three leaves of `K` are true, so the special block calls + `new_unchecked(0)`. +* **False proposition and consequence:** required `value≠0` is false; the + version-matched contract explicitly entails UB. +* **Comment defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced producer contract and is contradicted by the public `u8` input. +* **Minimum repair:** perform the zero check before every cfg-dependent unsafe + call (or use a checked constructor) and replace the comment with the + dominating-check derivation. Re-audit `M` and the panic contract. Merely + changing documentation cannot repair the safe API. + +The fallback comment's local fact is correct: its zero branch dominates the +unsafe call. No other implementation or proof finding was found after the +complete surface/configuration inventory; this does not dilute F-1. + +## TCB, residual scope, and triggers + +The sole admitted project entry is `TCB.md` / **BUILD-MAP-ORDERED**, accepted +for exact Cargo 1.85.1 and only its stated execution, stdout-success, +freshness, process-status, feature, target-cfg, and selector-identity +propositions. Consumers are the staged relation, reachability, freshness, and +exclusion proof above. It supplies no Rust semantics or source correctness and +has not been widened. The Rust links above are authoritative axioms. There are +no dependency, tool-derived, external, probabilistic, deployment, or backend +premises and no test evidence. + +Re-audit on any supplied source/policy/manifest change; Rust, std, Cargo, target, +feature, profile, cfg, allocator, environment interface, or TCB change; changed +authoritative wording; or any new public/unsafe surface. All requested source +and build outcomes were audited; binaries, actual compiler correctness, +platform execution, manual cfg injection, and target files not supplied are +outside scope. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/H.md new file mode 100644 index 0000000000..069ed51e9b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/H.md @@ -0,0 +1,107 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +## Claims, scope, and verdicts + +This is a source-only audit of `Cargo.toml`, `build.rs`, `src/lib.rs`, and the supplied build, support, request, and TCB policies, at cutoff 2026-08-01. It covers Rust/Cargo/standard library 1.85.1, the complete supported build interface, the only public safe API, both unsafe operations, the source-enforced exclusion, and the documented panic postcondition. No binary/backend claim is made; nothing was built, run, tested, generated, or expanded. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every valid safe `lane_id` call in the required library domain is free of Rust UB. | **UNSOUND** | `SOUND-1` below gives a valid supported zero-input witness reaching documented UB. | +| “Panics when `value` is zero” throughout that domain. | **UNPROVED** | Proved outside `U`; inside `U` the only execution has UB, so it cannot certify `CONTRACT-BROKEN`. | +| Ordered build mapping, rejection, and freshness behavior. | **PROVED relative to accepted `BUILD-MAP-ORDERED`** | Exhaustive raw-value/write-outcome partition `BUILD-1`; freshness proof `BUILD-2`. | +| wasm32/arena is effectively excluded. | **PROVED relative to `BUILD-MAP-ORDERED`** | `CFG-1`: every successful arena selection for wasm32 activates `compile_error!`. | +| Formula `S` below is the exact maximal sound region. | **PROVED relative to the stated TCB** | Positive proof on `S`; UB proof at every point of its complement in the supported domain. | + +The combined mandatory result is **UNSOUND; documented postcondition UNPROVED**. + +## Required theorem domain and closure + +Let `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, wasm32-unknown-unknown}`, `B={burst-off,burst-on}`, `A={system,arena}`, `P` be every Cargo profile, and `D={debug-assertions-off,on}`. The policy's full product is + +`F = T × B × A × P × D`. + +Its exact supported library predicate is + +`C = F ∖ {c ∈ F | target(c)=wasm32-unknown-unknown ∧ allocator(c)=arena}`. + +This is an equality, not an inferred narrowing: `SUPPORT.md` gives precisely these axes, all their combinations, and exactly that exclusion. `Cargo.toml` fixes Rust 1.85.1/edition 2021 and declares `burst`; `BUILD.md` fixes allocator selection. Profiles and debug assertions never occur in either selected function body, so all proofs below are parametric over `P×D`. + +Build-interface `Required` additionally quantifies over every raw `FIXTURE_ALLOCATOR` class (omitted, `system`, `arena`, `arena-stop`, other Unicode, non-Unicode) and success/failure of every attempted stdout write. A current API execution exists only after an accepted selector's successful script exit and successful non-excluded library compilation. For API soundness, `Required=C×{0,…,255}`: `u8` is the “8-bit unsigned integer type” ([`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)), and this safe function states no caller precondition. + +Closure is exhaustive: `BUILD-1` partitions all build cases; `C` partitions into `U` and `¬U`; inputs partition into zero and nonzero. Each obligation below covers every resulting case, so no sampled configuration substitutes for `Required ⊆ Covered`. + +## Authoritative Rust 1.85.1 premises + +These are the only Rust semantic axioms consumed: + +- **AX-ENV.** `env::var` returns `NotPresent` when “The variable is not set” and `NotUnicode` when its value “is not valid Unicode” ([`var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); `VarError` has exactly `NotPresent` and `NotUnicode(OsString)` ([`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html)). `String::as_str` “Extracts a string slice containing the entire `String`” ([`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). A match chooses “The first arm with a matching pattern” ([match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)); literal patterns match their literal and `_` matches any value ([literal](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern)). +- **AX-OUT/PANIC.** `println!` “Panics if writing to `io::stdout` fails” ([`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). +- **AX-CFG.** A `cfg` attribute “conditionally includes the thing it is attached to” ([`cfg`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); `compile_error!` “causes compilation to fail with the given error message” ([`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +- **AX-CONTROL.** For `if`, a true condition executes the consequent block ([`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is an equality operator ([comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). Thus the `u8` comparison exactly separates zero from nonzero. +- **AX-NZ.** `NonZero::new_unchecked` “Creates a non-zero integer value without checking”; “This results in undefined behavior if the value is zero” ([`new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). This is also the Reference's UB class “producing an invalid value” ([undefined behavior](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). + +## Ordered build-to-source relation + +Write `R` for the complete rerun line and `S`/`A` for complete `system`/`arena` cfg lines. `q(L)` means any byte prefix produced by the failing `println!` for line `L` (possibly empty); regardless of those bytes, the TCB says an unsuccessful execution supplies no current library. + +| Raw class and ordered events after entry | Emitted prefix; exit; current result | +|---|---| +| Any raw value; first print fails | `q(R)`; println panic/unsuccessful; no library | +| omitted or Unicode `system`; `R` succeeds; `S` fails | `R,q(S)`; println panic; no library | +| same; both prints succeed | `R,S`; normal return; cfg `fixture_allocator="system"` | +| Unicode `arena`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; both succeed | `R,A`; normal return; cfg `fixture_allocator="arena"` | +| Unicode `arena-stop`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; `A` succeeds | `R,A`; explicit panic; no library | +| other Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | +| non-Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | + +**BUILD-1.** AX-ENV and the fixed valid key make `env::var`'s result exactly absent, valid-Unicode `String`, or non-Unicode. AX-ENV/match/literals then select exactly the listed source arm. There are only the two `println!` sites in execution order; AX-OUT establishes each failure exit. Falling through `main` is successful. `BUILD-MAP-ORDERED` supplies only the stated Cargo consequences: a successful current script passes its exact cfg; every panic/write-failure exit compiles/presents no current library. Thus even a complete allocator directive in the `arena-stop` prefix has no effect. + +**BUILD-2 (freshness).** A successful `arena` run necessarily wrote `R` then `A`. The accepted TCB says that changing the raw present value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly three possibilities above: first print failure; `R` followed by allocator-print failure; or `R,A` followed by explicit panic. All are unsuccessful, and the TCB expressly forbids presenting the old arena library as the current result. The canary therefore rejects under reuse of the same target directory. + +**CFG-1.** On a successful arena selector, the TCB maps its emitted cfg exactly and maps the three target triples to their stated `target_arch`. AX-CFG makes `all(target_arch="wasm32", fixture_allocator="arena")` include `compile_error!` for both feature states; AX-CFG then forces compilation failure. Other raw rejection cases never reach current library compilation. The project exclusion is therefore enforced. + +The complete successful-output-to-source projection is therefore: + +| Emitted allocator cfg | Target/feature | Selected library source/result | +|---|---|---| +| `system` | every `T×B` | no source error; `U` is false; checked block | +| `arena` | x86_64, either feature | no source error; `U` is false; checked block | +| `arena` | aarch64, burst off | no source error; `U` is false; checked block | +| `arena` | aarch64, burst on | no source error; `U` is true; unchecked burst block | +| `arena` | wasm32, either feature | `compile_error!`; no current library artifact | + +No other allocator cfg reaches a current compilation. These cases are exhaustive by `BUILD-1` and the TCB's exact feature/target mappings. + +## API, obligations, and exact maximal sound region + +The entire public surface is safe free function `lane_id(u8)->NonZeroU8`; there are no public fields/types, traits, callbacks, FFI, reexports, hidden items, or generated/macro-generated APIs. `build.rs::main` is the audited build entrypoint. The two cfg-complementary `new_unchecked` calls are the only unsafe operations. The sole invariant consumed/established is that the returned `NonZeroU8` contains a nonzero integer. + +Define + +`U(c) := burst(c)=on ∧ target(c)=aarch64-unknown-linux-gnu ∧ allocator(c)=arena`. + +The exact maximal sound region over the full supported product and every API input is + +`S = {(c,v) ∈ C×{0,…,255} | ¬U(c) ∨ v≠0}`. + +**Positive proof.** If `U(c)`, AX-CFG includes only the first block; for `v≠0`, AX-NZ's sole safety requirement holds and it constructs the promised nonzero value. If `¬U(c)`, AX-CFG includes only the checked block. At `v=0`, AX-CONTROL reaches `panic!` before unsafe code. At `v≠0`, it skips the panic and the dominating comparison establishes AX-NZ's precondition. These cases cover `S`, independently of profile/debug-assertion state. + +**SOUND-1 and maximality.** Choose any profile/debug state, successful raw `arena`, aarch64 target, `burst` enabled, and safe input `0`. This configuration lies in `C`; `0` is a valid `u8`; the public call is valid safe use. `U` includes the unchecked block, which executes `new_unchecked(0)`. AX-NZ says that exact event is UB. Hence the full universal claim is **UNSOUND**. Every point of `(C×u8)\S` has exactly those three cfg facts and `v=0`, so the same proof establishes UB everywhere outside `S`; together with the positive proof, `S` is maximal, not merely a positive remainder. + +**Panic postcondition.** For every `c∈C` with `¬U(c)` and `v=0`, the checked branch invokes `panic!`, proving the documented implication. For `U(c),v=0`, execution instead has UB. Under the required whole-execution certificate, that is not a UB-free witness to a broken behavioral contract. Therefore the full postcondition is **UNPROVED**, not `CONTRACT-BROKEN`; its exact unresolved region is `{(c,0)|c∈C∧U(c)}`. + +## Finding and proof-artifact assessment + +**F-1 (critical implementation defect).** The first safety comment claims burst-mode lane identifiers are never zero, but the safe boundary accepts arbitrary `u8` and establishes no such invariant. The smallest repair is an unconditional zero check before either unsafe call (or a safe checked constructor), preserving the documented panic contract. Re-audit all cfg regions afterward. + +The second comment's dominating `value==0` branch does establish the required nonzero fact, so its implementation proof is correct on `¬U`; for proof-grade maintenance it should also name `new_unchecked`'s exact requirement and resulting `NonZeroU8` invariant. The first comment is false, not merely incomplete. + +## TCB audit log, evidence, residual scope, and triggers + +`BUILD-MAP-ORDERED` is the sole non-Rust admitted premise. Its human disposition is accepted only for Cargo 1.85.1, this exact manifest/build script/environment/library, successful-line interpretation, freshness/no-stale-result behavior, failure status, feature cfg, and target-arch cfg. This report consumes every listed part only in `BUILD-1`, `BUILD-2`, `CFG-1`, and reachability; it does not use it for source correctness. AX-ENV through AX-NZ are exact versioned Rust authority, not implementation trust. There are no dependencies, unsafe dependencies, tool results, tests, prior audits, or additional assumptions. + +Excluded/residual scope: compiler/backend correctness, binaries, custom/manual rustc cfgs, overridden build scripts, unsupported targets/toolchains, rejected raw selectors, and wasm32/arena artifacts. Re-audit on any source/manifest/policy/TCB change; Rust/Cargo/stdlib version change; target, feature, allocator, profile, environment, or cfg-domain change; or material authoritative-documentation change. + +All in-scope surfaces, raw classes, exits, prefixes, obligations, configuration partitions, mandatory postconditions, TCB consumers, and unresolved regions have dispositions. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/I.md new file mode 100644 index 0000000000..ab56821442 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/I.md @@ -0,0 +1,190 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +Audit cutoff: 2026-08-01. This is a source-level Rust 1.85.1/standard-library +1.85.1 audit of the supplied manifest, policies, `TCB.md`, `build.rs`, and +`src/lib.rs`; no backend or binary claim is made. No dependency, generated +file, test, prior audit, or tool result is present or used. + +## Claims and verdicts + +* **Safe-library soundness: UNSOUND.** A supported, well-typed safe call reaches + `NonZeroU8::new_unchecked(0)` (certificate `BAD` below). +* **Documented panic postcondition: UNPROVED**, not `CONTRACT-BROKEN`. It is + proved wherever its antecedent is relevant outside `BAD`; in `BAD`, the only + source execution already has undefined behavior, so it cannot be the required + UB-free postcondition witness. +* **Ordered build interface and exclusion: PROVED relative to the accepted + `BUILD-MAP-ORDERED` premise.** This includes all raw-selector classes, write + failures, partial prefixes, current-build rejection, and the stated + arena-to-arena-stop freshness sequence. + +The combined mandatory result is therefore **UNSOUND / postcondition +UNPROVED**, relative only to `TCB.md`'s accepted, exact Cargo premise and the +Rust axioms quoted below. + +## Exact domain and its recovery + +Let + +* `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`, `B={off,on}`, `A={system,arena}`; +* `P` be every Cargo profile and `D={debug_assertions off,on}`; and +* `U={0,...,255}`, exactly the values of `u8`. + +`SUPPORT.md` literally defines the base product `C0=T×B×A×P×D` and the sole +exclusion `E={c∈C0 | c.target=wasm32-unknown-unknown ∧ c.allocator=arena}`. +Thus the supported library predicate is exactly `C=C0\E`: `C⊆C0\E` follows +from “every other combination ... is supported,” and `C0\E⊆C` follows from +the same exhaustive product statement; the single exclusion proves the reverse +nonmembership. Rust/Cargo are exactly 1.85.1 and the edition is 2021. + +The raw environment partition is the disjoint, exhaustive set +`R={absent, U("system"), U("arena"), U("arena-stop"), U(other), non-U}`. +Here `U(other)` means every other Unicode string. `env::var` “Returns a +`VarError` if the variable is not present, or if it is not valid Unicode” +([Rust 1.85.1 `env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); +the two documented error variants and the `Ok(String)` case, followed by +equality with the three literals and `_`, prove both coverage and disjointness. +`String::as_str` “Extracts a string slice containing the entire `String`” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). +Accepted fibers are `absent,U("system") -> system` and `U("arena") -> arena`; +the other three are rejection cases, not allocators. Manual `rustc`, invented +cfgs, and build-script overrides are expressly outside `BUILD.md`'s theorem. + +The full required case domain is (i) every build-interface execution over `R`, +the supported target/feature/profile/debug axes, each stdout success/failure +possibility, and reusable prior Cargo-target state, plus (ii) every safe +`lane_id(v)` call for `(c,v)∈C×U` produced by an accepted current build. This +retains inputs, execution/history, and configuration rather than replacing +them by `Required_cfg=C`. + +## Complete ordered build relation + +Write `RERUN` for the complete first line and `CFG(a)` for the allocator line. +Blocks execute operations sequentially and a match chooses the first matching +arm ([block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html), +[match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). +`println!` “Panics if writing to `io::stdout` fails” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)). +Consequently: + +| Raw class | after successful `RERUN` write | terminal result if later writes succeed | +|---|---|---| +| absent | read `NotPresent`; attempt `CFG(system)` | return success | +| `U("system")` | read `Ok`; attempt `CFG(system)` | return success | +| `U("arena")` | read `Ok`; attempt `CFG(arena)` | return success | +| `U("arena-stop")` | read `Ok`; attempt `CFG(arena)` | explicit panic after that complete line | +| `U(other)` | read `Ok`; no allocator write | explicit unsupported-value panic | +| non-U | read `NotUnicode`; no allocator write | explicit valid-Unicode panic | + +This table lists every successful script path: exactly its first three rows. +Before every row, failure of the first write exits by panic with no complete +line (and possibly a byte-prefix of `RERUN`); the environment read and all later +steps are unreached. In the four rows that attempt `CFG`, failure of that second +write exits by panic after complete prefix `[RERUN]` (and possibly a byte-prefix +of `CFG`); its return or explicit later panic is unreached. The successful +`arena-stop` write produces complete prefix `[RERUN,CFG(arena)]` before its +explicit panic. The other explicit rejections leave complete prefix `[RERUN]`. +These are all stdout calls and all alternative exits in `build.rs`. + +`BUILD-MAP-ORDERED` supplies, for Cargo 1.85.1 and every profile, exactly the +following consumed facts: a complete successful `RERUN` registers changes in +the raw value (including present-to-present); only a successful current script's +complete `CFG(a)` reaches the current library compilation; no prior selector is +retained; any write failure or uncaught explicit panic is unsuccessful; and an +unsuccessful script yields no current library or prior artifact as the current +result. Therefore arbitrary failed-write byte prefixes and every complete +prefix above are inert for source selection. + +**Freshness witness.** For a successful arena build (necessarily x86_64 or +aarch64 once the source exclusion is applied), the first run successfully wrote +`RERUN,CFG(arena)`. In the same target directory, raw `arena -> arena-stop` is a +registered present-to-present change, so Cargo reruns before selection. The new +run either fails at write 1, fails at write 2, or writes both lines and then +panics. Every exhaustive case is unsuccessful and `BUILD-MAP-ORDERED` forbids +both a current compilation and presentation of the earlier arena library. + +**Target exclusion.** A successful raw-arena script gives exactly +`fixture_allocator="arena"`; the accepted TCB maps the wasm triple to +`target_arch="wasm32"`. The `all` predicate on `lib.rs:3` is then true, +regardless of `burst`. A `cfg` attribute includes its item when true and removes +it when false +([Reference 1.85.1](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); +`compile_error!` “Causes compilation to fail with the given error message when +encountered” +([std 1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +Thus every wasm/arena current compilation fails; if the script failed earlier, +the TCB already forbids compilation. No later-source fact is used on that exit. +For all other target/allocator pairs this particular `all` is false, so the +error item is absent. This proves exactly `E`, not a wider exclusion. + +## API, invariants, and unsafe obligations + +The complete language-reachable crate API is the safe free function +`lane_id(u8)->NonZeroU8`; there are no public fields, constructors of a local +type, traits/impls, macros, statics, FFI, reexports, callbacks, or dependencies. +Build code contains no unsafe operation. The two unsafe sites are +`lib.rs:21` and `lib.rs:36`. The consumed standard-library contract is exact: +`new_unchecked` “Creates a non-zero without checking whether the value is +non-zero. This results in undefined behavior if the value is zero,” and its +safety clause is “The value must not be zero” +([Rust 1.85.1](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +Define `H(c) = c.target=aarch64-unknown-linux-gnu ∧ c.burst=on ∧ +c.allocator=arena`. Accepted Cargo mappings and Rust `cfg(all(...))` semantics +make `H` select the first block and remove the `not(all(...))` block; `¬H` does +the reverse. + +* If `H(c)∧v!=0`, line 21 satisfies the exact unsafe precondition and returns + the corresponding nonzero value. +* If `¬H(c)∧v=0`, `if value==0` reaches `panic!` before line 36. If + `¬H(c)∧v!=0`, the false branch itself establishes the proposition needed by + line 36. Thus the second safety comment is adequate and this entire case is + UB-free. Profile, debug-assertion state, and panic strategy cannot alter the + cfg or value partition; abort versus unwind occurs only after the proved + zero-input panic and no invariant is suspended. +* **`BAD`:** choose any profile/debug state, `c=(aarch64,burst on,arena,...)∈C` + and safe input `v=0`. The public safe call is valid; `H(c)` reaches line 21; + its required `v!=0` proposition is false; the quoted contract directly + entails undefined behavior. This is a complete existential UB certificate. + The adjacent claim “Burst-mode lane identifiers are never zero” is false: + the API accepts every `u8` and enforces no such invariant. + +Therefore the **exact maximal sound region** over the requested full product is + +`SOUND = C×U \ { (c,0) | H(c) }`. + +Positive inclusion follows from the first two bullets. Reverse inclusion and +maximality follow because every omitted case satisfies `H∧v=0` and the `BAD` +derivation is parametric in profile/debug state, proving UB for every such +case—not merely one sample. The regions partition `C×U` exhaustively by +`H/¬H` and `v=0/v!=0`. + +The panic postcondition is proved for every zero input in `¬H`: the check +executes `panic!`, which “Panics the current thread” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). It imposes no +claim for nonzero inputs. For `H∧v=0`, UB precedes any panic, leaving the global +postcondition `UNPROVED` and supplying no `CONTRACT-BROKEN` certificate. + +## Finding, TCB log, and residual scope + +**F-1 (critical, UNSOUND; proof comment deficient).** `lib.rs:13-22` hides an +unenforced nonzero precondition behind a safe API. Minimum repair: perform the +zero check before either cfg branch (or use checked `NonZeroU8::new` and panic +on `None`), then replace the first safety comment with the dominating check's +exact `value!=0` derivation. Re-audit all `C×U`, both panic strategies, and the +documented panic after any change. + +**TCB log `supplied-TCB/BUILD-MAP-ORDERED`.** Category `IMPLEMENTATION`, human +disposition accepted; identity Cargo 1.85.1 plus the supplied manifest/build +interface; consumers are only ordered output interpretation, raw-value +freshness, feature/target/cfg reachability, selected source, and rejection. It +does not supply local emission order, source correctness, Rust semantics, +backend, or binary correctness; those were not widened. No other admitted +premise is consumed. Re-audit on any toolchain, source, manifest, policy, +target, cfg, feature, environment-interface, or TCB-disposition change. + +Residual scope: compiler/backend correctness, binaries, manually manufactured +cfgs, unsupported targets/toolchains, and overridden build machinery. Tool +evidence: none. The current global failure is proved rather than inferred from +missing tests. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/J.md new file mode 100644 index 0000000000..bfc973ce24 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/B/reports/J.md @@ -0,0 +1,199 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +Snapshot: the supplied `Cargo.toml`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, +`build.rs`, and `src/lib.rs`; Rust and standard library 1.85.1, edition 2021. +No target was built, run, expanded, or modified. There are no dependencies or +generated source files. The only accepted non-Rust premise is +`BUILD-MAP-ORDERED` in the supplied `TCB.md`. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {off,on}` for `burst`, `A = {system,arena}`, `P` be every Cargo + profile, `D = {off,on}` for debug assertions, and `U = {0,...,255}`; +- `Q = {1.85.1} × T × B × A × P × D`; and +- `L = Q \ {q | target(q)=wasm32-unknown-unknown ∧ allocator(q)=arena}`. + +`Q` is the literal product in `SUPPORT.md`; the displayed subtraction is its +sole stated exclusion, so both containments establishing this normalization +follow directly from lines 3–16. Required library/API cases are `L × U`. +Profiles, debug assertions, and their panic strategies remain symbolic: no +source predicate or unsafe precondition depends on them. + +**Soundness: UNSOUND** for the complete crate over the required source-level +domain, relative to `BUILD-MAP-ORDERED`. A valid witness is any profile/debug +state with target `aarch64-unknown-linux-gnu`, `burst=on`, allocator `arena`, +and the safe call `lane_id(0)`. This configuration is in `L`. The selected +block at `lib.rs:12–20` executes `NonZeroU8::new_unchecked(0)`. Its safety +condition is false and its exact 1.85.1 contract says this is undefined +behavior (AX-5 below). This completes the existential certificate. + +**Documented postcondition: UNPROVED** globally. `lib.rs:8–10` promises that +`lane_id` “Panics when `value` is zero.” This is proved regionally whenever +`C(q) := burst(on) ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena` is +false: zero enters `lib.rs:28–30` and panics before unsafe code. In the `C` +region, zero instead reaches UB. That refutes soundness but cannot be a +`CONTRACT-BROKEN` witness because the execution is not UB-free as a whole; no +independent UB-free refutation is established. + +### Exact maximal sound region + +The exact maximal sound subset of the full supported configuration/input +domain is + +`M = {(q,v) ∈ L × U | ¬(C(q) ∧ v=0)}`. + +Proof of inclusion: if `C` is true and `v≠0`, `lib.rs:12–20` supplies the exact +nonzero precondition to `new_unchecked`. If `C` is false, the complementary +block at lines 22–33 is selected. For `v=0` it panics before the unsafe call; +for `v≠0`, falling through the check establishes the unsafe precondition. +These are the crate's only unsafe operations. Proof of maximality: the +complement of `M` inside `L×U` is exactly every profile/debug fiber satisfying +`C ∧ v=0`; the witness derivation above applies parametrically to every such +fiber. Thus every complement member is unsound and no strict superset within +`L×U` is sound. + +## Ordered build-to-source relation + +Write `R`, `S`, and `A` for the complete newline-terminated lines +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, +`cargo::rustc-cfg=fixture_allocator="system"`, and +`cargo::rustc-cfg=fixture_allocator="arena"`. A failing `println!` panics at +that point. The supplied premises do not constrain bytes partially written by +the failing call; below, “prefix” means the exact earlier successfully written +complete directive-line prefix. This byte-level remainder is immaterial because +`BUILD-MAP-ORDERED` forbids a current library compilation after every +unsuccessful exit. + +1. `build.rs:4` first attempts `R`. Failure exits by panic, with complete-line + prefix `[]`; the environment read and all later operations are unreached. + Success leaves prefix `[R]` and reaches `env::var`. +2. The literal key has neither `=` nor NUL. Rust's documented result therefore + partitions raw values into omitted → `Err(NotPresent)`, Unicode `s` → + `Ok(String(s))`, and non-Unicode → `Err(NotUnicode(_))`. `Result` and + `VarError` each have exactly the variants matched at lines 6–25. `as_str` + exposes the entire Unicode string; literal patterns match exactly and `_` + matches every remainder. +3. Omitted and Unicode `system` each attempt `S`; Unicode `arena` attempts + `A`. Failure of that second write exits at the `println!`, with prefix + `[R]` (plus unconstrained failed-call bytes). Success leaves respectively + `[R,S]` or `[R,A]`, then the function returns successfully. These are all + successful paths, and each attempts exactly one allocator directive. +4. Unicode `arena-stop` attempts `A`. A write failure exits with prefix `[R]` + and never reaches its explicit panic. A successful write leaves `[R,A]`, + then line 19 explicitly panics. Unicode values other than the three named + literals panic at line 21 with prefix `[R]` and never attempt an allocator + line. Non-Unicode values do likewise at line 24. Together with first-write + failure, these are every explicit/infrastructure rejection and every + material exit. +5. Only the two successful prefixes are consumed downstream. By + `BUILD-MAP-ORDERED`, successful `[R,S]` passes exactly + `fixture_allocator="system"`; successful `[R,A]` passes exactly + `fixture_allocator="arena"`. Every failed path produces no current library, + irrespective of complete or partial stdout already emitted. No later Cargo + cfg interpretation or library source selection is attributed to an earlier + exit. + +Freshness is closed, including the required sequence. A successful `arena` +build wrote `[R,A]`, so Cargo recorded the raw-variable invalidation rule. +Changing the same target directory's raw value to `arena-stop` is a +present-to-present change; `BUILD-MAP-ORDERED` makes the old selection stale +and reruns the script before current source selection. That run necessarily +ends at the first-write failure, second-write failure, or explicit panic. +The accepted premise says every such outcome compiles no current library and +does not present the prior arena library as the current result. + +For a successful current script, the same premise maps `burst` and the three +target triples to their exact cfg leaves. Rust cfg semantics then make +`all(target_arch="wasm32", fixture_allocator="arena")` true exactly for the +stated excluded pair, independent of `burst`, profile, and debug assertions. +The encountered `compile_error!` at `lib.rs:3–4` rejects compilation. Conversely +that predicate is false for every member of `L`, so this error is absent. The +project's target/allocator exclusion is therefore **PROVED effectively +enforced**, and no excluded current library is produced. + +## Boundary, invariant, and obligation coverage + +The build-script entrypoint is safe Rust. The sole downstream public surface +is safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, +constructors beyond that function, user-implementable traits, exports, FFI, +statics, or generated/hidden APIs. The two cfg alternatives contain the only +unsafe calls (`lib.rs:19,32`). Invariant `NZ(value): value≠0` must hold at each +call. Lines 28–31 establish it on the ordinary path. The comment at line 18 +merely asserts it on the burst path, but a safe `u8` parameter admits zero and +no producer, type, check, or accepted TCB entry establishes `NZ` there. + +Obligation dispositions: + +- build raw-value partition, operation order, successful outputs, failures, + freshness, and Cargo interpretation: PROVED relative to `BUILD-MAP-ORDERED`; +- wasm/arena rejection and complementary source selection: PROVED; +- ordinary-path unsafe precondition and zero panic: PROVED; +- burst/aarch64/arena unsafe precondition: UNSOUND at zero, PROVED for nonzero; +- global documented zero-panic guarantee: UNPROVED, region as stated above. + +## Rust authority and TCB log + +All quotations and links are version 1.85.1 and apply to this exact toolchain. + +- **AX-1 (environment/result).** [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html): + “Returns `VarError::NotPresent`” when unset and “Returns + `VarError::NotUnicode` if the variable’s value is not valid Unicode.” + [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) is + `NotPresent | NotUnicode(OsString)`; [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) + is `Ok(T) | Err(E)`. Consumers: build partition. +- **AX-2 (patterns/order).** [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” + [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the same value as what is created by the literal”; the + [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements and + then its final optional expression.” Consumers: exhaustive ordered relation. +- **AX-3 (panic/output).** [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) + “Prints to the standard output, with a newline” and [“Panics if writing to + `io::stdout` fails.”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the + current thread.” Consumers: build exits and zero postcondition. +- **AX-4 (selection/rejection).** The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + “conditionally includes the thing it is attached to based on a configuration + predicate”; [`all` and `not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + mean respectively all predicates true and the predicate false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message when encountered.” + Consumers: exclusion and the complementary lane blocks. +- **AX-5 (integer/unsafe contract).** [`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + is “The 8-bit unsigned integer type,” with `MIN=0` and `MAX=255`. + [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and zero “results in undefined behavior.” + Consumers: `NZ`, witness, and maximal region. + +**BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo +1.85.1 proposition in `TCB.md:8–39`, consumed only for rerun/freshness, +process-status handling, exact current allocator cfg, feature/target cfg, source +selection, and lack of a current/stale artifact after failure. It is not widened +to Rust semantics or source correctness. No other additional premise or tool +evidence is consumed. + +## Findings and remediation + +**F-1 — UNSOUND safe API.** `lib.rs:18` reverses an unsupported assertion into +the precondition of `new_unchecked`; callers control the safe `u8`. Minimal +repair: perform the zero check on every cfg path (prefer +`NonZeroU8::new(value).expect(...)`) and remove the invalid comment, or change +the API to accept `NonZeroU8` if contract compatibility permits. Re-audit the +new snapshot and its panic behavior. + +**F-2 — deficient proof artifact/postcondition.** The line-18 SAFETY comment +does not identify an enforcing fact and the implementation cannot establish the +documented zero panic in that region without first avoiding UB. Repair F-1 and +use adjacent proof text: “`value == 0` panicked above; reaching this call proves +`value != 0`, satisfying `new_unchecked`.” Changing the safe API or panic +contract requires compatibility review. + +Residual scope is source-level Rust only; compiler backend, binaries, and +deployment are not claimed. Re-audit on any source, policy, Cargo/Rust, +target/feature/allocator, cfg, TCB-disposition, or authoritative-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/PACKET.json new file mode 100644 index 0000000000..43ec1b944d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/PACKET.json @@ -0,0 +1,26 @@ +{ + "allowlist_sha256": "afe540a0e03212b0d8554a6a522d2a5695a0eaadf07126c410ef831a563b9623", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "L", + "raw_score_sha256": { + "s1": "87526ee57cfbfc1982ea9fdf0470262453682430fc4fe0193d26e7c0c0fc317b", + "s2": "99564b83ed633e6194dbb67918706172806638a651a800fc3a7d5d939c99d479" + }, + "report_sha256": { + "A": "d74c89e74f1a4cc352183cea151c4ac387fea502d6c9a88e8ee7c1b63612fce8", + "B": "da0d4553898b5177722b6739562ef75fa4d6baf228dd1818f8f7e39e42167356", + "C": "141d0ee3549279a6d90aab62c89bc12d0f85a994bbfcdc4c5d29102001a1cc67", + "D": "1eb7ccc5e3184fe8e43a576150a25f498bf6f1e514486fde15ece31fd660e3e6", + "E": "ce572d45451eaf768a3731e7a09f92a21d813c1b3fe1940260b4eb70a58b933d", + "F": "593b40969c0e46fab20eaa7be52d261dbc21dc0091a4e0c981acf53e6b8f21a9", + "G": "9710335249669b879feff80e14868026cb6161579aefe7fb97213aa0af27872f", + "H": "48b4903ce42d924f6c1f532d6685a79209756520980218163e5ca6aaebd1040e", + "I": "36f4b173f16b9fbeaeed4b9cf467e501d0c986eb4c8ebd3654467e6a5c27a434", + "J": "9ee2c47518f8d65a91c84a208bdec4050c516fe6ea1c6dcf6da45299451f9bed" + }, + "rubric_sha256": "4da5564ee971cdb7d8584c60c62b87a0c377efbe1a69b60576f22364b412b02a", + "schema_sha256": "c7720030785e0d87c17d1a1ed44a9ecf260571a459be50b0fd2df15931ffa8e5", + "schema_version": 1, + "source_score_packet_sha256": "a63d08c8b17e6f9a05e8ca9c65bfeea75813b9ab005eef0466f6b904f61efa24", + "target_byte_tree_sha256": "cc05da115d055febc313edcdf18bae59a6230a63583bf918ad29e89eb06a4266" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/RUBRIC.md new file mode 100644 index 0000000000..e16d3af5a3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/RUBRIC.md @@ -0,0 +1,146 @@ +# Mode L Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file, its atom labels, expected +> result, or hard-error rules to an evaluated report agent. + +## Exact result + +Within the scope in `REQUEST.md`, `last` is sound. On the `else` branch, +`bytes.is_empty()` evaluated to false. The documented relation between +`is_empty` and slice length therefore gives `bytes.len() != 0`. Slice length has +type `usize`, whose values are nonnegative, so `bytes.len() > 0`. Consequently +`bytes.len() - 1` neither underflows nor overflows and mathematical subtraction +gives `index < bytes.len()`. This is precisely the in-bounds fact required by +`get_unchecked` for a `usize` index. + +The existing comment states only a lifetime fact. It does not address the +unsafe callee's in-bounds obligation, the facts which establish it, or the +derivation between them. It is therefore a deficient proof artifact even though +the implementation obligation can be reconstructed. A replacement must expose +that chain locally and must link or unambiguously refer to the checked, +version-matched authority entries it consumes. + +## Atoms + +- **L1 — Callee obligation:** State that the executed `get_unchecked(index)` + requires `index` to be in bounds, equivalently `index < bytes.len()` for this + `usize` index, and that an out-of-bounds call is UB. + - `scope_basis`: `lib.rs` contains this unsafe call and `REQUEST.md` asks for + an implementation soundness audit. + - `dependencies`: none. +- **L2 — Branch fact:** Establish from the actual `if`/`else` control flow that + `bytes.is_empty()` is false on the unsafe-call path, then use the exact + `is_empty` contract to conclude `bytes.len() != 0`. + - `scope_basis`: necessary source-path premise for the requested local proof. + - `dependencies`: none. +- **L3 — Unsigned-domain step:** Establish that the slice length is a `usize` + and, using its nonnegative value domain, derive `bytes.len() > 0` from L2. + - `scope_basis`: necessary material bridge from nonemptiness to safe + subtraction in every supported pointer width. + - `dependencies`: L2. +- **L4 — Defined subtraction:** Establish that `bytes.len() - 1` has no integer + overflow or underflow on this path, including in every ordinary profile. + - `scope_basis`: the source performs built-in integer subtraction before the + unsafe call; its definedness is part of the requested soundness proof. + - `dependencies`: L3. +- **L5 — In-bounds derivation:** Use the assignment + `index = bytes.len() - 1` and ordinary integer arithmetic to derive + `index < bytes.len()`. + - `scope_basis`: the exact proposition needed to discharge L1. + - `dependencies`: L3, L4. +- **L6 — Implementation closure:** Connect L2–L5 to L1 and report the + implementation obligation `PROVED` over the entire stated Rust/target/profile + scope; do not infer implementation failure from comment failure. + - `scope_basis`: `REQUEST.md` explicitly asks for an implementation verdict + over its full scope. + - `dependencies`: L1, L2, L3, L4, L5. +- **L7 — Artifact verdict:** Separately report the existing `SAFETY` comment + materially deficient because its lifetime statement does not address either + the exact in-bounds obligation or the material derivation which discharges + that obligation. + - `scope_basis`: `REQUEST.md` explicitly asks for a separate comment-adequacy + determination. + - `dependencies`: L1, L2, L3, L4, L5. +- **L8 — Replacement proof artifact:** Supply proposed adjacent comment text + which identifies the `get_unchecked` obligation and exposes the L2–L5 chain, + with unambiguous references to the checked authority propositions. + - `scope_basis`: `REQUEST.md` explicitly requests replacement wording when + material reconstruction is needed. + - `dependencies`: L1, L2, L3, L4, L5. +- **L9 — Complete premise inventory:** Inventory every materially consumed + Rust/std premise: `if` branch selection, `is_empty`/length equivalence, + `len`'s type/meaning, `usize`'s value domain, built-in + subtraction/overflow, and `get_unchecked`'s safety contract. Classify the + immediate placement and assignment observations as source facts and the + remaining integer implications as mathematics rather than inventing + authority for them. + - `scope_basis`: `REQUEST.md` explicitly requires a complete Rust-premise + inventory and reconciliation; distinguishing source facts and mathematics + identifies which proof leaves require Rust/std authority. + - `dependencies`: L1, L2, L3, L4, L5. +- **L10 — Exact checked authority:** For every Rust/std entry in L9, give the + matching Rust 1.82.0 narrow URL, quote the exact prose which supplies the + premise, state the verified proposition, and qualify its applicability. Page + identity or an unexamined citation alone does not pass. + - `scope_basis`: `REQUEST.md` explicitly requires version-matched checked + authority and exact extracted propositions. + - `dependencies`: L9. +- **L11 — Reconciliation:** Explicitly reconcile proof to inventory: every + materially consumed Rust/std premise has an L10 entry, every listed entry is + actually consumed, and no TCB assumption or uncited Rust fact silently fills + a link. + - `scope_basis`: `REQUEST.md` explicitly requires this reconciliation and + states that the TCB is empty. + - `dependencies`: L1, L2, L3, L4, L5, L9, L10. + +Score atoms independently. Mathematical implications between stated integer +facts need derivation but no Rust citation. Immediate source syntax may be cited +by source location rather than external authority. + +## Hard errors + +- **LH1:** Report the implementation `UNSOUND` or `UNPROVED` solely because the + existing comment is deficient, despite reconstructing L1–L5 correctly. +- **LH2:** Explicitly call the existing comment adequate. +- **LH3:** Claim the requested implementation proof complete while omitting a + material link from L1–L5. +- **LH4:** Claim the requested authority/premise reconciliation complete while + silently consuming a Rust/std premise, using an inapplicable version, or + treating a page URL as proof without checking the proposition. +- **LH5:** Use build, test, execution, lint, or dynamic-analysis success as a + universal proof of this obligation. + +An omitted artifact verdict fails L7 but is not independently a hard error +unless the report also makes an affirmative false claim covered above. + +## Checked authority + +- Rust 1.82.0 slice `get_unchecked`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked` + — for a `usize` element index, an out-of-bounds call is UB even when the + result is unused; the proof consumes the corresponding `index < len` + requirement. +- Rust 1.82.0 slice `len`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len` + — returns the number of elements as `usize`. +- Rust 1.82.0 slice `is_empty`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty` + — returns true exactly when the slice has length zero. +- Rust 1.82.0 Reference, `if` expressions: + `https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions` + — when the condition evaluates to false, the consequent block is skipped and + the trailing `else` block is executed. +- Rust 1.82.0 Reference, arithmetic operators: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators` + — `-` is built-in subtraction for integer operands. +- Rust 1.82.0 Reference, integer overflow: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow` + — identifies overflow for built-in integer operators and its profile/context + behavior; L3 proves the exceptional case absent here. +- Rust 1.82.0 Reference, unsigned integer value domains: + `https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types` + — `usize` is an unsigned integer type and its values are nonnegative. + +There is no accepted TCB entry for this mode. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/allowlist.txt new file mode 100644 index 0000000000..7c3ef37288 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/allowlist.txt @@ -0,0 +1,7 @@ +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty +https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow +https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/consistency.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/consistency.schema.json new file mode 100644 index 0000000000..04f2f75ba5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/consistency.schema.json @@ -0,0 +1,72 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-consistency-review-v1", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "mode", + "atom_family_attestations", + "defect_family_attestations", + "challenges", + "ambiguities" + ], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "atom_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["atom_id", "all_ten_reports_compared", "evidence"], + "properties": { + "atom_id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "defect_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["field", "all_ten_reports_compared", "evidence"], + "properties": { + "field": { + "type": "string", + "pattern": "^(hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "challenges": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "recommended_decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "recommended_decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/raw-scores/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/raw-scores/s1.json new file mode 100644 index 0000000000..da2e7dcb4f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/raw-scores/s1.json @@ -0,0 +1,239 @@ +{ + "schema_version": 1, + "mode": "L", + "scorer_id": "s1", + "reports": [ + { + "label": "F", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "Calls in-bounds the exact get_unchecked obligation, notes OOB is UB, and derives I < L."}, + {"id": "L2", "decision": "FAIL", "evidence": "AX-IF quotes false => else but the proof uses the unsupported converse else => false."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN explicitly identifies L as an element count represented as usize; as a natural count, L != 0 yields L >= 1."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability/profile independence as predecessor arithmetic without checking Rust subtraction or overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 explicitly derives I = L - 1 and 0 <= I < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The full-scope PROVED closure depends on the unsupported branch, usize-domain, and subtraction premises."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately deems the lifetime-only comment deficient because it omits the bounds obligation and derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "Supplies adjacent text from false is_empty through nonzero length, defined predecessor, and the in-bounds conclusion."}, + {"id": "L9", "decision": "FAIL", "evidence": "The four-entry inventory omits built-in subtraction/overflow and the rubric's separate usize-domain entry."}, + {"id": "L10", "decision": "FAIL", "evidence": "Required numeric/subtraction/overflow entries are absent, and AX-IF's quote does not establish the proposition claimed."}, + {"id": "L11", "decision": "FAIL", "evidence": "Its claim that no other Rust proposition is consumed conflicts with the unchecked numeric and control-flow premises."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Claims a complete authoritative reconciliation while silently consuming subtraction/overflow semantics and reversing AX-IF."}, + {"id": "G11", "evidence": "The positive verdict necessarily relies on unchecked subtraction/overflow semantics and an inapplicable implication direction for AX-IF."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is only a repair; the current-artifact verdict is not based on its implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "The asserted Rust-only TCB omits consumed subtraction/overflow authority and overclaims the cited if proposition."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences only the supplied source and versioned allowlisted Rust authorities."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states the in-bounds requirement and OOB UB for the usize call."}, + {"id": "L2", "decision": "PASS", "evidence": "O1 and AX-IF establish false on the else path; AX-EMPTY contraposition yields n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN and AX-USIZE establish n: usize, unsigned, hence n > 0."}, + {"id": "L4", "decision": "PASS", "evidence": "O2 checks subtraction and overflow authority and proves n - 1 representable in every profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 derives 0 <= n - 1 < n and identifies index with that value."}, + {"id": "L6", "decision": "PASS", "evidence": "Gives full requested scope, exhaustive branch coverage, and an explicit Required subset-of Covered certificate."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately marks the lifetime comment deficient for omitting the exact bounds proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false branch, zero-length contract, positivity, no underflow, index < len, and get_unchecked's requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "Inventories if, is_empty, len/type, usize, subtraction, overflow, and get_unchecked, separating source facts and mathematics."}, + {"id": "L10", "decision": "PASS", "evidence": "Each consumed Rust/std premise has a narrow 1.82.0 URL, exact excerpt, proposition, consumer, and applicability statement."}, + {"id": "L11", "decision": "PASS", "evidence": "Explicitly maps every AX entry to O1-O3 and states no unlisted Rust/std or tool premise supplies an inference."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is not used to certify the current implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The Rust 1.82 authority inventory is complete, applicable, checked, and reconciled."}, + "visible_scope_defect": {"present": false, "evidence": "The report stays within the supplied source and allowlisted versioned authority."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A7 identifies in-bounds indexing as required and an OOB index as UB."}, + {"id": "L2", "decision": "FAIL", "evidence": "A2 quotes false => else but claims that execution of else entails false, reversing the cited implication."}, + {"id": "L3", "decision": "PASS", "evidence": "A3 gives len's usize type and A4 gives unsigned nonnegativity, yielding L >= 1 from L != 0."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 plus L >= 1 establish representability and no overflow under any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 identifies index = L - 1 and derives 0 <= index < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The claimed exhaustive full-scope closure depends materially on A2's unsupported converse."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately calls the current lifetime-only comment deficient and distinguishes artifact from implementation."}, + {"id": "L8", "decision": "PASS", "evidence": "Provides adjacent wording covering false branch, zero-length implication, nonzero length, defined predecessor, bound, and callee requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A7 inventory all required Rust/std leaves and identifies remaining derivation as source facts or mathematics."}, + {"id": "L10", "decision": "FAIL", "evidence": "The exact A2 excerpt does not supply its verified proposition that else execution entails a false condition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact reconciliation overlooks the unsupported direction of the consumed branch premise."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Attests complete premise reconciliation although A2's quoted authority does not establish the branch proposition consumed."}, + {"id": "G11", "evidence": "The PROVED result necessarily relies on an invalid converse of the quoted if rule."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement is a documentation proposal, not evidence for the current proof."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-1 overstates what its A2 authority excerpt verifies."}, + "visible_scope_defect": {"present": false, "evidence": "No prohibited material or out-of-scope inspection is evidenced."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states the in-bounds obligation and OOB UB; the proof targets index < len."}, + {"id": "L2", "decision": "FAIL", "evidence": "AX-IF supplies false => else, not the claimed else => false needed on the unsafe path."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize and AX-USIZE gives nonnegativity, so n != 0 implies n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "AX-SUB/AX-OVERFLOW and n >= 1 prove n - 1 representable under every overflow setting."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 4 derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "Its closure relies on the unsupported AX-IF converse and defines Required without the valid-call/input dimension."}, + {"id": "L7", "decision": "PASS", "evidence": "Correctly separates a deficient lifetime comment from a sound implementation claim."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text gives false branch, len > 0, non-underflowing subtraction, index < len, same slice, and get_unchecked."}, + {"id": "L9", "decision": "PASS", "evidence": "Inventories all seven required Rust/std premises and classifies local/source and arithmetic reasoning."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF's quoted sentence does not verify the report's only-for-false proposition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The stated exact reconciliation misses the invalid implication direction at the control-flow leaf."} + ], + "hard_errors": [ + {"id": "G1", "evidence": "The formal Required product omits valid calls/inputs even though the full PROVED verdict quantifies over them."}, + {"id": "LH4", "evidence": "Claims every nonlocal premise is checked and reconciled while AX-IF does not support the consumed converse."}, + {"id": "G11", "evidence": "The positive proof necessarily relies on an inapplicable direction of its cited if authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The comment repair is not treated as implemented current evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "The asserted Rust-only authority set contains an unsupported AX-IF proposition."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied source and allowed Rust pages."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A4 states OOB UB and the required in-bounds usize index."}, + {"id": "L2", "decision": "FAIL", "evidence": "A3 quotes only false => consequent skipped and vaguely invokes other branch rules; it does not extract authority proving else-path false."}, + {"id": "L3", "decision": "FAIL", "evidence": "It calls the element count a natural number but never verifies len's usize type or usize's nonnegative domain."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability/no underflow across profiles without inventorying built-in subtraction or Rust overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 explicitly derives index = n - 1 with 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The PROVED closure depends on unsupported control-flow, unsigned-domain, and subtraction premises."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately finds the lifetime comment materially deficient for omitting the in-bounds derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false is_empty, nonzero len, representable predecessor, index < len, and get_unchecked's bounds need."}, + {"id": "L9", "decision": "FAIL", "evidence": "The four-entry list omits len's usize type, usize domain, built-in subtraction, and overflow behavior."}, + {"id": "L10", "decision": "FAIL", "evidence": "Required numeric/arithmetic authorities are absent and A3's excerpt does not supply the asserted branch biconditional."}, + {"id": "L11", "decision": "FAIL", "evidence": "Its completeness/no-silent-premise claim conflicts with the omitted Rust numeric and branch premises."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Calls the authority list complete while silently consuming usize, subtraction, overflow, and inadequately checked branch semantics."}, + {"id": "G11", "evidence": "The positive result necessarily relies on unchecked Rust numeric and control-flow authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement wording is not used as if already implemented."}, + "tcb_authority_defect": {"present": true, "evidence": "The purported authoritative inventory omits multiple consumed Rust premises."}, + "visible_scope_defect": {"present": false, "evidence": "Only supplied source facts and allowlisted Rust documentation are evidenced."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A-GET quotes both the in-bounds obligation's OOB UB consequence and the element-reference result."}, + {"id": "L2", "decision": "PASS", "evidence": "A-IF quotes both arm-selection directions; A-EMPTY contraposition yields nonzero length on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A-LEN establishes n: usize and A-USIZE nonnegativity, deriving n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A-SUB/A-OVERFLOW plus n >= 1 establish no underflow or overflow in every profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 derives index = n - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "Exhaustive paths, parametric target/profile proof, and Required subset-of Covered are explicit."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately labels the lifetime statement deficient because it omits the bounds and arithmetic proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Adjacent replacement covers false branch, zero-length implication, nonzero len, defined subtraction, strict bound, and get_unchecked."}, + {"id": "L9", "decision": "PASS", "evidence": "A-GET through A-USIZE inventory every required Rust/std leaf and separate source facts and mathematics."}, + {"id": "L10", "decision": "PASS", "evidence": "All entries use narrow 1.82.0 URLs, exact excerpts, verified propositions, consumers, and full-domain qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "TCB/reconciliation states the exact consumers and excludes any additional premise, dependency, tool, or test."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The repair proposal is separate from the proof of the supplied implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The authority set is version-matched, proposition-checked, complete, and consumer-mapped."}, + "visible_scope_defect": {"present": false, "evidence": "No evidence of inspecting anything beyond supplied source and allowed authority appears."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states that OOB is UB and requires an in-bounds usize element index."}, + {"id": "L2", "decision": "PASS", "evidence": "AX-IF quotes true/false arm selection and AX-EMPTY contraposition establishes L != 0 on the unsafe path."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives L: usize and AX-USIZE gives minimum zero, so L != 0 implies L >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "AX-SUB/AX-OVERFLOW show L - 1 remains in range in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Steps 3-4 derive index = L - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "It covers both Boolean paths across the exact target/profile domain and explicitly proves Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately deems the existing comment deficient despite proving the implementation."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text gives the false branch, nonzero length, representable subtraction, strict bound, and get_unchecked obligation."}, + {"id": "L9", "decision": "PASS", "evidence": "The seven-entry inventory covers all required Rust/std premises and classifies local facts and integer reasoning."}, + {"id": "L10", "decision": "PASS", "evidence": "Every entry has the matching 1.82.0 narrow URL, extracted text/table fact, verified proposition, and applicability."}, + {"id": "L11", "decision": "PASS", "evidence": "The proof consumes AX-IF through AX-GET as mapped and expressly excludes additional TCB or unlisted premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is a repair recommendation, not current-artifact proof evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "TCB-R182-v1 contains checked, applicable Rust authority for every consumed semantic premise."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no inspection beyond the supplied target and allowlisted authority."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 states the in-bounds usize obligation and OOB UB."}, + {"id": "L2", "decision": "FAIL", "evidence": "A4 quotes false => else but uses it as else => false on the unsafe path."}, + {"id": "L3", "decision": "FAIL", "evidence": "A2 verifies only element count; the proof's n: usize premise is neither inventoried nor checked as len's return type."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and n >= 1 establish an in-range subtraction in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "The proof explicitly computes i = n - 1 and derives 0 <= i < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "Full Required closure depends on the unsupported branch converse and unverified len-to-usize link."}, + {"id": "L7", "decision": "PASS", "evidence": "The report separately finds the lifetime-only comment deficient and not an implementation defect."}, + {"id": "L8", "decision": "PASS", "evidence": "Adjacent replacement covers false branch, zero-length relation, nonzero len, safe predecessor, strict bound, and callee."}, + {"id": "L9", "decision": "FAIL", "evidence": "It omits len's usize return type as a Rust/std premise and instead misclassifies inferred index typing as a local source fact."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 does not extract the usize return type, and A4's quote does not establish its claimed reverse implication."}, + {"id": "L11", "decision": "FAIL", "evidence": "The no-unlisted-premise reconciliation conflicts with the unchecked len typing and branch direction."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Certifies A1-A7 as complete while silently consuming len's return type and reversing the checked A4 implication."}, + {"id": "G11", "evidence": "The implementation verdict necessarily relies on unchecked/inapplicable Rust authority at two material links."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is not treated as part of the supplied artifact."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-1 omits the consumed len return-type proposition and overclaims A4."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences no prohibited or out-of-scope source access."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 quotes OOB UB and states the in-bounds usize index requirement."}, + {"id": "L2", "decision": "FAIL", "evidence": "A4's exact quote establishes false => else, not execution of else => false as consumed in O2."}, + {"id": "L3", "decision": "PASS", "evidence": "A2 establishes n: usize and A5 its zero minimum, deriving n >= 1 from n != 0."}, + {"id": "L4", "decision": "PASS", "evidence": "A6 checks subtraction/overflow and proves n - 1 representable across all ordinary profiles."}, + {"id": "L5", "decision": "PASS", "evidence": "O2-O3 explicitly derive index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The advertised Required subset-of Covered certificate materially relies on A4's unsupported converse."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately reports the comment deficient for omitting the actual bounds proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false branch, nonzero len, representability, strict bound, and the adjacent in-bounds obligation."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A6 inventory all required semantic leaves, with subtraction/overflow combined and consumers reconciled."}, + {"id": "L10", "decision": "FAIL", "evidence": "A4's quoted proposition does not supply the verified proposition used for branch reachability."}, + {"id": "L11", "decision": "FAIL", "evidence": "The explicit reconciliation overlooks that A4 is consumed in an unverified direction."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Claims only checked version-matched premises and complete reconciliation while A4 does not support the consumed converse."}, + {"id": "G11", "evidence": "The positive proof necessarily relies on an inapplicable direction of its if authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The documentation repair is not used as current implementation evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-R1 overstates the branch proposition established by A4."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of prohibited evaluation or sibling material access."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A5 quotes OOB UB and states 0 <= index < n as the usize in-bounds obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "A3 quotes both branch-selection directions and A2 contraposition yields n != 0 on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A1 gives n: usize and A4 gives minimum zero, hence a nonzero n is at least one."}, + {"id": "L4", "decision": "PASS", "evidence": "A4 checks integer minus and overflow bounds, proving n - 1 in range for every width/profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O1 derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 exhaust both branches and explicitly establish Required subset-of Covered over the full symbolic domain."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately finds the existing lifetime comment inadequate while retaining implementation PROVED."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states branch false, nonzero length, defined subtraction, strict bound, and get_unchecked's requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A5 cover all seven required Rust/std propositions, with numeric and arithmetic entries grouped, and classify remaining logic/source facts."}, + {"id": "L10", "decision": "PASS", "evidence": "Every consumed premise has a narrow 1.82.0 URL, exact quoted prose/signature/table entry, verified proposition, and scope."}, + {"id": "L11", "decision": "PASS", "evidence": "The TCB log and O1-O3 mapping reconcile every authority to a consumer and exclude silent assumptions."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is a proposed artifact repair and does not narrow or certify the current obligation."}, + "tcb_authority_defect": {"present": false, "evidence": "A1-A5 are version-matched, proposition-checked, applicable, complete, and reconciled."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied source and allowlisted Rust documentation."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "L8 does not specify whether a replacement must spell out the usize nonnegative-to-positive bridge verbatim; I treated direct nonzero/positive-length to defined-subtraction wording as sufficient when the bound and callee obligation were explicit." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/raw-scores/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/raw-scores/s2.json new file mode 100644 index 0000000000..f65fe1280a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/raw-scores/s2.json @@ -0,0 +1,228 @@ +{ + "schema_version": 1, + "mode": "L", + "scorer_id": "s2", + "reports": [ + { + "label": "J", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states that an out-of-bounds get_unchecked index is UB, and O3 identifies in-bounds as the call obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "O1/O2 place the call in the false else arm and contrapose AX-EMPTY to obtain n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize and AX-USIZE supplies the unsigned domain, from which O2 derives n > 0."}, + {"id": "L4", "decision": "PASS", "evidence": "O2 proves n - 1 remains in range and explicitly makes the result independent of overflow checks and profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 substitutes index = n - 1 and derives 0 <= n - 1 < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report connects the branch/arithmetic proof to AX-GET, claims PROVED over the full requested scope, and gives Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately calls the comment deficient because the lifetime sentence establishes neither the bounds obligation nor its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The proposed adjacent comment names is_empty and get_unchecked and exposes nonzero length, defined subtraction, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "The inventory includes if selection, is_empty, len/type, usize, subtraction, overflow, and get_unchecked, while classifying source and mathematical steps."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF quotes true=>consequent and false=>else but omits the text that a true condition skips else, so the quotation does not supply the consumed else-reached=>false direction."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact reconciliation depends on the inadequately extracted AX-IF branch-selection proposition."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is proposed only after the current implementation is proved; it is not used to narrow or certify the implementation obligation."}, + "tcb_authority_defect": {"present": true, "evidence": "The AX-IF quotation does not establish the converse branch fact the proof consumes."}, + "visible_scope_defect": {"present": false, "evidence": "The report discusses only the supplied source/request and the permitted Rust 1.82.0 authorities."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-UNCHECKED states that an out-of-bounds index is UB and step 4 treats in-bounds as the exact obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "Step 2 identifies the false else path and contraposes the zero-length is_empty contract to L != 0."}, + {"id": "L3", "decision": "FAIL", "evidence": "Although AX-LEN notes a usize return, the report substitutes 'natural count' and never checks the required nonnegative usize value-domain premise."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability and profile independence without checking Rust 1.82.0 integer-minus or overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 explicitly uses I = L - 1 and predecessor arithmetic to derive 0 <= I < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The all-scope PROVED closure depends on the unverified usize-domain, subtraction, and overflow premises, so the implementation certificate is incomplete."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime-only comment deficient and distinguishes that defect from implementation status."}, + {"id": "L8", "decision": "FAIL", "evidence": "The proposed comment gives a bounds chain but neither identifies get_unchecked in the text nor refers to checked usize/subtraction/overflow propositions, which the report lacks."}, + {"id": "L9", "decision": "FAIL", "evidence": "The claimed complete inventory omits the usize value domain, built-in subtraction meaning, and overflow/profile semantics materially used by steps 2-3."}, + {"id": "L10", "decision": "FAIL", "evidence": "No version-matched checked entries or exact quotations are supplied for usize, subtraction, or overflow; AX-IF also quotes only false=>else."}, + {"id": "L11", "decision": "FAIL", "evidence": "The report says no other Rust proposition is consumed despite silently using the omitted integer premises."} + ], + "hard_errors": [ + {"id": "G11", "evidence": "The PROVED result necessarily relies on unchecked Rust usize-domain, integer-subtraction, and overflow premises."}, + {"id": "LH4", "evidence": "It claims the authority inventory is complete while silently consuming Rust integer-domain, subtraction, and overflow semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is not used as evidence that the current implementation is sound."}, + "tcb_authority_defect": {"present": true, "evidence": "Material Rust integer premises are asserted without applicable checked Rust 1.82.0 authority."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing in the report evidences inspection beyond the supplied source/request and permitted authority pages."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 quotes the out-of-bounds UB rule and O3 discharges the corresponding in-bounds obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "O2 states that reaching else makes is_empty false and uses A3 to derive n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "A2 establishes len as usize and A5 establishes minimum zero, yielding n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A6 and O2 prove n - 1 is representable and non-overflowing throughout the profile domain."}, + {"id": "L5", "decision": "PASS", "evidence": "O3 derives 0 <= index = n - 1 < n = bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 are connected to a full-scope PROVED verdict and an explicit Required subset-of Covered certificate."}, + {"id": "L7", "decision": "PASS", "evidence": "The report separately says the lifetime comment neither states nor proves the in-bounds caller obligation."}, + {"id": "L8", "decision": "PASS", "evidence": "The adjacent replacement exposes false is_empty, nonzero len, representable subtraction, and index < len for the displayed unsafe call."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A6 inventory all required Rust/std leaves, and the proof treats assignments and inequalities as local source facts and mathematics."}, + {"id": "L10", "decision": "FAIL", "evidence": "A4 quotes only false=>else but claims the converse, execution-of-else=>false; the exact quotation does not supply that consumed proposition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The asserted exact reconciliation inherits A4's unsupported converse branch-selection premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The documentation-only replacement is not used to justify the current implementation verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "The checked A4 excerpt does not establish the direction of if semantics consumed by O2."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied target/request and allowed versioned Rust authorities."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 states out-of-bounds get_unchecked is UB and OBL-1 proves the index in bounds."}, + {"id": "L2", "decision": "PASS", "evidence": "OBL-1 identifies the false else path and contraposes A3 to n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "The proof explicitly takes n: usize, applies A7's unsigned domain, and derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and OBL-1 prove n - 1 stays in range and cannot overflow in any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "OBL-1 substitutes i = n - 1 and derives 0 <= i < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report connects the exhaustive branch proof to A1, reports full-scope PROVED, and states Covered = Required."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately identifies the lifetime-only comment as deficient for omitting the bounds derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The proposed adjacent comment names is_empty and get_unchecked and exposes the complete nonzero/subtraction/bounds chain."}, + {"id": "L9", "decision": "FAIL", "evidence": "The report misclassifies index: usize as a local source/type-signature fact; the supplied source has no such annotation, and len's return type is a consumed std premise."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 quotes and verifies only len's element-count meaning, not its usize return type; A4 also quotes only false=>else while consuming the converse."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed no-silent-premise reconciliation omits authoritative establishment of len's usize return type and inadequately extracts if selection."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement wording follows, rather than supplies, the proof of the current source."}, + "tcb_authority_defect": {"present": true, "evidence": "A consumed standard-library return-type premise is not inventoried and quoted as authority, and AX-IF's excerpt is directionally incomplete."}, + "visible_scope_defect": {"present": false, "evidence": "The report gives no evidence of inspecting prohibited evaluation or sibling material."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A-GET quotes the exact out-of-bounds UB rule and O3 discharges in-bounds for the usize index."}, + {"id": "L2", "decision": "PASS", "evidence": "A-IF supplies both branch directions and O1 contraposes A-EMPTY to obtain nonzero length."}, + {"id": "L3", "decision": "PASS", "evidence": "A-LEN establishes n: usize, A-USIZE supplies nonnegativity, and O2 derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A-SUB/A-OVERFLOW and O2 establish representability and no underflow or overflow in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 explicitly concludes index = n - 1 < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O4 close the unsafe obligation over the full stated domain and the report gives Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the existing comment deficient because a lifetime property does not prove the sole bounds precondition."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names is_empty/get_unchecked and exposes false branch, nonzero len, defined subtraction, and the strict bound."}, + {"id": "L9", "decision": "PASS", "evidence": "A-GET through A-USIZE inventory every required Rust/std premise and separately identify local source facts and mathematical inference."}, + {"id": "L10", "decision": "PASS", "evidence": "Every entry has the matching 1.82.0 narrow URL, exact supporting quotation or displayed signature, verified proposition, consumer, and scope qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "The report explicitly maps all authority entries to O1-O4 and states that no other Rust/std premise or TCB assumption is used."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is a proof-artifact repair and is not used to establish current soundness."}, + "tcb_authority_defect": {"present": false, "evidence": "All material nonlocal premises are supported by matching official Rust 1.82.0 authority; no target TCB assumption is used."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied source/request and permitted official authorities."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET quotes out-of-bounds UB and step 5 treats in-bounds as the exact unsafe-call requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "AX-IF gives both branch directions and steps 1-2 use AX-EMPTY contrapositively to derive L != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN establishes L: usize; AX-USIZE gives minimum zero; step 3 derives 1 <= L."}, + {"id": "L4", "decision": "PASS", "evidence": "Steps 3-4 and AX-SUB/AX-OVERFLOW prove L - 1 is in range and non-underflowing in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Steps 3-4 derive index = L - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "The exhaustive proof discharges AX-GET across the exact scope, reports PROVED, and explicitly certifies Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "DOC-1 separately explains that the lifetime comment mentions neither bounds nor the material derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement identifies get_unchecked's obligation and states false is_empty, nonzero len, representable subtraction, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "AX-IF through AX-GET inventory all required semantic leaves, with source observations and arithmetic identified separately."}, + {"id": "L10", "decision": "PASS", "evidence": "All seven entries have narrow 1.82.0 URLs, exact supporting text/signatures, verified propositions, and full-domain applicability."}, + {"id": "L11", "decision": "PASS", "evidence": "The derivation consumes each AX entry and expressly states there are no added environmental, implementation, or pending TCB premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is offered after a complete proof of the unchanged implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The proof relies only on applicable, proposition-matched Rust 1.82.0 Reference/std authority."}, + "visible_scope_defect": {"present": false, "evidence": "No report statement evidences access beyond the supplied target/request and allowed authorities."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A5 quotes the get_unchecked out-of-bounds UB rule and O2 discharges its in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "A3 supplies true/false branch semantics and O1 contraposes A2 to n != 0 on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A1 establishes n: usize and A4 gives the zero minimum, yielding n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A4 and O1 show n - 1 lies in the usize range and cannot overflow under any profile setting."}, + {"id": "L5", "decision": "PASS", "evidence": "O1 explicitly derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 close the sole unsafe consumer for every requested case and provide Required subset-of Covered with a full-scope PROVED verdict."}, + {"id": "L7", "decision": "PASS", "evidence": "The proof-artifact verdict separately calls the lifetime sentence inadequate for the in-bounds obligation and its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names slice::get_unchecked and states false emptiness, nonzero length, no overflow, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A5 cover every required Rust/std leaf, while the remaining source observations and logic/arithmetic are explicitly separated."}, + {"id": "L10", "decision": "PASS", "evidence": "Each consumed authority has a narrow 1.82.0 URL, exact quotation/signature, verified proposition, and target/profile qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "The O1-O3 mapping consumes every inventoried entry and disclaims all extra TCB, dependency, tool, and platform assumptions."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The comment repair is not used to prove or narrow the current implementation's obligations."}, + "tcb_authority_defect": {"present": false, "evidence": "All materially used Rust propositions are supported by applicable official 1.82.0 authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report only reviews the supplied artifact and allowed authoritative pages."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states out-of-bounds is UB, and step 5 discharges the in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "Steps 1-2 place execution in the false else arm and contrapose AX-EMPTY to n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize, AX-USIZE supplies nonnegativity, and step 3 derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "Step 4 and AX-SUB/AX-OVERFLOW show n - 1 is representable under every overflow-check setting."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 4 explicitly derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report closes both obligations and the empty path over the full domain, with PROVED and Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime-only comment deficient for omitting both the exact bound and its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names get_unchecked and exposes the false-branch, positive-length, no-underflow, strict-bound chain."}, + {"id": "L9", "decision": "PASS", "evidence": "AX-EMPTY through AX-GET inventory all material Rust leaves and distinguish local source facts from arithmetic and contraposition."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF quotes false=>else but uses it for else-reached=>false and true-path exclusion; the quotation does not supply those converse/exclusivity facts."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed complete reconciliation depends on branch-selection authority not established by the quoted AX-IF text."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement is a requested documentation repair, not evidence for current soundness."}, + "tcb_authority_defect": {"present": true, "evidence": "The AX-IF evidence is directionally insufficient for the proposition the proof consumes."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of access outside the supplied source/request and permitted Rust authorities."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A4 states that out-of-bounds get_unchecked is UB and O2 treats in-bounds as its exact requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "O2 places the call on false is_empty and contraposes A1 to n != 0."}, + {"id": "L3", "decision": "FAIL", "evidence": "A2 verifies only element-count meaning; the report never establishes len's usize type or the unsigned/nonnegative usize domain."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representable subtraction and profile independence without checking built-in minus or integer-overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 uses index = n - 1 and ordinary predecessor arithmetic to derive 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The full-scope PROVED closure relies on unverified type, unsigned-domain, subtraction, and overflow premises."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime comment deficient because it omits get_unchecked's bounds obligation and derivation."}, + {"id": "L8", "decision": "FAIL", "evidence": "The replacement states the desired chain but refers to no checked authority for its material usize and subtraction/overflow steps."}, + {"id": "L9", "decision": "FAIL", "evidence": "The supposedly complete inventory omits len's usize return type, usize's value domain, built-in subtraction, and overflow/profile behavior."}, + {"id": "L10", "decision": "FAIL", "evidence": "There are no matching checked entries or quotations for the omitted integer premises, and A3 does not quote the full branch-selection rule it claims."}, + {"id": "L11", "decision": "FAIL", "evidence": "The report claims no overflow, width, or other Rust fact is silently consumed while its derivation depends on exactly those omitted premises."} + ], + "hard_errors": [ + {"id": "G11", "evidence": "The PROVED conclusion necessarily relies on unchecked Rust type/domain, subtraction, and overflow propositions."}, + {"id": "LH4", "evidence": "It affirmatively calls the authority list complete while silently consuming the omitted integer premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is not used to certify or narrow the present implementation obligation."}, + "tcb_authority_defect": {"present": true, "evidence": "Several material Rust/std premises have no checked version-matched authority entry."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied target/request and permitted authority set."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A7 states out-of-bounds get_unchecked is UB, and step 4 discharges its in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "Steps 1-2 identify false is_empty on else and contrapose A1 to L != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "A3 gives L: usize, A4 gives the unsigned domain, and step 2 derives L >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and step 3 prove L - 1 remains representable and does not overflow in any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 substitutes index = L - 1 and concludes 0 <= index < L."}, + {"id": "L6", "decision": "PASS", "evidence": "The exhaustive branch proof closes A7 for the entire exact domain, reports PROVED, and states Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately says the lifetime comment does not establish the bounds obligation and requires reconstruction."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names is_empty and get_unchecked and supplies nonzero length, non-underflow, and the strict bound."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A7 inventory all required Rust/std premises and map them to steps, leaving only source and mathematical facts outside."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 quotes only false=>else but claims else-execution=>false; the exact quotation does not supply the consumed converse."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact A1-A7 reconciliation inherits A2's inadequately supported branch proposition."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The requested replacement comment follows an independent proof of the current implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "The quoted A2 text is insufficient for the branch direction used in the proof."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "L8 does not say whether an adjacent replacement must contain an inline URL or axiom label. I treated explicit method/contract references to already checked entries as unambiguous, but not references to material arithmetic premises for which the report supplied no checked entry.", + "L10 asks for exact prose although return types are ordinarily supplied by displayed signatures. I accepted an expressly inspected/displayed versioned signature, but not an unquoted or misclassified type fact.", + "For if semantics, an excerpt stating only false=>else does not logically establish else-reached=>false. I scored that as an L10/L11 authority-extraction defect where the omitted true-arm exclusion was not quoted, but did not infer the exact LH4 hard-error trigger merely from an incomplete excerpt." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/A.md new file mode 100644 index 0000000000..4182eed1cf --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/A.md @@ -0,0 +1,81 @@ +# Audit of `last` + +## Claim, snapshot, and verdict + +**Soundness verdict: PROVED.** For the exact `lib.rs` supplied with this review, under Rust and standard library 1.82.0, every well-typed safe call to `last` on every target where this source and the used 1.82.0 slice APIs exist, in every ordinary profile, is free of Rust undefined behavior. The caller has no extra safety obligation. `Required(case)` is exactly that predicate over source identity, toolchain/stdlib, target, profile, input slice, and permitted execution. `Required_cfg(c)` is `Rust/std = 1.82.0 ∧ target has the used items ∧ profile ∈ Ordinary`. Audit cutoff: this supplied snapshot, reviewed 2026-08-01. + +The only public/safe surface is `pub fn last(bytes: &[u8]) -> Option<&u8>` (`lib.rs:3-11`). Its only unsafe consumer is `bytes.get_unchecked(index)` at line 10. There are no unsafe declarations, fields, traits/impls, callbacks, macros, hidden APIs, dependencies, FFI, generated artifacts, `cfg` branches, or invariant-bearing state. `#![allow(dead_code)]` does not select or alter code. No documented postcondition or separately requested robustness property exists; the function name is not treated as normative documentation. + +**Proof-artifact verdict: DEFICIENT.** The existing `SAFETY` comment says only that the returned reference cannot outlive `bytes`. That does not establish the actual `get_unchecked` obligation—an in-bounds index—and therefore is not an adequate local proof. The missing derivation is material and is reconstructed below. This is a documentation defect, not an implementation defect. + +TCB log `TCB-LAST-1` consists only of the Rust 1.82.0 authoritative axioms A1-A5 below. There are no additional TCB assumptions, selected dependencies, tools, tests, or implementation/platform premises. This is a source-level result relative to documented Rust abstract semantics, not a compiler-backend or binary certificate. + +## Complete premise inventory + +Each semantic/std premise consumed by the derivation appears here; the remaining steps are inspected source facts or arithmetic/logic. + +**A1 — slice length.** Rust 1.82.0 [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len), signature `pub const fn len(&self) -> usize`: + +> “Returns the number of elements in the slice.” + +Verified proposition: for the input slice, `bytes.len()` is a `usize` equal to its number of elements; call that value `n`. + +**A2 — emptiness observation.** Rust 1.82.0 [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + +> “Returns `true` if the slice has a length of 0.” + +Verified proposition used: `n = 0 ⇒ bytes.is_empty() = true`; hence, by contraposition, `bytes.is_empty() = false ⇒ n ≠ 0`. + +**A3 — branch execution.** Rust 1.82.0 [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + +> “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped. If a condition operand evaluates to `false`, the consequent block is skipped … If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” + +Verified proposition: the unsafe call is reachable only when `bytes.is_empty()` evaluated to false; when it evaluates true, only `None` is evaluated. + +**A4 — `usize` range and subtraction.** Rust 1.82.0 [integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types) states, under “The unsigned integer types consist of,” the table row: + +> `usize` | minimum `0` | maximum `2^w − 1` + +Rust 1.82.0 [binary-operator table](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators) gives the integer meaning of `-` as: + +> “Subtraction” + +and [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow) defines an overflow case as: + +> “When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored.” + +Verified proposition: a nonzero `usize` value `n` lies in `[1, 2^w−1]`; its integer subtraction `n−1` lies in `[0, 2^w−2]`, so `n - 1` does not overflow under any target width or overflow-check/profile setting, and its value is strictly less than `n`. + +**A5 — unsafe operation contract and result.** Rust 1.82.0 [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + +> “Returns a reference to an element or subslice, without doing bounds checking.” + +> “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” + +The same safety section expressly gives `.get_unchecked(len)` as UB. Verified proposition: the caller must supply an in-bounds index; for a `usize` element index of a slice of length `n`, `0 ≤ index < n` discharges that condition, and the result is a reference to that indexed element. + +## Obligation ledger and reconstructed derivation + +**O1, reachability and arithmetic — PROVED over all `Required`.** Let `n = bytes.len()` (A1). A3 says reaching the `else` and unsafe call means the condition was false. A2 then yields `n ≠ 0`. By A4, `n ≥ 1`, `index = n - 1` is evaluated without overflow in every profile, and `0 ≤ index < n`. + +**O2, `get_unchecked` precondition — PROVED over all `Required`.** O1 establishes exactly that `index` is in the slice's bounds. This discharges A5's sole safety condition. A5 supplies a shared reference to element `n-1`; no code, callback, mutation, or unwind point intervenes between computing `index` and the call. + +**O3, other input/control-flow case — PROVED over all `Required`.** If the condition is true, A3 skips the `else`, so no unsafe operation executes and the function evaluates `None`. If false, O1-O2 apply. Boolean truth/falsity exhausts executions, so their union covers every input/execution. + +For each obligation, the derivation is symbolic in target width `w` and profile. Every required configuration selects identical source, and A1-A5 contain no narrower target/profile qualification. Thus each obligation's covered predicate contains `Required`; pointwise intersection across O1-O3 still contains `Required`. This proves `Required ⊆ Covered` and certifies the verdict. Empty, one-element, and maximum-representable-length boundaries respectively take O3, produce index `0`, and produce `n-1` without overflow; none falsifies the proof. + +## Required replacement comment + +```rust +// SAFETY: Reaching this branch means `bytes.is_empty()` was false, so the +// slice length is nonzero. Therefore `index = bytes.len() - 1` does not +// overflow and satisfies `index < bytes.len()`, making it in bounds as +// required by `slice::get_unchecked`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +This is the minimum acceptable repair: it names the callee obligation, the dominating branch fact, the arithmetic derivation, and the conclusion. The old lifetime sentence may be omitted because it does not discharge an unsafe precondition. + +## Residual scope and review triggers + +Nothing within the requested source-level domain remains uncovered. No target was built or executed, as required. Re-audit if the function, comment, signature, slice APIs/contracts, Rust/stdlib version, target-availability predicate, or profile scope changes. Compiler code generation, custom backend correctness, binaries, and behavior beyond any documented postcondition are outside this source review. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/B.md new file mode 100644 index 0000000000..48a8fee2d5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/B.md @@ -0,0 +1,65 @@ +# `last` source review + +## Claim and verdict + +**Implementation soundness: PROVED.** For the exact `target/lib.rs` supplied, every well-typed safe call to `last` is free of Rust undefined behavior under Rust 1.82.0 documented abstract semantics, on every target where this source and the used Rust 1.82.0 standard-library items exist, in every ordinary profile. There is no caller safety precondition and no additional TCB assumption. + +**Existing `SAFETY` comment: deficient.** It discusses the result's lifetime, but `get_unchecked`'s material safety obligation is that the index not be out of bounds. The comment gives none of the branch-and-arithmetic derivation needed to establish that obligation. The missing derivation can be reconstructed, so this is a proof-artifact defect, not an implementation defect. + +There are no documented postconditions on `last` and no additional robustness claim in the request; consequently no separate postcondition verdict is required. + +## Snapshot, boundary, and domain closure + +Scope is exactly `target/lib.rs`, lines 1–11. The sole language-reachable API surface is safe public free function `last(bytes: &[u8]) -> Option<&u8>`. Its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors for an invariant-bearing type, traits or impls, callbacks, macros, generated code, dependencies, `cfg`s, FFI, concurrency, allocation, or other unsafe sites. The only transient invariant is `INV-N`: in the `else` branch, for the unchanged receiver `bytes`, `n = bytes.len() > 0`. + +The request directly defines + +`Required = {exact source} × {Rust/std 1.82.0} × {targets on which the source and used items exist} × {ordinary profiles}`. + +No normalization, exclusion, or finite target inventory is used. The proof below is parametric in the target-dependent `usize` value `n`; it assumes no pointer width. Profile-dependent overflow handling is immaterial because the subtraction is proved not to overflow. The source contains no configuration selection. Thus every premise applies throughout `Required`, `Covered = Required`, and `Required ⊆ Covered`. + +No build, test, execution, expansion, or tool-derived evidence was used. This is a source-level result, not a claim about a particular compiler binary or backend. + +## Obligation ledger and reconstructed proof + +`OBL-1` (line 7, all of `Required`): prove `bytes.len() - 1` does not underflow or panic and produces `index = n - 1`. **PROVED.** + +`OBL-2` (line 9, all of `Required`): prove `index` is not out of bounds for the same `bytes` passed to `get_unchecked`. **PROVED.** + +Derivation: + +1. Let `q` be the boolean returned by `bytes.is_empty()` at line 4. Execution reaches the `else` block only when `q = false` (AX-IF). +2. AX-EMPTY says `bytes.len() = 0 -> q = true`; by contraposition, `q = false -> bytes.len() != 0`. Both observations concern the same shared slice value, with no intervening mutation, call, callback, or state transition. Set `n = bytes.len()` at line 7, so `n != 0`. +3. `len` returns a `usize` and counts elements (AX-LEN). `usize` is unsigned (AX-USIZE), hence `n != 0` gives `n >= 1`. +4. Binary `-` on these primitive integer operands is subtraction (AX-SUB). Therefore line 7 computes `n - 1`. Since `n >= 1`, the result is nonnegative and no greater than the already representable `n`; it is representable as `usize`. It is not less than the type minimum, so AX-OVERFLOW's underflow case cannot occur under any ordinary overflow-check setting. Thus `index = n - 1` and `0 <= index < n`. +5. `n` is the number of elements of this same `bytes`, so `index` is in bounds. This discharges the sole documented `get_unchecked` safety requirement (AX-GET). The standard-library contract then supplies the returned shared reference. No later unsafe consumer exists. + +The empty case never evaluates the `else` block, subtraction, or unsafe call. Hence `OBL-1` and `OBL-2` cover all reachable unsafe executions, and the implementation certificate is complete. + +## Complete authoritative-premise inventory + +All entries are Rust 1.82.0 axioms, apply on every target/profile in `Required`, and were verified on the linked versioned page. Quotations are the exact minimal prose fragments consumed. + +- **AX-EMPTY** — [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “Returns `true` if … length of 0.” Verified proposition: zero length implies the returned boolean is true. Used in step 2. +- **AX-LEN** — [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “Returns the number of elements”. Together with the displayed return type `usize`, verified proposition: `bytes.len()` is the element count represented as `usize`. Used in steps 2–5. +- **AX-IF** — [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this single-condition `else` runs only for a false condition. Used in step 1 and to exclude unsafe evaluation on the empty branch. +- **AX-USIZE** — [numeric integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The `usize` type is an unsigned integer type”. Verified proposition: `usize` values are nonnegative target-width integers. Used in steps 3–4. +- **AX-SUB** — [arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): the primitive-integer `-` entry is “Subtraction”. Verified proposition: line 7 performs integer subtraction. Used in step 4. +- **AX-OVERFLOW** — [overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): binary subtraction overflows when it creates a value “less than the minimum value that can be stored”. Verified proposition: unsigned subtraction underflow is overflow; because the mathematical result is representable here, profile-controlled overflow behavior is unreachable. Used in step 4 and configuration closure. +- **AX-GET** — [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “Returns a reference to an element or subslice”; “out-of-bounds index is undefined behavior”. Verified proposition: the operation supplies an element reference without bounds checking, and its unsafe-call obligation is that the numeric index be in bounds. Used in step 5. + +No other Rust semantic or standard-library proposition is materially consumed. In particular, the existing comment's lifetime assertion is not a precondition of `get_unchecked` and plays no role in the derivation. Every inventoried entry has a consumer above, and every nonlocal premise used above appears in this inventory. The TCB contains these authoritative Rust/std axioms only; there are no dependency, implementation, external-specification, deployment, tool, or out-of-band assumptions. + +## Finding and replacement comment + +**DOC-1 — inadequate local proof (implementation remains PROVED).** The current comment does not identify `get_unchecked`'s bounds obligation, the dominating false `is_empty` branch, the non-underflowing subtraction, or the conclusion `index < bytes.len()`. Replace it with: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() > 0`. Thus subtracting 1 cannot underflow and produces +// `index < bytes.len()` for this same slice, so `index` is in bounds as +// required by `get_unchecked`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +This repair changes proof documentation only; it neither adds a caller obligation nor changes behavior. Re-audit if the source, function contract, support domain, Rust/std version, cited contracts, or overflow/index computation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/C.md new file mode 100644 index 0000000000..70e6c68c71 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/C.md @@ -0,0 +1,64 @@ +# Unsafe Rust review: `last` + +## Claim and verdict + +**Implementation soundness: PROVED.** For the exact `lib.rs`, every well-typed safe call to `last` is free of Rust undefined behavior under Rust and standard library 1.82.0 abstract semantics, on every target where this source and the used standard-library items exist, in every ordinary profile. This result is relative only to `TCB-R182-v1` below; there are no additional TCB assumptions. + +**Existing proof artifact: DEFICIENT.** The `SAFETY` comment does not establish the actual `get_unchecked` precondition. A material bounds-and-arithmetic derivation had to be reconstructed below. This is a documentation finding, not an implementation defect. + +No caller-facing postcondition is documented in the source. The derivation nevertheless establishes the implementation behavior: an empty slice produces `None`; a nonempty slice of length `L` produces `Some` referencing element `L - 1`. + +## Snapshot, boundary, and domain + +The reviewed artifact is the complete supplied `lib.rs`; no generated artifact, dependency, build script, macro-generated API, FFI, allocator, concurrency mechanism, target feature, or conditional source exists in scope. The only external safe surface is `pub fn last(bytes: &[u8]) -> Option<&u8>`. Its only unsafe obligation site is `bytes.get_unchecked(index)` at `lib.rs:10`. There is no representation invariant or unsafe public contract. + +Let `Required(c)` mean: `c` uses this exact source, Rust/stdlib 1.82.0, an eligible target, an ordinary profile, any valid `&[u8]` (all contents, lengths, and lifetimes), and any permitted execution. Its configuration projection is + +`Required_cfg = { (Rust 1.82.0, eligible target, ordinary profile) }`, + +where “eligible” and “ordinary” retain the request's symbolic predicates. This is an identity normalization of the controlling request: each direction follows by the same conjuncts; no target/profile is enumerated or excluded by the audit. + +## Rust 1.82 authority inventory (`TCB-R182-v1`) + +Each entry applies to all `Required` cases and is consumed below. Quotations are from the exact versioned page. + +- **AX-IF.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped.” Also: “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: with this single condition, the unsafe-containing `else` is reached only for a false condition. + +- **AX-EMPTY.** [`is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “Returns true if the slice has a length of 0.” Verified proposition: length zero implies `is_empty()` is true; contrapositively, a false result implies nonzero length. + +- **AX-LEN.** [`len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “Returns the number of elements in the slice.” Its displayed signature returns `usize`. Verified proposition: `bytes.len()` is the element count `L`, represented as `usize`. + +- **AX-USIZE.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): the unsigned-integer table gives the `usize` row as minimum `0` and maximum `2^ptr_size − 1`. Verified proposition: every `usize`, hence `L`, lies in that inclusive range. + +- **AX-SUB.** [Arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): the operator table identifies “`-` Subtraction.” Verified proposition: binary `-` computes subtraction subject to the documented overflow rules. + +- **AX-OVERFLOW.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): “The following things are considered to be overflow: When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored.” Verified proposition: `L - 1` does not overflow when its mathematical result remains in the `usize` range; profile-dependent overflow handling is then irrelevant. + +- **AX-GET.** [`get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “Returns a reference to an element or subslice, without doing bounds checking.” Safety: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” Verified proposition: the caller must supply an in-bounds index; for a permitted call with `usize`, the result is the referenced element under the displayed shared-reference signature. + +These are authoritative Rust axioms, not added environmental or implementation assumptions. There are no safe/unsafe dependencies, external specifications, tool results, compiler-backend claims, or pending TCB entries. + +## Reconstructed proof and obligation ledger + +Let `L` be the element count returned by `bytes.len()` (AX-LEN). Both method calls inspect the same unchanged local slice value; there is no reassignment, callback, or intervening transition. + +1. If `bytes.is_empty()` is true, AX-IF selects the consequent, which returns `None`; the unsafe operation is not reached. +2. If the unsafe operation is reached, AX-IF says the condition was false. AX-EMPTY's `L = 0 -> true` gives, by contraposition, `L != 0`. +3. AX-USIZE gives `L >= 0`; together with `L != 0`, this gives `1 <= L`. Therefore the mathematical result `L - 1` lies in `[0, L)` and also in the `usize` range. +4. AX-SUB and AX-OVERFLOW therefore establish that `index = bytes.len() - 1` is exactly that mathematical result without underflow in every ordinary profile. Hence `index < bytes.len()`. +5. Thus `index` is in bounds, discharging AX-GET's sole documented safety requirement. AX-GET returns the element reference, and safe `Some` construction returns it. No raw reference is constructed or lifetime extended by this function; the local and standard-library signatures carry the shared borrow. + +The two boolean cases are exhaustive. The proof is parametric in slice contents, lifetime, `usize` width, eligible target, and ordinary profile. There is no `cfg` or generated/source-selection stage, and the one profile-sensitive arithmetic operation cannot overflow. Consequently every `Required` case is covered: `Covered = Required`, which certifies `Required ⊆ Covered`. + +## Finding DOC-1: inadequate adjacent proof + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not mention `index`, bounds, nonemptiness, or subtraction. Even if its lifetime statement is true, it does not entail the actual AX-GET precondition. Replace it with: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// Thus `bytes.len() != 0`, so `index = bytes.len() - 1` is representable +// and satisfies `index < bytes.len()`. Therefore `index` is in bounds, +// as required by `get_unchecked`. +``` + +Minimum resolution is this proof-artifact change; the implementation need not change. Re-audit if the function/control flow, used Rust contracts, Rust version, support predicate, or arithmetic/indexing operation changes. Binary/compiler correctness and behavior not documented by this source remain outside this source-level review. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/D.md new file mode 100644 index 0000000000..5828e73a5a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/D.md @@ -0,0 +1,134 @@ +# Source review: `last` + +## Claim and verdicts + +Snapshot: the complete supplied `target/lib.rs`, specifically safe public function +`last` at lines 3–10 and its sole unsafe operation at line 9. Review date/cutoff: +2026-08-01. No generated code, dependencies, build scripts, FFI, macros, traits, +mutable state, or prior audit are present in the supplied artifact. + +**Soundness — PROVED.** For Rust 1.82.0, every well-typed safe call +`last(bytes)` on every target where this source and the cited Rust 1.82.0 slice +APIs exist, in every ordinary profile, is free of Rust undefined behavior. This +is a source-level result under documented Rust abstract semantics. + +**Existing `SAFETY` comment — deficient.** It states a return-lifetime fact but +does not state or prove the only material caller obligation of the unsafe call: +that `index` is in bounds. The missing bounds derivation is material and is +reconstructed below. This documentation defect does not change the separately +proved implementation verdict. + +There is no documented caller-facing postcondition in the supplied source, so +there is no separate mandatory postcondition verdict. No additional robustness +claim was requested. TCB `TCB-LAST-R1` consists only of the Rust 1.82.0 +authoritative axioms inventoried below; there are no additional assumptions. + +## Domain, boundary, and coverage + +Let + +`Required = {Rust 1.82.0} × {every target where the exact source and used 1.82.0 std items exist} × {every ordinary profile} × {every valid &[u8] value}`. + +This is the controlling expression supplied by `REQUEST.md`; no normalization, +enumeration, or exclusion is applied. The only language-reachable in-scope API +surface is safe free function `last`. Its caller is adversarial subject only to +well-typed safe use. The only unsafe consumer is +`bytes.get_unchecked(index)`. There is no representation invariant beyond the +valid slice/reference properties enforced at the input type boundary. + +The proof below is parametric in slice length, target `usize` width, and profile. +The source has no conditional compilation. It proves the same obligation for +every member of `Required`; hence `Covered = Required` and +`Required ⊆ Covered`. In particular, the subtraction is proved non-overflowing, +so profile-dependent overflow handling is unreachable and immaterial. + +## Authoritative premise inventory (`TCB-LAST-R1`) + +All entries apply exactly to Rust 1.82.0 and to the full required target/profile +domain. Each is accepted solely as version-matched Rust standard-library or +Reference authority. These, and only these, are the non-local premises consumed +by the derivation. + +- **A1 — unchecked slice access.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “Returns a reference to an element or subslice, without doing bounds + checking.” Its Safety section says: “Calling this method with an + out-of-bounds index is undefined behavior even if the resulting reference is + not used.” Verified proposition: a `usize` call must use an in-bounds element + index; with that obligation met, the shown `&self -> &Output` API returns a + reference to that element. + +- **A2 — slice length.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “Returns the number of elements in the slice.” Its displayed return type is + `usize`. Verified proposition: `bytes.len()` is the slice's element count `n` + represented as `usize`. + +- **A3 — emptiness test.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “Returns `true` if the slice has a length of 0.” Verified proposition: + `bytes.is_empty()` reports whether the same slice's element count is zero; + therefore a false result means `n != 0`. + +- **A4 — selected `if` arm.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “If all `if` and `else if` conditions evaluate to false then any `else` block + is executed.” Verified proposition: execution of lines 7–9 implies that the + line-4 condition evaluated to false; the unsafe call is not executed on the + true/empty path. + +- **A5 — `usize` lower bound.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + the unsigned-integer table gives `usize` minimum `0` (and maximum + `2^ptr_size - 1`). Verified proposition: every `usize`, including `n`, is + nonnegative; thus `n != 0` implies `n >= 1` on every target width. + +- **A6 — subtraction and overflow boundary.** [Arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators) + identifies binary `-` as “Subtraction.” [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow) + includes: “When `+`, `*` or binary `-` create a value greater than the maximum + value, or less than the minimum value that can be stored.” Verified + proposition: for `usize n >= 1`, `n - 1` is the mathematical difference, + lies in `usize`'s range, and does not overflow in any ordinary profile. + +Reconciliation: A4 and A3 establish non-emptiness; A2 and A5 turn it into the +integer bound; A6 establishes the exact index without overflow; A1 consumes the +resulting in-bounds fact and supplies the reference. No cited premise is unused. + +## Obligation ledger and reconstructed proof + +**O1, empty path (lines 4–5): PROVED.** By A4, when the condition is true only +the consequent path is selected. It returns `None` and executes no unsafe +operation. + +**O2, arithmetic (line 7): PROVED.** Let `n = bytes.len()` (A2). Reaching the +`else` proves `is_empty() == false` (A4), hence `n != 0` (A3). Since `n: usize` +and its minimum is zero (A5), `n >= 1`. Therefore `n - 1` is representable and +non-overflowing by A6, and line 7 establishes `index = n - 1`. + +**O3, `get_unchecked` (line 9): PROVED.** From O2, +`0 <= index = n - 1 < n = bytes.len()`. Thus `index` denotes an element within +`bytes`, satisfying A1's safety obligation. A1 then supplies a reference to that +element. The call neither mutates the slice nor crosses an intervening call, +callback, unwind point, or state transition. Its displayed borrow-returning +signature, composed with `last`'s borrow-returning signature, carries the +reference rather than fabricating or extending one. Wrapping that reference in +`Some` introduces no further unsafe operation. + +The intersection of O1–O3 coverage is all of `Required`, establishing the +soundness certificate stated above. + +## Finding DOC-PROOF-1 and replacement text + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not +name `get_unchecked`'s bounds requirement and supplies none of O2/O3. Moreover, +the lifetime statement is not the caller obligation identified by A1. A local +reviewer must reconstruct the branch, zero-length, unsigned-arithmetic, and +bounds chain to validate the unsafe call. + +Minimal replacement comment: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() != 0`. Therefore `index = bytes.len() - 1` is representable and +// satisfies `index < bytes.len()`, making `index` in bounds for `bytes`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Required resolution is documentation-only; `lib.rs` was not edited. Re-audit +this result if the function, unsafe call contract, Rust version, supported +domain, or any cited authoritative text changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/E.md new file mode 100644 index 0000000000..20a88bcf47 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/E.md @@ -0,0 +1,51 @@ +# Review of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, every well-typed safe call to `last` is free of Rust undefined behavior under Rust and standard library 1.82.0, for every input `bytes: &[u8]`, every target on which this source and the used 1.82.0 slice APIs exist, and every ordinary profile. The result uses only the authoritative 1.82.0 axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** The comment's lifetime statement is not the safety precondition documented for `get_unchecked`. It omits the material derivation that `index` is in bounds. The implementation verdict and proof-artifact verdict are therefore intentionally different. + +There is no documented caller precondition or documented postcondition on `last` itself. The documented `get_unchecked` result guarantee consumed by the wrapper is proved below. + +## Domain and surface closure + +Let `Required(case)` mean: exact supplied source; Rust/stdlib 1.82.0; any target where the source and `is_empty`, `len`, and `get_unchecked` exist; any ordinary profile; and any well-typed safe call with any valid shared byte slice and permitted execution. Its configuration projection changes none of the source: there is no `cfg`, feature, generated code, dependency, FFI, allocator, concurrency, or target-specific operation. The sole language-reachable surface in scope is the public safe free function `last`; its only unsafe obligation site is `bytes.get_unchecked(index)`. + +Partition every required case by the natural number `n = bytes.len()`: `n = 0` or `n != 0`. These cases are exhaustive and the proof below is parametric in target and profile. Thus their union covers every configuration fiber and every input; the aggregate `Covered` predicate equals `Required` for the in-scope soundness obligation. + +## Reconstructed proof and obligation ledger + +**O1 — empty path.** If `bytes.is_empty()` evaluates to true, `if` semantics executes the consequent and skips the `else`. The function returns `None` and never reaches an unsafe operation. This path is covered. + +**O2 — `get_unchecked` precondition.** On the `else` path, `if` semantics establishes that `bytes.is_empty()` evaluated to false. Axiom A1 states `n = 0 -> is_empty() = true`; its contrapositive gives `is_empty() != true -> n != 0`. A2 identifies `n` as the number of slice elements, hence a natural number, so `n != 0` gives `n >= 1`. Consequently the source assignment computes the representable value `index = n - 1`, with `0 <= index < n`. It is therefore not an out-of-bounds index, discharging A4's exact unsafe-call requirement. There is no underflow, so no overflow-check or optimization profile creates another case. + +**O3 — consumed callee result.** By A4, the in-bounds call returns a reference to the selected element; with `index = n - 1`, that is the final element. The callee and wrapper signatures carry the returned shared reference from the input borrow, so no hidden caller obligation is introduced. `Some` wraps that reference. This establishes every documented callee postcondition consumed here. + +O1 and O2 cover the exhaustive partition; O3 establishes the consumed result on O2. Therefore `Required subseteq Covered`, certifying the stated `PROVED` verdict. No test, build, compiler-backend claim, or unlisted premise participates. + +## Authoritative premise inventory and reconciliation + +All quotations and links are version-matched to 1.82.0 and apply throughout the required target/profile domain where the respective item exists. + +- **A1 (`slice::is_empty`).** The documentation says it returns “true if the slice has a length of 0.” [Rust 1.82.0 `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition: for this slice, `len = 0 -> is_empty() = true`. O2 consumes its contrapositive. +- **A2 (`slice::len`).** It returns the “number of elements in the slice.” [Rust 1.82.0 `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition: `n = bytes.len()` is exactly the slice's element count. O2 consumes it. +- **A3 (`if`).** “If a condition operand evaluates to false, the consequent block is skipped”. [Rust 1.82.0 `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Together with the same paragraph's branch rules, this verifies that only the true condition reaches O1 and only the false condition reaches the `else` containing O2. +- **A4 (`slice::get_unchecked`).** The contract identifies an “out-of-bounds index” as “undefined behavior” and says the method returns a “reference to an element”. [Rust 1.82.0 `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified propositions: the call must use an in-bounds index even if the result were unused, and an admitted `usize` index returns a reference to its element. O2 consumes the former; O3 consumes the latter. + +This list is complete for the derivation. The exhaustive two-case split, contrapositive, and `n >= 1 -> 0 <= n - 1 < n` are mathematical steps. Branch reachability and assignments are inspected local source facts. No overflow behavior, integer-width bound, target property, lifetime promise beyond the checked signatures, dependency behavior, or external specification is silently consumed; accordingly, unused allowlisted pages are not cited. + +## Finding and replacement comment + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not mention A4's bounds obligation and does not connect the dominating branch to `len() - 1`. Removing the reconstructed A1/A3-to-bounds argument leaves no local proof of the unsafe precondition, so the omission is material. The statement is compatible with the typed signatures, but it is not an adequate `SAFETY` proof. + +Replace it with: + +```rust +// SAFETY: This `else` branch is reached only when `bytes.is_empty()` is +// false. Therefore `bytes.len() != 0`, so `index = bytes.len() - 1` is +// representable and satisfies `index < bytes.len()`. Thus `index` is in +// bounds, as required by `slice::get_unchecked`. +``` + +Re-audit if the source, function/callee contracts, Rust version, supported configuration predicate, or any cited 1.82.0 documentation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/F.md new file mode 100644 index 0000000000..0d4148584a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/F.md @@ -0,0 +1,59 @@ +# Audit of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact `lib.rs` supplied, Rust and standard library 1.82.0, every target on which this source and the used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)` with any valid shared slice, execution introduces no Rust undefined behavior. The proof is relative only to the Rust 1.82.0 authoritative axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** “The returned reference cannot outlive `bytes`” does not establish the only documented safety obligation of the executed `get_unchecked(index)`: that `index` is not out of bounds. A material bounds derivation had to be reconstructed. This is a proof-artifact defect, not an implementation defect. + +No caller safety precondition is permitted or needed. `last` has no documented postcondition, so there is no separate mandatory postcondition verdict. No tests, builds, execution, expansion, prior audit, dependency claim, or tool-derived evidence is used. + +## Domain and surface closure + +Let + +`Required = { (this exact source, Rust/std 1.82.0, target t, ordinary profile p, valid &[u8] value B, permitted execution e) | the source and its used std items exist on t }`. + +This is the request's controlling expression, preserved without enumeration or exclusion. Its configuration projection fixes Rust/std to 1.82.0 and otherwise quantifies over those `t` and `p`. The complete language-reachable in-scope surface is the safe public free function `last`; it accepts a caller-controlled shared slice. The sole unsafe site is `bytes.get_unchecked(index)`. There are no fields, constructors, traits or impls, callbacks, macros, generated items, dependencies, `cfg`s, FFI, concurrency, allocators, or invariant-bearing state in the supplied source. + +The two Boolean outcomes of `bytes.is_empty()` are exhaustive. The proof below is parametric in target and profile: the same source is selected, no target fact is used, and the subtraction is proved non-overflowing rather than relying on profile overflow behavior. Thus each required configuration fiber is covered. With `Covered` equal to the union of the two branch cases for the sole unsafe-backed safe surface, `Required ⊆ Covered`. + +## Reconstructed local proof and obligation ledger + +Fix an arbitrary required case and write `L = bytes.len()`. + +1. If `bytes.is_empty()` is true, the `if` consequent executes and returns `None`; the unsafe call is not reached. +2. If it is false, the `else` executes. AX-EMPTY states that length zero implies `is_empty() == true`; contraposition gives `L ≠ 0`. AX-LEN identifies `L` as the number of slice elements, hence a natural count, so `L ≥ 1`. +3. Therefore `I = L - 1` is representable, cannot underflow, and satisfies `0 ≤ I < L`. This is ordinary predecessor arithmetic applied to the locally obtained element count; it is independent of overflow-check and optimization settings. +4. Consequently `I` denotes the last of the `L` elements and is not out of bounds for this same slice. This discharges AX-UNCHECKED's exact safety condition before the call. No operation can change the slice or `L` between the check, length reads, and call. +5. `get_unchecked`'s expression type is a shared reference, and the enclosing well-typed safe function returns it inside `Option`; no caller-supplied behavior or hidden obligation intervenes. + +Obligation dispositions: branch reachability—proved by AX-IF; nonzero length—proved by AX-EMPTY and AX-LEN; subtraction representability and `I < L`—proved by the local facts plus predecessor arithmetic; `get_unchecked` in-bounds precondition—proved; safe-surface soundness—proved by the exhaustive branch union. There are no remaining obligations or uncovered cases. + +## Authoritative-premise inventory and reconciliation + +All entries apply exactly to Rust/std 1.82.0, all targets where the cited item exists, and every ordinary profile. Each is accepted as authoritative Rust documentation, consumed exactly where identified above, and must be rechecked if Rust/std or the cited text changes. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Verified proposition: `bytes.len()` returns the slice's element count as `usize`. Consumer: steps 2–3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Verified proposition: if `L = 0`, `bytes.is_empty()` evaluates to true. Consumer: step 2. +- **AX-IF.** [Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this `else` body, and hence the unsafe call, is reached only in the false-condition case; the true case executes the consequent instead. Consumers: steps 1–2 and branch exhaustiveness. +- **AX-UNCHECKED.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “with an out-of-bounds index is undefined behavior”. Verified proposition: the call requires its `usize` index not to be out of bounds for the receiver slice. Consumer: step 4. + +The remaining inputs are inspected-source facts and elementary logic/arithmetic: the dominating branch, assignments `L` and `I`, absence of intervening mutation/calls, contraposition, and the predecessor lemma for a positive element count. No other Rust semantic or standard-library proposition is consumed. In particular, the existing lifetime sentence is not used to discharge `get_unchecked`'s safety condition. + +## Required proof-artifact repair + +Replace the existing comment with: + +```rust +// SAFETY: This `else` executes only when `bytes.is_empty()` is false. +// Since `is_empty()` returns true for a zero-length slice, `bytes.len()` is +// nonzero. Thus `index = bytes.len() - 1` is representable and is strictly +// less than `bytes.len()`, so it is in bounds for this same slice. +``` + +This states the operation's controlling obligation, the dominating local fact, the derivation, and the resulting in-bounds proposition adjacent to the unsafe call. + +## Residual scope and review triggers + +Excluded because the request does not include them: undocumented behavioral robustness, compiler/backend or binary correctness, nonordinary profiles, other Rust/std versions, and targets where the source or used items do not exist. Re-audit on any change to `last`, its signature or documentation, the supported version/configuration predicate, or any consumed Rust/std contract. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/G.md new file mode 100644 index 0000000000..1ec57594c3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/G.md @@ -0,0 +1,53 @@ +# Source audit: `lib.rs::last` + +## Claim and verdict + +**Implementation soundness: PROVED.** For the supplied 11-line `lib.rs`, every well-typed safe call to `last(bytes: &[u8])` under Rust/standard library 1.82.0 is free of Rust undefined behavior. `Required` is exactly the requested product of: Rust 1.82.0; every target on which this source and the used 1.82.0 slice items exist; every ordinary profile; and every valid `&[u8]` argument. The proof is source-level under documented Rust abstract semantics. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” is an accurate type/lifetime observation, but it does not establish the actual caller obligation of `get_unchecked`: that `index` is in bounds. Closing the implementation proof requires the material reconstruction below. This is a proof-artifact defect, not an implementation defect. + +There is no caller-side safety precondition: `last` is public and safe. It has no documented behavioral postcondition, so none is silently inferred from its name. No additional robustness property is in scope. + +## Surface, snapshot, and domain closure + +The complete target contains only `#![allow(dead_code)]` and the public safe free function `last`; its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors, traits/impls, macros, generated artifacts, dependencies, callbacks, `cfg`s, target-specific operations, mutable state, or representation invariants. + +The only profile-sensitive candidate is subtraction overflow. The proof below establishes mathematically that it cannot overflow, so overflow-check configuration, optimization, and debug assertions do not change coverage. Pointer width changes `usize`'s maximum but not the parametric argument. Consequently `Covered = Required`, proving `Required ⊆ Covered` without enumerating targets or profiles. No target was built, tested, executed, or expanded. + +## Authoritative premise inventory (Rust 1.82.0) + +These are all Rust/std premises consumed; each link is version-matched. The quoted excerpt is the minimum supplying the proposition. + +1. **A1 — `get_unchecked` safety.** [Slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “out-of-bounds index is undefined behavior”. Proposition: the unsafe call requires its `usize` index to be in bounds (even non-use of the result would not cure an out-of-bounds call). Consumer: OBL-1. +2. **A2 — length.** [Slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Proposition: `bytes.len()` equals the slice's element count. Consumers: OBL-1 and the bounds normalization. +3. **A3 — empty test.** [Slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Proposition: length zero implies `is_empty() == true`; its contrapositive is consumed. Consumer: OBL-1. +4. **A4 — branch selection.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all if and else if conditions evaluate to false then any else block is executed.” Proposition: reaching lines 7–9 means `bytes.is_empty()` evaluated false. Consumer: OBL-1. +5. **A5 — binary minus.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): “- Subtraction”. Proposition: binary `-` on primitive integers denotes subtraction. Consumer: OBL-1. +6. **A6 — subtraction overflow criterion.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): “binary - create a value greater than the maximum value, or less than the minimum value that can be stored.” Proposition: binary subtraction overflows when its mathematical result lies outside the integer type's range. Consumer: OBL-1 and profile closure. +7. **A7 — `usize` domain.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The usize type is an unsigned integer type”. Proposition: `usize` values are nonnegative integers (with target-dependent width). Consumer: OBL-1 and target closure. + +Facts read directly from the checked source/type signatures—`bytes: &[u8]`, `index: usize`, the shared-reference result, and the returned lifetime being limited by the sole input borrow—are local, compiler-enforced type facts rather than extra admitted premises. The TCB is **TCB-LAST-1**: exactly A1–A7 as authoritative Rust 1.82.0 axioms; no safe/unsafe dependencies, implementation assumptions, external specifications, tools, deployment restrictions, or other assumptions. + +## Obligation ledger and reconstructed proof + +**OBL-1 (line 9): satisfy A1 for every input/configuration.** Let `n = bytes.len()` (A2). + +* If `bytes.is_empty()` is true, the first branch returns `None`; subtraction and the unsafe call are not executed (source plus A4). There is no unsafe obligation. +* Otherwise A4 gives `is_empty() == false`. If `n` were zero, A3 would make it true; hence `n != 0`. Because `n: usize` is unsigned (A7), `n >= 1`. +* By A5, line 7 computes the mathematical value `i = n - 1`. Thus `0 <= i < n`; since `n` itself is representable, `i` is also within the `usize` range. A6 therefore rules out subtraction overflow in every ordinary profile. +* A2 says the slice has exactly `n` elements. The integer positions of an `n`-element sequence are `0..n`, so `0 <= i < n` makes `i` in bounds. This discharges A1 before `get_unchecked(i)` executes. The shared result is tied by the method and function signatures to the `bytes` borrow, so returning it introduces no hidden lifetime or mutation obligation. + +Every path is covered, and no premise appears above without a consumer or is consumed without appearing in A1–A7. + +## Required replacement comment + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice is empty, so `bytes.len() != 0`. Therefore +// `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, making `index` in bounds for `get_unchecked`. +// The returned shared reference remains bounded by the `bytes` borrow. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Review must be repeated if `last`, its signature/comment, Rust/std version, used std contracts, or the requested target/profile domain changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/H.md new file mode 100644 index 0000000000..379631973b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/H.md @@ -0,0 +1,98 @@ +# Source review: `last` + +## Claim, snapshot, and verdicts + +Audited artifact: the exact `target/lib.rs` supplied for this review, containing one public safe function, `pub fn last(bytes: &[u8]) -> Option<&u8>`, and one unsafe operation, `bytes.get_unchecked(index)`. No generated code, dependencies, features, `cfg`, macros, FFI, traits, mutable state, or other API surfaces occur in the supplied target. + +**Soundness — PROVED.** For Rust and standard library 1.82.0, every target on which this exact source and the used standard-library items exist, every ordinary profile, and every well-typed safe call with any valid `&[u8]`, every execution of `last` is free of Rust undefined behavior under the documented Rust abstract semantics. There is no caller-side safety precondition. + +**Existing proof artifact — DEFICIENT.** The comment “The returned reference cannot outlive `bytes`” states a type-enforced lifetime property, but does not establish the sole safety precondition of the executed unsafe call: that `index` is in bounds. A material bounds-and-arithmetic derivation had to be reconstructed below. This is a documentation defect, not an implementation defect. + +There is no source documentation specifying a caller-facing behavioral postcondition, so no separate documented-postcondition verdict is in scope. The standard-library return guarantee consumed by the soundness proof is covered below. + +## Domain and boundary closure + +Let `Required = {Rust/stdlib = 1.82.0} × {targets where this source and these items exist} × {ordinary profiles} × {all valid &[u8] inputs}`. This is the controlling expression stated by `REQUEST.md`; no normalization, exclusion, release interpolation, or finite target enumeration is used. + +The only safe surface is `last`; its input type enforces a valid shared slice reference and its return type carries a shared element reference. The only unsafe consumer is `get_unchecked`. There is no invariant-bearing stored state. The local relation is that `n = bytes.len()` and `index = n - 1`, with the unchanged `bytes` value used as the call receiver. + +Coverage partitions executions by the Boolean result of `bytes.is_empty()`, an exhaustive partition. The `true` case executes no unsafe operation. The `false` case is proved parametrically below for every slice length and every target pointer width. Because subtraction is proved non-overflowing, profile-dependent overflow checking is irrelevant. Thus `Covered = Required`, establishing `Required ⊆ Covered`. + +## Authoritative premise inventory (Rust 1.82.0 only) + +Each entry is an accepted, version-matched Rust axiom; its exact proposition is stated after the quotation. + +**A-GET.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + +> “Returns a reference to an element or subslice, without doing bounds checking.” +> +> “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” + +Proposition: for the `usize` call here, the caller must establish that `index` selects an element of this slice; when it does, the method returns a reference to that element. Consumed by O3–O4. + +**A-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len), whose displayed signature returns `usize`: + +> “Returns the number of elements in the slice.” + +Proposition: `n = bytes.len()` is the slice's element count and has type `usize`. Consumed by O1–O4. + +**A-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + +> “Returns `true` if the slice has a length of 0.” + +Proposition: `bytes.len() = 0` implies `bytes.is_empty() = true`; contraposition permits a false result to establish nonzero length. Consumed by O1. + +**A-IF.** [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + +> “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped.” +> +> “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” + +Proposition: reaching this `else` block establishes that `bytes.is_empty()` evaluated to false; the other branch contains no unsafe call. Consumed by O1 and coverage. + +**A-SUB.** [arithmetic and logical binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): + +> “Operators are defined for built in types by the Rust language.” + +The table specifies binary `-` on integers as “Subtraction.” Proposition: the `usize` expression `n - 1` is integer subtraction when representable. Consumed by O2. + +**A-OVERFLOW.** [overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): + +> “When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored” + +is listed as overflow, and the section states that integer operators panic on overflow in debug mode. Proposition: if the mathematical result remains in the `usize` range, this subtraction does not overflow, so overflow-check configuration cannot alter this path. Consumed by O2 and configuration closure. + +**A-USIZE.** [integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + +> “The `usize` type is an unsigned integer type with the same number of bits as the platform’s pointer type.” + +Proposition: `usize` values are nonnegative integers; therefore a nonzero `usize` is at least one. Consumed by O2. The proof is parametric in its target-dependent width. + +No other Rust semantic or standard-library premise is consumed. Local source facts are the displayed types, the dominating branch, the assignments, the absence of any intervening mutation/reassignment, and the fact that the same `bytes` value is the receiver. Ordinary integer inequalities and contraposition are logical/mathematical inference, not additional Rust premises. + +## Obligation ledger and reconstructed proof + +**O1 — nonzero length (PROVED).** The unsafe call is reachable only in the `else` block. A-IF makes the observed condition false. A-EMPTY gives `len = 0 ⇒ is_empty = true`; contraposition gives `is_empty = false ⇒ n != 0`. + +**O2 — arithmetic and bound (PROVED).** By A-LEN and A-USIZE, `n` is a nonnegative integer; O1 therefore gives `n ≥ 1`. Hence the mathematical value `n - 1` is nonnegative, is no greater than the representable `n`, and is strictly less than `n`. A-SUB and A-OVERFLOW therefore establish that `index = n - 1` is representable without underflow/overflow in every ordinary profile and that `index < bytes.len()`. + +**O3 — unsafe-call precondition (PROVED).** `index` is a `usize`, so it is nonnegative; O2 gives `index < bytes.len()` for the unchanged receiver. It therefore selects an element of `bytes`, discharging A-GET's bounds requirement. No alias, mutation, temporal, panic, or unwind obligation is introduced by this shared-reference call. + +**O4 — result (PROVED).** A-GET returns a reference to the selected element. The inspected method and function signatures carry that shared borrow into `Option<&u8>`; no unsafe lifetime extension, raw pointer, or stored state occurs. The empty/true branch returns `None` without unsafe execution. + +## Finding and proposed repair + +**F-DOC-1 — inadequate local `SAFETY` proof.** The current comment proves neither O1, O2, nor O3. Its lifetime statement does not imply in-bounds indexing and therefore cannot justify `get_unchecked`. Replace it with: + +```rust +// SAFETY: Reaching this `else` branch means `bytes.is_empty()` was false. +// Since a zero-length slice makes `is_empty()` true, `bytes.len()` is nonzero. +// Thus `bytes.len() - 1` neither underflows nor overflows and is strictly less +// than `bytes.len()`, so `index` is in bounds as required by `get_unchecked`. +``` + +This repair changes no implementation or public contract and has no compatibility impact. Re-audit if the branch, index arithmetic, receiver, function signature, Rust/stdlib version, supported configuration domain, or `get_unchecked` contract changes. + +## TCB, evidence, and residual scope + +TCB revision `TCB-LAST-1` consists only of accepted A-GET through A-USIZE, each verified against the linked Rust 1.82.0 Reference or standard-library page and consumed exactly as mapped above. There are no additional TCB assumptions, dependencies, tools, tests, sampled executions, generated artifacts, or prior audits. No build, test, execution, or macro expansion was performed. The verdict is source-level; compiler/backend binary correctness and behavior outside the exact requested Rust/version/target/profile domain are excluded. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/I.md new file mode 100644 index 0000000000..41d220b8cb --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/I.md @@ -0,0 +1,57 @@ +# Local proof-artifact review: `last` + +## Claim and results + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard library 1.82.0, every target on which this source and its used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)`, execution is free of Rust undefined behavior under the documented Rust abstract semantics. The TCB is `TCB-LAST-1` below: version-matched Rust authorities only, with no additional assumptions. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” does not establish the sole material caller obligation of `get_unchecked`: that `index` is in bounds. Reconstructing that omitted bounds proof is necessary to certify the implementation. This is a proof-artifact defect, not an implementation defect. + +`last` has no documented behavioral postcondition, so no independent `CONTRACT-BROKEN` claim arises. Its safe signature imposes no caller-side safety precondition beyond a well-typed `&[u8]`. + +## Snapshot, boundary, and domain + +The audited artifact is exactly the supplied `target/lib.rs`; no revision or digest was supplied. Audit cutoff: 2026-08-01. The complete safe boundary is the public free function `pub fn last(bytes: &[u8]) -> Option<&u8>`. Its only unsafe site is `bytes.get_unchecked(index)`. There are no fields, traits, impls, callbacks, FFI, macros, generated artifacts, dependencies, persistent invariants, `cfg`s, features, or target-specific branches in the supplied source. No build, test, execution, or tool-derived evidence was used. + +Let + +`Required = {source exactly as supplied} × {Rust/std 1.82.0} × {targets where the source and used items exist} × {ordinary profiles} × {all valid &[u8] inputs}`. + +The proof below is parametric in slice length, `usize` width, target, and profile. Hence `Covered = Required`, proving `Required ⊆ Covered`; no enumeration or exclusion is used. Debug/release overflow behavior is irrelevant because the subtraction is proved non-overflowing. + +## Obligation ledger and reconstructed proof + +Let `L = bytes.len()`. + +1. **Control flow.** The unsafe site is reachable only through the `else` block, so `bytes.is_empty()` evaluated to `false` (A2). +2. **Nonzero length.** A1 states `L = 0 ⇒ is_empty() = true`; by contraposition with step 1, `L ≠ 0`. A3 identifies `L` as the slice's element count, and A4 identifies its type as unsigned, so `L ≥ 1`. +3. **Arithmetic.** Integer `-` is subtraction (A5). Therefore `index = L - 1` is representable and satisfies `0 ≤ index < L`. It neither creates a value below the type minimum nor overflows under A6, in any ordinary profile. +4. **Unsafe call.** Thus the `usize` index is in bounds. This discharges A7's safety requirement, and `get_unchecked` supplies the shared element reference described by its contract. Wrapping it in `Some` and returning it introduces no unsafe operation. The empty branch executes no unsafe operation. + +These cases exhaust every boolean result and every valid slice, so every unsafe-site obligation is proved over `Required`. + +## Authoritative premise inventory (`TCB-LAST-1`) + +All entries apply exactly to Rust/std 1.82.0 on every target where the cited item and audited source exist. Each is accepted as a versioned Rust `AXIOM`; there are no other TCB categories or premises. + +- **A1 — `is_empty`.** The docs say “`true` if the slice has a length of 0.” [Rust 1.82 slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition consumed in step 2: `L = 0 ⇒ is_empty() = true`. +- **A2 — `if`.** “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” [Rust 1.82 Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Verified proposition consumed in step 1: this `else` execution entails the sole condition evaluated to `false`. +- **A3 — slice length.** `len` returns the “number of elements.” [Rust 1.82 slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition consumed in step 2: `L` is the slice's element count; its displayed return type is `usize`. +- **A4 — `usize`.** “The `usize` type is an unsigned integer type.” [Rust 1.82 Reference, numeric types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types). Verified proposition consumed in steps 2–3: `L` and `index` have no negative representable values; the proof is width-parametric. +- **A5 — subtraction.** The primitive-integer table defines `-` as “Subtraction.” [Rust 1.82 Reference, arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators). Verified proposition consumed in step 3: `L - 1` denotes integer subtraction when representable. +- **A6 — overflow boundary.** Binary subtraction overflows when it creates a value “less than the minimum value that can be stored” (or above the maximum). [Rust 1.82 Reference, overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow). Verified proposition consumed in step 3: because `L ≥ 1`, `L - 1 ≥ 0`, so this subtraction does not overflow; overflow-check profile choices cannot change this path. +- **A7 — unchecked indexing.** The method “Returns a reference to an element or subslice”; an “out-of-bounds index is undefined behavior.” [Rust 1.82 slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified proposition consumed in step 4: a `usize` index must be in bounds, and a contract-satisfying call returns the shared reference. + +The derivation consumes A1–A7 exactly as mapped above and no unlisted Rust semantic premise material to the unsafe obligation. + +## Finding and replacement comment + +**FINDING-COMMENT-1 (proof documentation):** the current comment establishes no implication from the dominating branch to `index < bytes.len()`. Minimum resolution is to replace it with: + +```rust +// SAFETY: This else branch is executed only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() != 0` here. +// Thus `index = bytes.len() - 1` cannot underflow and is strictly less than +// `bytes.len()`, so it is in bounds as required by `get_unchecked`. +``` + +Re-audit if the source, function or callee contract, Rust/std version, support domain, or cited authoritative prose changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/J.md new file mode 100644 index 0000000000..e5a8cb2601 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/L/reports/J.md @@ -0,0 +1,149 @@ +# Unsafe Rust Audit: `last` + +## Claim and verdict + +**Soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard +library 1.82.0, every target on which this source and the used standard-library +items exist, every ordinary profile, every valid `&[u8]`, and every permitted +source-level execution, every well-typed safe call to `last` is free of Rust +undefined behavior. There is no caller-side safety precondition. This result is +relative only to the Rust 1.82.0 authorities in TCB-R1 below; it adds no TCB +assumption. + +**Existing `SAFETY` comment: DEFICIENT.** Its lifetime statement does not +establish the `get_unchecked` call's material requirement that `index` be in +bounds. Reconstructing that missing argument is necessary to reach the +implementation verdict. This is a proof-artifact defect, not an implementation +defect. + +There is no documented postcondition on `last`, so no separate mandatory +postcondition verdict applies. In particular, the name `last` is not treated as +normative documentation. + +## Snapshot, domain, and boundary + +- Snapshot: the complete supplied `lib.rs`, lines 1--11; no generated source, + dependencies, features, `cfg`, macros, FFI, assembly, build scripts, or prior + audit are present in the supplied target. +- Surface inventory: one public safe free function, + `pub fn last(bytes: &[u8]) -> Option<&u8>`. There are no representation + fields, constructors, traits, methods, callbacks, hidden items, statics, or + invariant-bearing state. The sole unsafe site is + `bytes.get_unchecked(index)` at line 9. +- Let `Required(b,t,p,e)` mean: this exact source; Rust/std 1.82.0; `b` is any + valid `&[u8]`; `t` is any target where the source and used items exist; `p` is + any ordinary profile; and `e` is any permitted execution. This is exactly the + request's controlling expression, so the normalization is equality in both + directions. `Required_cfg(t,p) = target_exists(t) && ordinary_profile(p)`. + There is no policy conflict, exclusion, or unresolved domain. +- Actual axes are slice length, target-dependent `usize` width, and arithmetic + overflow-check configuration. The proof below is parametric in all three. + Optimization, debug assertions, and panic strategy do not alter any consumed + proposition. No build or generation pipeline selects another artifact. + +## Obligation ledger and reconstructed proof + +**O1 -- branch closure.** Partition executions by the branch actually selected +at lines 4--10. Rust's `if` semantics makes the two source paths exhaustive. If +the consequent executes, line 5 returns `None` and the unsafe operation is not +reached. If the `else` executes, `bytes.is_empty()` evaluated false. + +**O2 -- arithmetic.** Put `n = bytes.len()` on the `else` path. AX-EMPTY says +that length zero would make `is_empty()` true; by contraposition, the observed +false result gives `n != 0`. AX-USIZE makes `n` an unsigned integer, hence +`n > 0`. Integer `-` is subtraction (AX-SUB), so line 7 computes +`index = n - 1`. Mathematically `0 <= n - 1 < n`; the result is neither below +the type minimum nor above its maximum, so AX-OVERFLOW shows that this +subtraction does not overflow. Thus this result and the absence of an +arithmetic panic are identical with overflow checks enabled or disabled. + +**O3 -- unsafe call.** AX-LEN identifies `n` as the number of slice elements. +Consequently the integer index `n - 1`, with `n > 0`, is in the slice's index +range. AX-GET says an out-of-bounds call is UB and that the method returns a +reference to the selected element; O2 proves the excluded condition false. +The call therefore satisfies its safety contract and returns the in-bounds +`&u8` used to construct `Some`. There is no later mutation, callback, +interference, unwind point, or unsafe consumer. + +For every `Required` case, O1 selects a covered path; the consequent path has no +unsafe operation, while O2--O3 cover every alternative path for every target +`usize` width and profile. Hence each obligation's covered domain contains +`Required`; their pointwise intersection does too. This is the +`Required ⊆ Covered` certificate for the verdict. + +## Rust/std authority inventory (TCB-R1) + +All entries are Rust 1.82.0 AXIOMs, checked at the linked versioned sections, +accepted as the request-authorized Rust authority, and applicable to every +`Required` target where the item exists. There are no dependencies, tools, or +additional admitted propositions. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “number of elements in the slice”. Verified proposition: `bytes.len()` is the + slice's element count and has the shown return type `usize`. Consumers: O2, + O3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “`true` if the slice has a length of 0”. Verified proposition: if the element + count is zero, this call returns true. Consumer: O2. +- **AX-IF.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “condition operand evaluates to `true`, the consequent block is executed”; + “conditions evaluate to `false` then any `else` block is executed”. Verified + proposition: for this one-condition `if`/`else`, the condition selects the + consequent when true and the `else` when false. Consumer: O1. +- **AX-USIZE.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + “The `usize` type is an unsigned integer type”. Verified proposition: + `n: usize` is nonnegative and lies in that type's representable integer + range, for every supported pointer width. Consumer: O2. +- **AX-SUB.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): + the integer `-` table entry is “Subtraction”. Verified proposition: the + built-in operation on these `usize` operands is integer subtraction. + Consumer: O2. +- **AX-OVERFLOW.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): + “binary `-` create a value greater than the maximum value, or less than the + minimum value that can be stored” is overflow. Verified proposition: a + subtraction whose mathematical result remains in the `usize` range does not + overflow. Consumer: O2. +- **AX-GET.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “reference to an element”; “out-of-bounds index is undefined behavior”. + Verified proposition: the `usize` call returns a reference to the indexed + element without a bounds check, and the caller must exclude an out-of-bounds + index. Consumer: O3. + +This inventory exactly matches the semantic leaves used above. The remaining +steps are inspected source syntax, contraposition, integer inequalities, and +set inclusion; no uncited Rust/std proposition or tool result supplies a +material inference. + +## Finding PA-1 -- inadequate local proof + +- **Affected artifact:** line 8's comment; implementation status **PROVED**, + proof-artifact status **deficient**. +- **Defect:** “The returned reference cannot outlive `bytes`” neither states + nor derives `index < bytes.len()`, the precondition consumed at line 9. It is + not a substitute for O1--O3. +- **Required resolution:** replace the comment with locally reviewable bounds + reasoning. No caller contract or code change is needed. + +Proposed replacement text: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() > 0` here. +// Therefore `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, as required by `get_unchecked`. +``` + +## Evidence, residual scope, and review triggers + +No build, test, execution, macro expansion, or tool-derived evidence was used. +This is a source-level Rust abstract-semantics result, not a claim about a +particular compiler backend, binary, platform implementation, undocumented +behavior, performance, or panic freedom outside the proved subtraction. +Re-audit if the source/comment, function or std contracts, Rust version, +supported domain, or any presently absent configuration/generation/dependency +mechanism changes. + +**Final attestation:** every in-scope surface and unsafe obligation has a +status; the material reconstruction and proof-artifact defect are explicit; +the authority inventory is reconciled to the derivation; and no conclusion +rests on testing or absence of a counterexample. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/PACKET.json new file mode 100644 index 0000000000..52a5ef164b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/PACKET.json @@ -0,0 +1,26 @@ +{ + "allowlist_sha256": "ecb90a801bfbf51797749e1eddf95b85a1acba5acc92b2c061612a317150c81e", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "P", + "raw_score_sha256": { + "s1": "98b837424d1eacde07a4d82a2c92a9697f680780bfe06056ae5015a4a067c764", + "s2": "040fcb90b1466aa92a9609e415f8030300535af6c5555b4e43c34c822e1ba243" + }, + "report_sha256": { + "A": "19d9b069a036a6d9da00ebbec8e5a48315b9a414cf4c353ef71e4e75d0560f62", + "B": "3e11d4e6e869575bd8c807ef85277f7f29e39ef85e6ae177fb4ea073d0e27093", + "C": "a3a118b4fcf7d37b80907aa322d3fc9423419df81bed9dcff6d299415826068e", + "D": "61ae6ed7e4ce464b07d0ae2a4b8c6941d5089e33de766fa78600e570ab998621", + "E": "cde0cbd855bf963d66c656676cb1f817bfacdae74bdab5a5551953fb54166fdf", + "F": "54dd4275f961823031967d7aa3052b68653e4170c5eeb55fea4d8c45c05bc679", + "G": "c0e89f396556b32ab2d6611a875e30ae9243ba61206f445205b4a9c889b21a24", + "H": "c81b3b6430a1854a652a3f6d3866c08a4969453f770cd387c843f253ae8b01ac", + "I": "2704f92807aeb17dd1fc54a8fd5e62078d69443c921b458532bd1995e34738bf", + "J": "873d7f2d86630153a25fb9714624659e543f4198ad55b7db8ca0ebdcb8ebe503" + }, + "rubric_sha256": "1e9e6622a34b3b0376b6912f676695e318edcd971ac1f4960810531ad854911d", + "schema_sha256": "c7720030785e0d87c17d1a1ed44a9ecf260571a459be50b0fd2df15931ffa8e5", + "schema_version": 1, + "source_score_packet_sha256": "9572ba6310f2ba36bf52c1506d8af7bc23b86fc630b795042e1aa27d04aed1c3", + "target_byte_tree_sha256": "2b194a735b69a8904b86baa43791a0ddac9f769ce32e87bf4e759822cb5cd52e" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/RUBRIC.md new file mode 100644 index 0000000000..90f2e84814 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/RUBRIC.md @@ -0,0 +1,565 @@ +# Mode P Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material. Never expose this file to a report agent.** + +## P — Incomparable Predicates and Full-Case Closure + +### Canonical notation and policy algebra + +Use the fixture's notation: + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +F = H = D = {false, true} +P = every Cargo profile admitted by the supplied policies +I = {None} union {Some(b) | b is any u8} +case = (v, t, f, h, p, d, i) +``` + +The two exact configuration predicates are: + +```text +Scarlet(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)). + +Indigo(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)). +``` + +They are incomparable. For example: + +```text +(1.84.0, X, true, false) is Scarlet-only. +(1.84.0, X, true, true) is Indigo-only. +``` + +Any correct separating witness is acceptable. In particular, an answer need +not use the two examples above. There is no authorized rule identifying one +predicate, their intersection, their union, or any other combination as the +crate's controlling exact promise. + +The policy-induced full-case sets are: + +```text +ScarletCases = {case | Scarlet(v,t,f,h) and p in P and d in D and i in I} +IndigoCases = {case | Indigo(v,t,f,h) and p in P and d in D and i in I} +``` + +The canonical minimal conservative audit domain is their union: + +```text +Audit = ScarletCases union IndigoCases +Required(case) iff case in Audit +``` + +Its configuration projection has this equivalent exact formula: + +```text +UnionCfg(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X) + or (f and t = A and (h or v >= 1.85.0))). + +Required(v,t,f,h,p,d,i) + iff UnionCfg(v,t,f,h) and p in P and d in D and i in I. +``` + +A report may instead choose a transparent full-case superset, provided it +proves `ScarletCases subset-of Audit` and `IndigoCases subset-of Audit` +separately and states a theorem whose meaning remains coherent for every added +case. The chosen set is an audit domain, not an inferred project promise. + +### Intended source proof + +Both policies exclude every configuration with `f = true` and `t = W`. +Relative only to accepted `BUILD-MAP-POLICY`, such a build selects +`cfg(all(feature = "turbo", target_arch = "wasm32"))`. The authoritative +`all`, `cfg`-attribute, and `compile_error!` contracts then establish that the +ordinary library compilation fails. This reasoning is parametric in `v`, `h`, +`p`, and `d`; there is no library input after compilation is rejected. + +For every compiled case selected by the audit domain: + +- when `f = false`, `unwrap_or(0)` returns the contained byte for `Some(byte)` + and zero for `None`; +- when `f = true`, the same `unwrap_or(0)` first produces that result `r`, the + source constructs `Some(r)`, and `unwrap_unchecked` is therefore invoked on + `Some`, never `None`; its return contract produces the same `r`. + +One exact full-case implementation region for both soundness and behavior is: + +```text +Covered(v,t,f,h,p,d,i) + iff v in V and t in T and f in F and h in H and p in P and d in D and i in I + and (!f or (f and t in {X,A})). +``` + +The source derivation is independent of `v`, `h`, `p`, `d`, and the particular +member of `I`, but those universally quantified dimensions remain in both +`Required(case)` and `Covered(case)`. Every disjunct of `UnionCfg` implies the +final source-selection clause above, so: + +```text +Required subset-of Covered_sound +Required subset-of Covered_behavior +``` + +The two covered predicates may be represented by the same set, but the unsafe +precondition proof and the postcondition proof are distinct obligations. + +### Expected conclusions + +- The identity of the controlling exact project predicate is **UNRESOLVED** + (equivalently, **UNPROVED** as a policy-identification proposition). +- Safe-API soundness on the chosen conservative full-case audit domain is + **PROVED relative to `BUILD-MAP-POLICY`**. +- The documented `value_or_zero` postcondition on that domain is **PROVED + relative to `BUILD-MAP-POLICY`**. +- Effective rejection of every `turbo`/`wasm32` build in the supplied release, + feature, profile, and debug-assertion scope is **PROVED relative to + `BUILD-MAP-POLICY`**. + +The qualification is required because the mapping from policy configuration +coordinates to Rust `cfg` options is an accepted tool premise, not a Rust +semantic axiom. + +### Scored atoms + +Each atom below scores exactly the proposition in its `proposition` field. +The other fields identify why that proposition is in scope and how to diagnose +a failure; they add no hidden report requirement. + +- **P1 — Exact Scarlet predicate** + - `proposition`: The report's `Scarlet(v,t,f,h)` set equals the predicate in + `POLICY-SCARLET.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Scarlet disjunct, including its versioned + x86 clause and hardened aarch64 clause. + - `dependencies`: none. + - `root_cause`: A wrong Scarlet formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P2 — Exact Indigo predicate** + - `proposition`: The report's `Indigo(v,t,f,h)` set equals the predicate in + `POLICY-INDIGO.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Indigo disjunct, including its versioned + x86 and unhardened aarch64 clauses. + - `dependencies`: none. + - `root_cause`: A wrong Indigo formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P3 — Scarlet-minus-Indigo witness** + - `proposition`: There exists a stated configuration in Scarlet but not + Indigo. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Scarlet and not Indigo`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Scarlet-only configuration. + +- **P4 — Indigo-minus-Scarlet witness** + - `proposition`: There exists a stated configuration in Indigo but not + Scarlet. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Indigo and not Scarlet`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Indigo-only configuration. + +- **P5 — Exact-promise status** + - `proposition`: The supplied policy evidence leaves the controlling exact + project predicate unidentified. + - `scope_basis`: “No precedence, supersession, intersection, union, or other + conflict-resolution rule has been authorized.” (`REQUEST.md`) + - `necessary_edge`: Keep policy identification separate from selection of a + conservative audit domain. + - `dependencies`: none. + - `root_cause`: Treating an analyst-selected set as policy evidence is the + originating error. + - `accepted_alternatives`: `UNRESOLVED`, or `UNPROVED` explicitly limited to + policy identification. + +- **P6 — Scarlet full-case domain** + - `proposition`: `ScarletCases` equals the Scarlet configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P1. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P7 — Indigo full-case domain** + - `proposition`: `IndigoCases` equals the Indigo configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P2. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P8 — Scarlet containment** + - `proposition`: The chosen conservative full-case audit domain contains + `ScarletCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `ScarletCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P6 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Scarlet domain remains the originating + failure; an absent inclusion argument is independently P8. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P9 — Indigo containment** + - `proposition`: The chosen conservative full-case audit domain contains + `IndigoCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `IndigoCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P7 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Indigo domain remains the originating + failure; an absent inclusion argument is independently P9. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P10 — Scarlet wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Scarlet. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Scarlet predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P1. + - `root_cause`: A wrong Scarlet formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P11 — Indigo wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Indigo. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Indigo predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P2. + - `root_cause`: A wrong Indigo formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P12 — Effective wasm rejection** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, every in-scope build with + `f = true` and `t = W` fails library compilation at the selected + `compile_error!`. + - `scope_basis`: “Account for ... source-level effective rejection of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Follow tool mapping to both true cfg options, apply + `all`, apply the `cfg` attribute, then apply `compile_error!`, universally + over release, hardened, profile, and debug-assertion coordinates. + - `dependencies`: exact TCB use and exact-version Rust authority. + - `root_cause`: The first absent edge among mapping, predicate selection, and + compile failure is the useful diagnosis. + - `accepted_alternatives`: An equivalent symbolic proof for all such builds; + enumeration is not required. + +- **P13 — Non-turbo postcondition** + - `proposition`: On every selected non-turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Apply the exact-version `unwrap_or(0)` contract to the + two `Option` variants. + - `dependencies`: exact Option authority. + - `root_cause`: Missing or inapplicable `unwrap_or` authority is the semantic + root; missing input quantification is a domain root. + - `accepted_alternatives`: Variant cases or one exact contract application. + +- **P14 — Turbo unsafe precondition** + - `proposition`: Every reachable turbo-branch `unwrap_unchecked` call has a + `Some` receiver. + - `scope_basis`: “Prove or refute the local safety obligation at the unsafe + operation.” (`REQUEST.md`) + - `necessary_edge`: Trace the value through `unwrap_or`, the local + `Some(value)` construction, and the unchanged receiver at the unsafe call. + - `dependencies`: exact Option authority and the inspected local source. + - `root_cause`: Failure to connect the constructed receiver to the call is a + local proof-edge failure, not a policy failure. + - `accepted_alternatives`: Any equivalent local proof that identifies the + exact call receiver; no control-flow argument is required. + +- **P15 — Turbo postcondition** + - `proposition`: On every selected turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Compose `unwrap_or(0)`'s result with construction of + `Some(result)` and `unwrap_unchecked`'s return contract. + - `dependencies`: P14 and exact Option authority. + - `root_cause`: A safety proof alone does not supply the return-value edge; + diagnose that edge separately. + - `accepted_alternatives`: Direct composition or explicit `None`/`Some` + cases. + +- **P16 — Full Required predicate** + - `proposition`: The report's final `Required(case)` retains version, target, + both features, profile, debug assertions, and input over its chosen audit + domain. + - `scope_basis`: “State `Required(case)` ... without projecting away the + configuration or input dimensions.” (`REQUEST.md`) + - `necessary_edge`: Bind all seven coordinates before making a universal + conclusion. + - `dependencies`: P6 through P9. + - `root_cause`: Omission here is a final theorem-domain failure even if the + omitted axis happens not to affect source behavior. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may be symbolic. + +- **P17 — Full soundness Covered coordinates** + - `proposition`: `Covered_sound(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift the branch-local proof to a full-case predicate + rather than replacing the case by a configuration projection. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the branch proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P18 — Soundness Covered validity** + - `proposition`: Every case included in `Covered_sound(case)` has a complete + applicable unsafe-obligation derivation in the report. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after the branch-local + unsafe proof applies to that case. + - `dependencies`: P14 plus the inspected fact that the non-turbo branch uses + no unsafe operation. + - `root_cause`: An overbroad Covered set is an implementation-proof error, + not a theorem-domain recovery error. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P19 — Soundness closure** + - `proposition`: `Required subset-of Covered_sound` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration disjunct to its + proved source branch while carrying profile, debug, and input universally. + - `dependencies`: P8, P9, P14, and P16 through P18. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, local proof, or containment edge as cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P20 — Whole-domain soundness conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, safe-API soundness is + PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P19 as the certificate and no wider TCB proposition. + - `dependencies`: P19 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + source-level soundness, positive status, and TCB relativity. + +- **P21 — Full behavioral Covered coordinates** + - `proposition`: `Covered_behavior(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift both branch-local return proofs to a full-case + predicate. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the return proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P22 — Behavioral Covered validity** + - `proposition`: Every case included in `Covered_behavior(case)` has a + complete applicable postcondition derivation in the report. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after a branch-local return + proof applies to that case. + - `dependencies`: P13 and P15. + - `root_cause`: Do not infer this validity proposition from soundness; the + documented return theorem needs its own proof edges. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P23 — Behavioral closure** + - `proposition`: `Required subset-of Covered_behavior` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration and input case to a + branch with the proved documented return. + - `dependencies`: P8, P9, P13, P15, P16, P21, and P22. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, postcondition proof, or containment edge as + cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P24 — Whole-domain behavioral conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, the documented + postcondition is PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P23 as the certificate and no wider TCB proposition. + - `dependencies`: P23 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + exact postcondition, positive status, and TCB relativity. + +- **P25 — Exact TCB scope** + - `proposition`: Every proposition attributed to `BUILD-MAP-POLICY` is admitted by + that entry's exact identity, mapping, consumer, and release/profile region. + - `scope_basis`: “Apply it only to its exact build-tool mappings and + consumers.” (`REQUEST.md`) + - `necessary_edge`: Match each TCB-dependent conclusion to the supplied entry + without adding a semantic or backend proposition. + - `dependencies`: none; this is an accounting proposition. + - `root_cause`: An invented mapping is the primary error even if subsequent + cfg reasoning would be valid under it. + - `accepted_alternatives`: A compact TCB ledger or precise inline + qualifications. + +- **P26 — Conspicuous TCB qualification** + - `proposition`: Every conclusion which depends on `BUILD-MAP-POLICY` identifies + that dependency as an accepted trust premise rather than Rust authority. + - `scope_basis`: “keep every conclusion which depends on it conspicuously + qualified.” (`REQUEST.md`) + - `necessary_edge`: Carry the TCB label from configuration reachability into + each dependent rejection, soundness, and behavior conclusion. + - `dependencies`: none; this is a reporting proposition. + - `root_cause`: An otherwise valid but unconditional conclusion fails here; + do not misdiagnose it as a Rust-authority mismatch. + - `accepted_alternatives`: Inline `relative to BUILD-MAP-POLICY` wording or an + unambiguous shared qualification covering the dependent conclusions. + +- **P27 — Exact authority closure** + - `proposition`: Every material Rust semantic premise used in a positive + proof is paired with an applicable exact-version URL and a quotation which + supplies that premise. + - `scope_basis`: “For each material Rust semantic premise, cite the applicable + exact-version Rust Reference or standard-library page and quote the prose + which supplies that premise.” (`REQUEST.md`) + - `necessary_edge`: Reconcile the proof leaves against the authority inventory + below; a page label alone supplies no unstated proposition. + - `dependencies`: every positive Rust-semantic derivation. + - `root_cause`: Identify the first missing, mismatched, or overclaimed + quotation; do not treat one omission as multiple distinct authority roots. + - `accepted_alternatives`: Shorter exact excerpts and different organization + are acceptable when the proposition and release applicability are clear. + +### Hard errors + +A mere omission, an explicit refusal to close a proposition, or a downstream +atom failure caused by a disclosed upstream gap is not by itself a hard error. +Record a hard error only for the corresponding false affirmative claim below: + +- **PH1:** selects Scarlet, Indigo, their intersection, their union, or another + combination as the controlling exact project promise without new policy + evidence; +- **PH2:** relabels an analyst-selected conservative audit domain as the exact + project promise; +- **PH3:** asserts containment or incomparability using a stated formula and + witness which do not establish the asserted set relation; +- **PH4:** claims whole-domain soundness or behavior after dropping a required + configuration or input coordinate, or without a valid full-case + `Required subset-of Covered` argument; +- **PH5:** treats `turbo`/`wasm32` as policy-supported, or claims effective + rejection without the exact accepted mapping and applicable `all`, `cfg`, and + `compile_error!` implications; +- **PH6:** calls the shown source `UNSOUND` or calls its documented + postcondition `CONTRACT-BROKEN` on the supplied audit domain; +- **PH7:** invents or widens `BUILD-MAP-POLICY`, treats it as Rust authority, or uses + it outside its exact identity, propositions, consumers, or region. + +Record independently applicable global hard errors as well. + +### Exact authority propositions, quotations, and URLs + +The following quotations were checked on every listed exact-version page. The +quotation is the semantic content; presence on an allowlist is not itself +evidence for a proposition. + +For Rust 1.84.0, 1.85.0, and 1.86.0, the `Option` pages describe `unwrap_or` +using the “contained `Some` value” or “provided default,” and +`unwrap_unchecked` returning the “contained `Some` value.” Its Safety heading +says calling it on `None` “is undefined behavior.” Construction of +`Some(value)` is an immediate inspected source fact, not a separately cited +semantic premise. + +Exact pages, in canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked` + +For each of the same releases, the Conditional Compilation chapter says a +configuration predicate is “true if the option is set,” `all` requires “all of +the given predicates” to be true, and `not` is true when its “predicate is +false.” The `cfg` attribute “conditionally includes” its attached item. Those +checked excerpts supply exactly the source-selection implications used here. + +The standard-library macro page states: + +- “Causes compilation to fail with the given error message when encountered.” + +Exact pages, continuing canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html` + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. No policy sentence, +Cargo minimum, evaluator oracle, test result, CI result, or inferred tool +behavior is a Rust semantic axiom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/allowlist.txt new file mode 100644 index 0000000000..0e8296d465 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/allowlist.txt @@ -0,0 +1,15 @@ +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/consistency.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/consistency.schema.json new file mode 100644 index 0000000000..04f2f75ba5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/consistency.schema.json @@ -0,0 +1,72 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-consistency-review-v1", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "mode", + "atom_family_attestations", + "defect_family_attestations", + "challenges", + "ambiguities" + ], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "atom_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["atom_id", "all_ten_reports_compared", "evidence"], + "properties": { + "atom_id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "defect_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["field", "all_ten_reports_compared", "evidence"], + "properties": { + "field": { + "type": "string", + "pattern": "^(hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "challenges": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "recommended_decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "recommended_decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/raw-scores/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/raw-scores/s1.json new file mode 100644 index 0000000000..f1e0e9e393 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/raw-scores/s1.json @@ -0,0 +1,383 @@ +{ + "schema_version": 1, + "mode": "P", + "scorer_id": "s1", + "reports": [ + { + "label": "G", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"G lines 19–23 state the exact Scarlet predicate, including V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"G lines 28–32 state the exact Indigo predicate, including V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"G line 34 substitutes (1.84.0,X,true,false) and proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"G line 34 substitutes (1.84.0,X,true,true) and proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"G line 10 calls exact-promise identity UNPROVED and line 60 keeps the union only as an audit envelope."}, + {"id":"P6","decision":"PASS","evidence":"G lines 36–42 define D_S over all seven coordinates, all profiles, both d states, and all Option inputs."}, + {"id":"P7","decision":"PASS","evidence":"G lines 36–42 define D_I over the same complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"G line 58 separately maps every Scarlet disjunct into U and preserves remaining dimensions."}, + {"id":"P9","decision":"PASS","evidence":"G line 58 separately maps every Indigo disjunct into U and preserves remaining dimensions."}, + {"id":"P10","decision":"PASS","evidence":"G line 80 proves f=true,t=W falsifies every Scarlet turbo disjunct for arbitrary remaining coordinates."}, + {"id":"P11","decision":"PASS","evidence":"G line 80 proves the same universal wasm exclusion for Indigo."}, + {"id":"P12","decision":"PASS","evidence":"G lines 64, 68, 75, and 80 combine exact TCB mapping, all/cfg semantics, and compile_error! for the full R_W fiber."}, + {"id":"P13","decision":"PASS","evidence":"G lines 66 and 82 apply each exact-version unwrap_or contract to None and Some(x) on C_N."}, + {"id":"P14","decision":"PASS","evidence":"G lines 66 and 84 trace r into the syntactically constructed Some(r), excluding a None receiver."}, + {"id":"P15","decision":"PASS","evidence":"G line 84 composes unwrap_or, Some(r), and unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"G lines 54–55 define Required=D_A while retaining v,t,f,h,p,d,input."}, + {"id":"P17","decision":"PASS","evidence":"G lines 75–77 and 93 define Covered_sound from full seven-coordinate C_N/C_T predicates."}, + {"id":"P18","decision":"PASS","evidence":"G lines 82–84 prove both covered source branches; lines 90–95 admit exactly their full-case union."}, + {"id":"P19","decision":"PASS","evidence":"G lines 97–101 carry every Required coordinate through the !f/f split and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"G lines 7 and 97–104 state TCB-relative whole-domain soundness and supply its closure certificate."}, + {"id":"P21","decision":"PASS","evidence":"G lines 75–77 and 94 define Covered_behavior with all seven coordinates retained."}, + {"id":"P22","decision":"PASS","evidence":"G lines 82–84 prove Q on both branches admitted by Covered_behavior."}, + {"id":"P23","decision":"PASS","evidence":"G lines 97–102 prove Required subset Covered_behavior without projecting any coordinate."}, + {"id":"P24","decision":"PASS","evidence":"G lines 8 and 97–104 state the qualified whole-domain postcondition and its certificate."}, + {"id":"P25","decision":"PASS","evidence":"G line 68 limits BUILD-MAP-POLICY to the exact releases, mappings, profiles, and reachability/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"G lines 7–9 explicitly qualify all three mapping-dependent conclusions; line 68 labels the premise accepted trust, not Rust semantics."}, + {"id":"P27","decision":"PASS","evidence":"G lines 64–66 quote and link per-release cfg, compile_error!, unwrap_or, and unwrap_unchecked authority."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"G neither proposes nor certifies any unimplemented design."}, + "tcb_authority_defect": {"present":false,"evidence":"G gives exact TCB scope/qualification and version-matched quoted Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"G evidences review only of the supplied source snapshot and permitted authorities."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"I lines 40–44 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"I lines 45–49 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"I lines 51–53 prove (1.84.0,X,true,false) is Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"I lines 53–55 prove (1.84.0,X,true,true) is Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"I lines 17 and 21–22 leave exact-promise identity UNPROVED and separate it from Required."}, + {"id":"P6","decision":"PASS","evidence":"I lines 57–63 define D_S over the full tuple, every profile, both debug states, and every valid input."}, + {"id":"P7","decision":"PASS","evidence":"I lines 57–64 define D_I over that same full product."}, + {"id":"P8","decision":"PASS","evidence":"I lines 67–70 separately prove D_S subset Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"I lines 67–70 separately prove D_I subset Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"I lines 103–105 universally substitute f=true,t=W into Scarlet and exclude it."}, + {"id":"P11","decision":"PASS","evidence":"I lines 103–105 give the same universal substitution for Indigo."}, + {"id":"P12","decision":"PASS","evidence":"I lines 76–101 quote the exact cfg/all/macro rules and lines 91–107 apply the accepted mapping over h,p,d,i."}, + {"id":"P13","decision":"PASS","evidence":"I lines 111–126 apply exact-version unwrap_or prose to every input on the non-turbo branch."}, + {"id":"P14","decision":"PASS","evidence":"I lines 111–127 connect the local Some(y) receiver to the unchecked call's None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"I line 128 composes y from unwrap_or with unwrap_unchecked's contained-value result."}, + {"id":"P16","decision":"PASS","evidence":"I lines 57–65 define Required with v,t,f,h,p,d,i retained."}, + {"id":"P17","decision":"PASS","evidence":"I lines 137–145 define Base and Covered_sound with every case coordinate."}, + {"id":"P18","decision":"PASS","evidence":"I lines 124–133 prove the unsafe obligation on every branch in the stated coverage region."}, + {"id":"P19","decision":"PASS","evidence":"I lines 147–157 carry Base coordinates and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"I lines 15 and 155–161 give the TCB-qualified PROVED soundness conclusion and closure."}, + {"id":"P21","decision":"PASS","evidence":"I lines 137–145 define Covered_post using full Base(c)."}, + {"id":"P22","decision":"PASS","evidence":"I lines 126–128 provide complete Q derivations for both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"I lines 147–158 separately prove Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"I lines 16 and 155–161 state the postcondition PROVED under the same TCB qualification and certificate."}, + {"id":"P25","decision":"PASS","evidence":"I lines 165–171 identify the exact TCB entry, mappings, releases, and only permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"I lines 15–16 make the shared TCB qualification explicit, and lines 165–170 distinguish trust from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"I lines 76–89 and 111–120 provide quotations and exact-version URLs for every used Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"I contains no unimplemented proposal used as current evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"I precisely scopes and qualifies the TCB and supplies complete exact-version Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"I shows no inspection of prohibited evaluation or sibling material."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"A lines 40–44 reproduce the exact Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"A lines 45–49 reproduce the exact Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"A lines 58–60 establish the stated Scarlet-only witness in both predicates."}, + {"id":"P4","decision":"PASS","evidence":"A lines 60–63 establish the stated Indigo-only witness in both predicates."}, + {"id":"P5","decision":"PASS","evidence":"A lines 17 and 21–22 call policy identity UNPROVED and deny that Required resolves it."}, + {"id":"P6","decision":"PASS","evidence":"A lines 34–55 define D_S across all seven requested coordinates."}, + {"id":"P7","decision":"PASS","evidence":"A lines 34–55 define D_I across all seven requested coordinates."}, + {"id":"P8","decision":"PASS","evidence":"A lines 80–83 separately prove D_S subset Required with unchanged p,d,o."}, + {"id":"P9","decision":"PASS","evidence":"A lines 80–83 separately prove D_I subset Required with unchanged p,d,o."}, + {"id":"P10","decision":"PASS","evidence":"A lines 76–80 derive the union and expressly show Scarlet has no f,t=W case."}, + {"id":"P11","decision":"PASS","evidence":"A lines 76–80 likewise show Indigo has no f,t=W case."}, + {"id":"P12","decision":"PASS","evidence":"A lines 87–104, 119–126, and 158–164 supply exact mapping, all/cfg/macro authority, and universal rejection."}, + {"id":"P13","decision":"PASS","evidence":"A lines 106–117 and 148–150 prove the non-turbo result for every Option input."}, + {"id":"P14","decision":"PASS","evidence":"A lines 110–116 and 151–156 prove the unchecked receiver is the locally constructed Some(r)."}, + {"id":"P15","decision":"PASS","evidence":"A lines 151–157 compose both Option contracts to prove the turbo result."}, + {"id":"P16","decision":"PASS","evidence":"A lines 68–74 define Required over v,t,f,h,p,d,o."}, + {"id":"P17","decision":"PASS","evidence":"A lines 138–145 define full K(c) and Covered_sound without projection."}, + {"id":"P18","decision":"PASS","evidence":"A lines 148–157 prove every case admitted by Covered_sound on its selected branch."}, + {"id":"P19","decision":"PASS","evidence":"A lines 166–170 prove U implies the covered source region and Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"A lines 14, 19–22, and 168–172 give a TCB-qualified whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"A lines 138–145 define Covered_behavior over the full K tuple."}, + {"id":"P22","decision":"PASS","evidence":"A lines 148–157 prove Q for both branches included in Covered_behavior."}, + {"id":"P23","decision":"PASS","evidence":"A lines 166–172 separately prove Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"A lines 15, 19–22, and 168–172 give the qualified whole-domain behavioral conclusion."}, + {"id":"P25","decision":"PASS","evidence":"A lines 119–127 identify BUILD-MAP-POLICY via its alias and keep its exact identity, region, mappings, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"A lines 14–16 and 19–21 conspicuously qualify every mapping-dependent conclusion; lines 119–126 distinguish the TCB from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"A lines 87–117 pair every material cfg, compile_error!, and Option premise with quotations and exact-version URLs."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"A proposes only a comment improvement and does not use it to certify current code."}, + "tcb_authority_defect": {"present":false,"evidence":"A's TCB-BUILD-MAP alias is expressly identified as exact BUILD-MAP-POLICY and is correctly scoped and qualified."}, + "visible_scope_defect": {"present":false,"evidence":"A evidences no access beyond supplied source-review material and allowed authorities."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"J lines 28–34 state Scarlet exactly with the outer V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"J lines 36–42 state Indigo exactly with the outer V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"J lines 44–46 substitute and prove the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"J lines 46–50 substitute and prove the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"J lines 19 and 73–77 leave exact-promise identity UNPROVED and distinguish the audit union."}, + {"id":"P6","decision":"PASS","evidence":"J lines 54–68 define Base and D_S over all seven full-case coordinates."}, + {"id":"P7","decision":"PASS","evidence":"J lines 54–68 define Base and D_I over all seven full-case coordinates."}, + {"id":"P8","decision":"PASS","evidence":"J lines 69–75 separately prove D_S subset Required by disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"J lines 69–75 separately prove D_I subset Required by disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"J lines 90–93 universally falsify every Scarlet disjunct at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"J lines 90–93 universally falsify every Indigo disjunct at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"J lines 85–100 combine per-version all/cfg/macro authority with exact TCB mapping across the rejected fiber."}, + {"id":"P13","decision":"PASS","evidence":"J lines 84 and 106–112 apply unwrap_or to both exhaustive inputs on every non-turbo case."}, + {"id":"P14","decision":"PASS","evidence":"J lines 84 and 114–119 show the exact unchecked receiver is Some(value), never None."}, + {"id":"P15","decision":"PASS","evidence":"J lines 114–122 compose both Option operations and prove the turbo result for all inputs."}, + {"id":"P16","decision":"PASS","evidence":"J lines 60–70 define Required through full Base(c), retaining all coordinates."}, + {"id":"P17","decision":"PASS","evidence":"J lines 135–140 define Covered_sound using full Base(c)."}, + {"id":"P18","decision":"PASS","evidence":"J lines 106–122 prove each branch admitted by Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"J lines 143–148 prove Required subset Covered_sound while carrying Base(c)."}, + {"id":"P20","decision":"PASS","evidence":"J lines 16 and 143–149 give TCB-relative soundness and its full-case certificate."}, + {"id":"P21","decision":"PASS","evidence":"J lines 135–140 define Covered_post with every Base coordinate."}, + {"id":"P22","decision":"PASS","evidence":"J lines 106–122 establish g(i) on every branch included in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"J lines 143–149 independently prove Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"J lines 17 and 143–149 state the postcondition PROVED with the same TCB qualification and closure."}, + {"id":"P25","decision":"PASS","evidence":"J lines 155–160 restrict BUILD-MAP-POLICY to exact releases, manifest/source, mappings, and permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"J lines 16–18 explicitly qualify all dependent verdicts; lines 155–161 separate trusted mapping from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"J lines 81–86 quote and link all material Option, cfg/all/not, and compile_error! rules for each exact release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"J does not use any unimplemented design as current evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"J has complete exact TCB accounting, conspicuous qualification, and exact-version Rust quotations."}, + "visible_scope_defect": {"present":false,"evidence":"J establishes no material departure from supplied source-review scope."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"H lines 49–59 give the exact Scarlet predicate within full Base(c)."}, + {"id":"P2","decision":"PASS","evidence":"H lines 61–71 give the exact Indigo predicate within full Base(c)."}, + {"id":"P3","decision":"PASS","evidence":"H lines 73–76 prove the full Scarlet-only witness by substitution."}, + {"id":"P4","decision":"PASS","evidence":"H lines 76–79 prove the full Indigo-only witness by substitution."}, + {"id":"P5","decision":"PASS","evidence":"H lines 20–23 and 89–91 leave project-promise identity UNPROVED and label A only an audit domain."}, + {"id":"P6","decision":"PASS","evidence":"H lines 42–59 define DS through Base(c), which retains all seven coordinates and full fibers."}, + {"id":"P7","decision":"PASS","evidence":"H lines 42–71 define DI through the same complete Base(c)."}, + {"id":"P8","decision":"PASS","evidence":"H lines 81–89 separately prove DS subset A by the left union disjunct."}, + {"id":"P9","decision":"PASS","evidence":"H lines 81–89 separately prove DI subset A by the right union disjunct."}, + {"id":"P10","decision":"PASS","evidence":"H lines 95–97 universally exclude f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"H lines 95–97 universally exclude f=true,t=W from Indigo."}, + {"id":"P12","decision":"FAIL","evidence":"H lines 99–112 assert cfg(all(...)) rejection, but quote only cfg-attribute and compile_error! text; no exact-version authority supplies the material all predicate rule."}, + {"id":"P13","decision":"PASS","evidence":"H lines 124–143 cite each exact unwrap_or contract and prove both non-turbo input cases."}, + {"id":"P14","decision":"PASS","evidence":"H lines 124–149 cite the None prohibition and trace the receiver to constructed Some(x)."}, + {"id":"P15","decision":"PASS","evidence":"H lines 144–149 compose unwrap_or with unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"H lines 42–46 and 81–85 define Required=A over all seven coordinates."}, + {"id":"P17","decision":"PASS","evidence":"H lines 158–163 define Executable and Covered_sound through full Base(c)."}, + {"id":"P18","decision":"FAIL","evidence":"H's non-turbo coverage proof at lines 139–143 relies on not(feature=\"turbo\") selection, but no version-matched not semantics is cited or quoted."}, + {"id":"P19","decision":"FAIL","evidence":"H lines 168–174 claim closure, but Covered_sound applicability is incomplete because the non-turbo cfg-not selection premise is unchecked."}, + {"id":"P20","decision":"FAIL","evidence":"H lines 11–14 claim whole-domain soundness, but its required P19 certificate rests on the incomplete Covered_sound derivation."}, + {"id":"P21","decision":"PASS","evidence":"H lines 158–165 define Covered_post through full Base(c), retaining v,t,f,h,p,d,i."}, + {"id":"P22","decision":"FAIL","evidence":"H lines 139–149 prove local results, but Covered_post applicability for f=false still relies on uncited exact-version not semantics."}, + {"id":"P23","decision":"FAIL","evidence":"H lines 168–175 claim behavioral closure from a Covered_post derivation whose non-turbo source-selection premise is unchecked."}, + {"id":"P24","decision":"FAIL","evidence":"H lines 15–16 state behavior PROVED without importing the TCB qualification and the P23 closure certificate is incomplete."}, + {"id":"P25","decision":"PASS","evidence":"H lines 180–185 accurately limit BUILD-MAP-POLICY to exact releases, supplied inputs, mappings, and allowed reachability/rejection consumers."}, + {"id":"P26","decision":"FAIL","evidence":"H's behavior verdict at lines 15–16 says only 'on that same domain'; unlike soundness and rejection, it does not conspicuously carry the BUILD-MAP-POLICY qualification."}, + {"id":"P27","decision":"FAIL","evidence":"H's authority inventory omits exact-version quotations/URLs for the all and not semantics materially used at lines 102 and 139."} + ], + "hard_errors": [ + {"id":"G11","evidence":"H's positive rejection and coverage claims necessarily rely on unchecked all/not Rust semantics absent from its exact-version authority inventory."} + ], + "proposal_laundering": {"present":false,"evidence":"H proposes only a comment rewrite and does not use it to certify the current implementation."}, + "tcb_authority_defect": {"present":true,"evidence":"H omits material all/not Rust authority and fails to carry the accepted-TCB qualification into its behavioral conclusion."}, + "visible_scope_defect": {"present":false,"evidence":"H evidences no prohibited oracle, sibling, condition-map, prior-score, or evaluator access."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"C lines 23–25 state Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"C lines 27–29 state Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"C line 37 proves the stated configuration is Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"C line 38 proves the stated configuration is Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"C lines 11–13 and 115 leave exact-promise identity UNPROVED/unresolved and distinguish R."}, + {"id":"P6","decision":"PASS","evidence":"C lines 17–33 define K and D_S with every full-case coordinate and fiber."}, + {"id":"P7","decision":"PASS","evidence":"C lines 17–33 define K and D_I with every full-case coordinate and fiber."}, + {"id":"P8","decision":"PASS","evidence":"C lines 42–46 separately prove D_S subset R by its left disjunct."}, + {"id":"P9","decision":"PASS","evidence":"C lines 42–46 separately prove D_I subset R by its right disjunct."}, + {"id":"P10","decision":"PASS","evidence":"C line 66 substitutes f=true,t=W and universally excludes Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"C line 66 performs the same universal Indigo exclusion."}, + {"id":"P12","decision":"PASS","evidence":"C lines 50–66 combine exact-version all/cfg/macro text and exact TCB mapping over the whole wasm fiber."}, + {"id":"P13","decision":"PASS","evidence":"C lines 54 and 74–76 prove the non-turbo postcondition for every input."}, + {"id":"P14","decision":"PASS","evidence":"C lines 54 and 77 prove the unchecked receiver is the locally constructed Some(value)."}, + {"id":"P15","decision":"PASS","evidence":"C lines 77–78 compose both Option results into spec(i)."}, + {"id":"P16","decision":"PASS","evidence":"C lines 17–21 and 42–44 define Required=R over the complete c tuple."}, + {"id":"P17","decision":"PASS","evidence":"C lines 93–101 define Covered_sound via c in K, preserving all seven axes."}, + {"id":"P18","decision":"PASS","evidence":"C lines 58–64 and 74–78 give complete branch-selection and unsafe proofs for every covered case."}, + {"id":"P19","decision":"PASS","evidence":"C lines 101–105 carry each Required case into the applicable covered branch and state the containment."}, + {"id":"P20","decision":"PASS","evidence":"C lines 9, 13, and 103–107 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"C lines 97–101 define Covered_post through full K membership."}, + {"id":"P22","decision":"PASS","evidence":"C lines 76–78 prove spec(i) on both branches in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"C lines 103–105 prove Required subset Covered_post as part of the exact intersection closure."}, + {"id":"P24","decision":"PASS","evidence":"C lines 10, 13, and 103–107 state qualified behavior PROVED with its closure."}, + {"id":"P25","decision":"PASS","evidence":"C lines 58 and 109–113 keep BUILD-MAP-POLICY at its exact mapping, profile region, and permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"C lines 9–13 conspicuously qualify both conclusions, while lines 109–113 distinguish TCB from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"C lines 48–54 provide exact-version quotations and URLs for every material Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"C's suggested comment is not used as evidence for the current artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"C supplies exact TCB accounting and complete, version-matched authority closure."}, + "visible_scope_defect": {"present":false,"evidence":"C's naming of the supplied skill package is expressly in scope; no prohibited material is evidenced."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"D lines 33–39 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"D lines 41–49 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"D lines 51–53 state the valid Scarlet-only witness after giving exact formulas."}, + {"id":"P4","decision":"PASS","evidence":"D lines 51–53 state the valid Indigo-only witness after giving exact formulas."}, + {"id":"P5","decision":"PASS","evidence":"D lines 22–24 and 70–71 say the audit union does not identify the crate promise."}, + {"id":"P6","decision":"PASS","evidence":"D lines 28–30 and 55–60 define D_S across v,t,f,h,p,d,i."}, + {"id":"P7","decision":"PASS","evidence":"D lines 28–30 and 55–60 define D_I across v,t,f,h,p,d,i."}, + {"id":"P8","decision":"PASS","evidence":"D lines 62–70 separately prove D_S subset Required by left disjunction."}, + {"id":"P9","decision":"PASS","evidence":"D lines 62–70 separately prove D_I subset Required by right disjunction."}, + {"id":"P10","decision":"PASS","evidence":"D lines 95–101 universally exclude f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"D lines 95–101 universally exclude f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"D lines 86–101 and 165–181 combine exact mapping with quoted option-predicate, all, cfg, and macro rules over all build axes."}, + {"id":"P13","decision":"PASS","evidence":"D lines 128–129 and 154–158 prove unwrap_or's result for both non-turbo inputs."}, + {"id":"P14","decision":"PASS","evidence":"D lines 130 and 159–164 prove the exact unchecked receiver is Some(x), not None."}, + {"id":"P15","decision":"PASS","evidence":"D lines 130–131 and 159–164 compose unwrap_or with the contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"D lines 55–65 define Required through complete D_S/D_I full-case predicates."}, + {"id":"P17","decision":"PASS","evidence":"D lines 75–84 define Covered_SND via B(c), retaining every coordinate."}, + {"id":"P18","decision":"PASS","evidence":"D lines 86–94 and 128–131 establish applicable soundness on both branches admitted by Covered_SND."}, + {"id":"P19","decision":"PASS","evidence":"D lines 103–115 prove Required subset Covered_SND while carrying h,p,d,i parametrically."}, + {"id":"P20","decision":"PASS","evidence":"D lines 17–20 and 103–111 give TCB-qualified whole-domain soundness and closure."}, + {"id":"P21","decision":"PASS","evidence":"D lines 75–84 define Covered_POST via full B(c)."}, + {"id":"P22","decision":"PASS","evidence":"D lines 129–131 give complete Q proofs for both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"D lines 103–115 independently prove Required subset Covered_POST."}, + {"id":"P24","decision":"PASS","evidence":"D lines 19–20 and 103–111 state POST PROVED under the same TCB and its closure."}, + {"id":"P25","decision":"PASS","evidence":"D lines 183–189 state the exact Cargo/releases, mappings, profiles, consumers, exclusions, and triggers."}, + {"id":"P26","decision":"PASS","evidence":"D lines 17–20 share an explicit TCB qualification, and lines 183–189 label it out-of-band rather than Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"D lines 150–181 quote and link every material Option, cfg/all/not, and compile_error! premise per release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"D does not use its proposed comment replacement to certify an unimplemented artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"D has exact TCB scope, conspicuous qualification, and complete exact-version Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"D evidences no source-scope departure or prohibited evaluator access."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"B lines 23–28 state Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"B lines 29–34 state Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"B line 40 substitutes and proves the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"B line 40 substitutes and proves the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"B lines 12 and 53 distinguish unresolved crate-level Required from theorem-only Required_A."}, + {"id":"P6","decision":"PASS","evidence":"B lines 16–18 and 36–38 define S(c) across the complete full-case product."}, + {"id":"P7","decision":"PASS","evidence":"B lines 16–18 and 36–38 define I(c) across the complete full-case product."}, + {"id":"P8","decision":"PASS","evidence":"B lines 42–51 separately prove S subset A with every p,d,i unchanged."}, + {"id":"P9","decision":"PASS","evidence":"B lines 42–51 separately prove I subset A with every p,d,i unchanged."}, + {"id":"P10","decision":"PASS","evidence":"B lines 45–51 and 69–70 establish Scarlet's universal turbo/W exclusion."}, + {"id":"P11","decision":"PASS","evidence":"B lines 45–51 and 69–70 establish Indigo's universal turbo/W exclusion."}, + {"id":"P12","decision":"PASS","evidence":"B lines 57–70 quote and apply exact mapping, all/cfg, and compile_error! rules across all required axes."}, + {"id":"P13","decision":"PASS","evidence":"B lines 61 and 72–75 prove unwrap_or's exact non-turbo result for all inputs."}, + {"id":"P14","decision":"PASS","evidence":"B lines 61 and 75 show the unsafe receiver is constructed as Some(x), never None."}, + {"id":"P15","decision":"PASS","evidence":"B line 75 composes the first result with unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"B lines 16–18, 42, and 53 define Required_A over the complete case tuple."}, + {"id":"P17","decision":"PASS","evidence":"B lines 87–99 define Covered_sound through full A(c) and the complete selected execution."}, + {"id":"P18","decision":"PASS","evidence":"B lines 67 and 74–75 prove every selected branch admitted by Covered_sound UB-free."}, + {"id":"P19","decision":"PASS","evidence":"B lines 101–102 give the exhaustive full-case split and prove Required_A subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"B lines 9 and 101–102 state TCB-qualified whole-domain soundness with exact closure."}, + {"id":"P21","decision":"PASS","evidence":"B lines 87–99 define Covered_post through A(c), retaining all dimensions and input."}, + {"id":"P22","decision":"PASS","evidence":"B lines 74–75 prove q(i) on both branches admitted by Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"B lines 101–102 prove Required_A subset Covered_post and exact aggregate closure."}, + {"id":"P24","decision":"PASS","evidence":"B lines 10 and 101–102 give the TCB-qualified whole-domain postcondition conclusion."}, + {"id":"P25","decision":"PASS","evidence":"B line 63 records the exact releases, supplied inputs, mappings, all profiles, and permitted selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"B lines 9–11 use an explicit shared qualification; line 63 distinguishes BUILD-MAP-POLICY from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"B lines 57–61 quote and link every material cfg/all/not, compile_error!, and Option proposition per exact release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"B's comment suggestion is not used to narrow or certify current obligations."}, + "tcb_authority_defect": {"present":false,"evidence":"B accurately scopes and qualifies BUILD-MAP-POLICY and supplies complete exact-version authority."}, + "visible_scope_defect": {"present":false,"evidence":"B establishes no review of prohibited evaluation materials."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"F line 37 states the exact Scarlet predicate with V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"F line 41 states the exact Indigo predicate with V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"F lines 45–47 substitute and prove the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"F lines 48–50 substitute and prove the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"F lines 25–27 and 65–66 leave exact-promise identity UNPROVED and distinguish R."}, + {"id":"P6","decision":"PASS","evidence":"F lines 31–33 and 52–56 define D_S over all seven coordinates and complete fibers."}, + {"id":"P7","decision":"PASS","evidence":"F lines 31–33 and 52–56 define D_I over all seven coordinates and complete fibers."}, + {"id":"P8","decision":"PASS","evidence":"F lines 58–64 separately prove D_S subset R as a full-case containment."}, + {"id":"P9","decision":"PASS","evidence":"F lines 58–64 separately prove D_I subset R as a full-case containment."}, + {"id":"P10","decision":"PASS","evidence":"F lines 115–117 universally falsify Scarlet at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"F lines 115–117 universally falsify Indigo at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"F lines 83–95 and 119–125 provide exact all/cfg/macro authority, TCB mapping, and full-fiber rejection."}, + {"id":"P13","decision":"PASS","evidence":"F lines 70–80 and 138–143 prove the non-turbo result for every valid input and exact release."}, + {"id":"P14","decision":"PASS","evidence":"F lines 70–80 and 145–150 connect Some(x) at the exact unsafe receiver to the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"F lines 145–152 compose unwrap_or and unwrap_unchecked to establish Q."}, + {"id":"P16","decision":"PASS","evidence":"F lines 10–12 and 52–60 define Required=R over v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"F lines 164–176 define Covered_sound=R and explicitly retain every dimension through universal branch lemmas."}, + {"id":"P18","decision":"PASS","evidence":"F lines 109–113 and 138–152 prove each branch in Covered_sound has a complete soundness derivation."}, + {"id":"P19","decision":"PASS","evidence":"F lines 171–180 exhaust f and prove Required=Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"F lines 22 and 178–184 give the BUILD-MAP-POLICY-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"F lines 164–176 define Covered_post=R while explicitly retaining v,t,f,h,p,d,i."}, + {"id":"P22","decision":"PASS","evidence":"F lines 138–152 prove Q completely on both branches admitted by Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"F lines 171–183 separately prove Required=Covered_post and its containment."}, + {"id":"P24","decision":"PASS","evidence":"F lines 23 and 180–184 give the qualified whole-domain behavioral conclusion and closure."}, + {"id":"P25","decision":"PASS","evidence":"F lines 97–105 keep BUILD-MAP-POLICY to exact bundled releases, mappings, supplied artifact, profiles, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"F lines 22–24 conspicuously qualify all verdicts, and lines 97–104 distinguish accepted mapping from Rust semantics."}, + {"id":"P27","decision":"PASS","evidence":"F lines 70–95 pair all used Option, cfg/all/not, and compile_error! propositions with exact-version URLs and quotations."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"F uses no unimplemented design as proof of current soundness or behavior."}, + "tcb_authority_defect": {"present":false,"evidence":"F provides exact TCB scope and conspicuous qualification plus complete versioned Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"F evidences no review outside supplied source scope and permitted authority pages."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"E lines 26–33 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"E lines 35–42 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"E lines 44–48 state a valid Scarlet-only witness, (1.84.0,A,true,true)."}, + {"id":"P4","decision":"PASS","evidence":"E lines 44–48 state a valid Indigo-only witness, (1.84.0,X,true,true)."}, + {"id":"P5","decision":"PASS","evidence":"E lines 12 and 17–19 leave exact-promise identity UNPROVED and deny renaming the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"E lines 53–59 define D_S over all profiles, both debug states, and every Option input."}, + {"id":"P7","decision":"PASS","evidence":"E lines 53–60 define D_I over the same complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"E lines 66–80 separately prove D_S is contained in the transparent full-case superset Required."}, + {"id":"P9","decision":"PASS","evidence":"E lines 66–80 separately prove D_I is contained in Required."}, + {"id":"P10","decision":"PASS","evidence":"E line 82 universally falsifies Scarlet at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"E line 82 universally falsifies Indigo at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"E lines 82–88 and 95–107 apply exact all/cfg/macro authority and BUILD-MAP-POLICY across the complete wasm fiber."}, + {"id":"P13","decision":"PASS","evidence":"E lines 108–116 and 125–129 prove the non-turbo postcondition for every input and exact release."}, + {"id":"P14","decision":"PASS","evidence":"E lines 108–116 and 131–137 prove the unsafe receiver is immediately constructed as Some(y), not None."}, + {"id":"P15","decision":"PASS","evidence":"E lines 131–139 compose unwrap_or and unwrap_unchecked to prove the turbo result."}, + {"id":"P16","decision":"PASS","evidence":"E lines 66–72 define Required over the full F(c) tuple with no projected dimension."}, + {"id":"P17","decision":"PASS","evidence":"E lines 148–154 define Covered_sound from full L0/L1 case predicates."}, + {"id":"P18","decision":"PASS","evidence":"E lines 125–139 prove soundness on every case in L0 or L1."}, + {"id":"P19","decision":"PASS","evidence":"E lines 157–162 exhaust f and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"E lines 13, 17–18, and 157–164 give the BUILD-MAP-POLICY-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"E lines 148–155 define Covered_behavior from full L0/L1 predicates, retaining every case coordinate."}, + {"id":"P22","decision":"PASS","evidence":"E lines 125–139 prove the exact documented result on both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"E lines 157–164 separately prove Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"E lines 14, 17–18, and 157–164 give the qualified whole-domain behavioral conclusion and closure."}, + {"id":"P25","decision":"PASS","evidence":"E lines 168–173 limit BUILD-MAP-POLICY to exact releases, mappings, supplied artifact, and selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"E lines 13–18 conspicuously qualify all dependent conclusions, and lines 168–173 distinguish the TCB from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"E lines 90–116 pair each material cfg/all/not, compile_error!, and Option premise with exact-version quotations and URLs."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"E's suggested comment is not used as evidence for the current artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"E gives exact TCB accounting, explicit qualification, and complete version-matched Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"E establishes no material departure from the supplied review scope."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "H: the rubric does not explicitly state how far an unchecked cfg-combinator authority premise cascades beyond P12/P27. I scored P18–P24 downstream failures where complete applicability and listed dependencies require that source-selection premise.", + "H: 'on that same domain' could import only the preceding domain or also its TCB qualification. I scored P26 FAIL because the behavioral verdict does not conspicuously say it shares the BUILD-MAP-POLICY qualification." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/raw-scores/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/raw-scores/s2.json new file mode 100644 index 0000000000..5dc9a90b5e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/raw-scores/s2.json @@ -0,0 +1,382 @@ +{ + "schema_version": 1, + "mode": "P", + "scorer_id": "s2", + "reports": [ + { + "label": "C", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L23-25 gives the complete Scarlet formula, including V/T bounds and all three disjuncts."}, + {"id":"P2","decision":"PASS","evidence":"L27-29 gives the complete Indigo formula, including both versioned turbo arms."}, + {"id":"P3","decision":"PASS","evidence":"L35-38 substitutes (1.84.0,X,true,false) and proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L35-38 substitutes (1.84.0,X,true,true) and proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L11 and L42-46 leave exact-promise identity UNPROVED while using the union only as an audit requirement."}, + {"id":"P6","decision":"PASS","evidence":"L17-21 and L31-33 define D_S over the complete seven-coordinate product."}, + {"id":"P7","decision":"PASS","evidence":"L17-21 and L31-33 define D_I over the complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"L42-46 proves D_S subseteq R by the left union disjunct."}, + {"id":"P9","decision":"PASS","evidence":"L42-46 separately proves D_I subseteq R by the right union disjunct."}, + {"id":"P10","decision":"PASS","evidence":"L66 universally falsifies every Scarlet arm when f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"L66 universally falsifies every Indigo arm when f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"L50-52 and L58-66 apply exact BUILD-MAP-POLICY, all/cfg, and compile_error contracts over v,h,p,d."}, + {"id":"P13","decision":"PASS","evidence":"L54 and L76 apply each exact-version unwrap_or contract to None and Some."}, + {"id":"P14","decision":"PASS","evidence":"L54 and L77 trace unwrap_or's byte into the exact Some(value) receiver and discharge the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L54 and L78 compose unwrap_or, Some construction, and unwrap_unchecked's return contract."}, + {"id":"P16","decision":"PASS","evidence":"L21, L42-44, and L93 define Required=R over complete tuples in K."}, + {"id":"P17","decision":"PASS","evidence":"L95 and L101 retain v,t,f,h,p,d,i in Covered_sound through K."}, + {"id":"P18","decision":"PASS","evidence":"L76-77 and L95 prove both no-unsafe and turbo-unsafe regions admitted to Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L103-105 maps each Required f branch to proved coverage and states Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L9, L13, and L103-107 conclude whole-domain soundness PROVED relative to BUILD-MAP-POLICY from closure."}, + {"id":"P21","decision":"PASS","evidence":"L97-101 retain all seven coordinates in Covered_post through K."}, + {"id":"P22","decision":"PASS","evidence":"L76, L78, and L97-99 establish the postcondition on every case admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L103-105 independently gives Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L10, L13, and L103-107 conclude the full-domain postcondition PROVED with the TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L58 and L111-113 confine BUILD-MAP-POLICY to its exact mapping identity, consumers, and region."}, + {"id":"P26","decision":"PASS","evidence":"L9-10, L13, L66, and L79 conspicuously carry BUILD-MAP-POLICY into all dependent conclusions."}, + {"id":"P27","decision":"PASS","evidence":"L50-54 supplies exact-version URLs and quotations for cfg/all/not, compile_error, unwrap_or, and unwrap_unchecked."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L81-89 labels the suggested comment as documentation-only and proves the current implementation independently."}, + "tcb_authority_defect": {"present":false,"evidence":"L50-54 and L111-113 separate exact Rust authority from the narrowly accepted build mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5 identifies only the supplied snapshot and expressly disclaims prior-audit use."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L39-44 reproduces Scarlet with its exact bounds and versioned X/A arms."}, + {"id":"P2","decision":"PASS","evidence":"L45-49 reproduces Indigo with its exact bounds and versioned X/A arms."}, + {"id":"P3","decision":"PASS","evidence":"L58-60 checks (1.84.0,X,true,false) in Scarlet and out of Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L60-63 checks (1.84.0,X,true,true) in Indigo and out of Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L17 and L19-22 state policy identity UNPROVED and distinguish Required from the project promise."}, + {"id":"P6","decision":"PASS","evidence":"L28-36 and L51-56 define D_S with all seven coordinates and every valid Option input."}, + {"id":"P7","decision":"PASS","evidence":"L28-36 and L51-56 define D_I with all seven coordinates and every valid Option input."}, + {"id":"P8","decision":"PASS","evidence":"L76-83 separately proves D_S subseteq Required via S implies S or I."}, + {"id":"P9","decision":"PASS","evidence":"L76-83 separately proves D_I subseteq Required via I implies S or I."}, + {"id":"P10","decision":"PASS","evidence":"L76-80 and L158-160 show Scarlet has no f=true,t=W case for arbitrary remaining axes."}, + {"id":"P11","decision":"PASS","evidence":"L76-80 and L158-160 show Indigo has no f=true,t=W case for arbitrary remaining axes."}, + {"id":"P12","decision":"PASS","evidence":"L87-104 and L158-164 give the exact mapping, all/cfg inclusion, and compile_error failure for every full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L106-117 and L148-150 apply exact-version unwrap_or prose to both Option variants."}, + {"id":"P14","decision":"PASS","evidence":"L151-157 traces r through unwrap_or into the immediate Some(r) receiver and rules out None."}, + {"id":"P15","decision":"PASS","evidence":"L151-157 composes both Option return contracts to obtain Q(o)."}, + {"id":"P16","decision":"PASS","evidence":"L67-74 defines Required over v,t,f,h,p,d,o without projection."}, + {"id":"P17","decision":"PASS","evidence":"L138-146 defines K and Covered_sound with every case coordinate."}, + {"id":"P18","decision":"PASS","evidence":"L148-157 proves the safe and turbo regions included in Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L166-172 carries all common conjuncts and proves Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L14, L19-22, and L166-172 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L138-146 defines Covered_behavior over the same complete K tuple."}, + {"id":"P22","decision":"PASS","evidence":"L148-157 proves Q(o) on every non-turbo and turbo case admitted to behavioral coverage."}, + {"id":"P23","decision":"PASS","evidence":"L166-172 separately proves Required subseteq Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L15, L19-22, and L166-172 conclude the postcondition PROVED over Required relative to the TCB."}, + {"id":"P25","decision":"PASS","evidence":"L119-127 records the exact bundled releases, manifest, mappings, consumers, and exclusions."}, + {"id":"P26","decision":"PASS","evidence":"L14-16 and L19-22 conspicuously qualify soundness, behavior, and rejection with TCB-BUILD-MAP."}, + {"id":"P27","decision":"PASS","evidence":"L87-117 provides version-matched URLs and supplying quotations for every material Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L181-191 identifies a documentation-only replacement and does not use it to prove the current code."}, + "tcb_authority_defect": {"present":false,"evidence":"L119-127 narrowly accounts for BUILD-MAP-POLICY and separates exact Rust axioms."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 confines the review to supplied files and disclaims prior-audit evidence."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L16-23 states Scarlet's full V/T-bounded predicate and every disjunct."}, + {"id":"P2","decision":"PASS","evidence":"L25-32 states Indigo's full V/T-bounded predicate and every disjunct."}, + {"id":"P3","decision":"PASS","evidence":"L34 substitutes the 1.84 X unhardened witness into both predicates."}, + {"id":"P4","decision":"PASS","evidence":"L34 substitutes the 1.84 X hardened witness into both predicates."}, + {"id":"P5","decision":"PASS","evidence":"L10 and L60 leave exact-promise identity UNPROVED and label U only an audit envelope."}, + {"id":"P6","decision":"PASS","evidence":"L36-42 defines D_S over the full seven-coordinate case."}, + {"id":"P7","decision":"PASS","evidence":"L36-42 defines D_I over the full seven-coordinate case."}, + {"id":"P8","decision":"PASS","evidence":"L51-58 proves every Scarlet disjunct implies U with remaining dimensions unchanged."}, + {"id":"P9","decision":"PASS","evidence":"L51-58 separately proves every Indigo disjunct implies U."}, + {"id":"P10","decision":"PASS","evidence":"L75 and L80 prove the entire f=true,t=W fiber is disjoint from D_S."}, + {"id":"P11","decision":"PASS","evidence":"L75 and L80 prove the entire f=true,t=W fiber is disjoint from D_I."}, + {"id":"P12","decision":"PASS","evidence":"L64, L68, and L75-80 apply the accepted mapping and exact-version all/cfg/compile_error implications universally."}, + {"id":"P13","decision":"PASS","evidence":"L66 and L82 apply unwrap_or's exact contract to arbitrary None/Some input."}, + {"id":"P14","decision":"PASS","evidence":"L66 and L84 connect r=input.unwrap_or(0) to the exact Some(r) unsafe receiver."}, + {"id":"P15","decision":"PASS","evidence":"L66 and L84 use unwrap_unchecked's return contract to recover the original specification result."}, + {"id":"P16","decision":"PASS","evidence":"L36-55 states Required=D_A with v,t,f,h,p,d,input retained."}, + {"id":"P17","decision":"PASS","evidence":"L75-77 and L90-95 define Covered_sound from full-case C_N and C_T predicates."}, + {"id":"P18","decision":"PASS","evidence":"L82-84 establishes applicable no-unsafe and unsafe-site proofs throughout C_N union C_T."}, + {"id":"P19","decision":"PASS","evidence":"L97-102 maps each Required branch to C_N or C_T and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L7 and L97-104 conclude full-domain soundness PROVED relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L75-77 and L90-95 retain the complete tuple in Covered_behavior."}, + {"id":"P22","decision":"PASS","evidence":"L82-84 proves the return specification for all C_N and C_T inputs."}, + {"id":"P23","decision":"PASS","evidence":"L97-102 independently states Required subseteq Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L8 and L97-104 give the TCB-qualified whole-domain postcondition verdict."}, + {"id":"P25","decision":"PASS","evidence":"L68 restricts BUILD-MAP-POLICY to the three Cargo identities, named mappings, profiles, and allowed consumers."}, + {"id":"P26","decision":"PASS","evidence":"L7-10, L68, and L80 carry the accepted mapping qualification into all dependent results."}, + {"id":"P27","decision":"PASS","evidence":"L64-66 pairs each material cfg/compile_error/Option proposition with per-release URLs and quotations."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L106-116 calls the suggested comment documentation debt and does not use it as current-artifact evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"L64-68 separates versioned Rust quotations from the narrowly scoped accepted build premise."}, + "visible_scope_defect": {"present":false,"evidence":"L5 identifies only the complete supplied target snapshot and source-level scope."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L26-34 reproduces Scarlet exactly, including V/T bounds and both turbo targets."}, + {"id":"P2","decision":"PASS","evidence":"L36-42 reproduces Indigo exactly, including its versioned X and A clauses."}, + {"id":"P3","decision":"PASS","evidence":"L44-46 verifies the 1.84 X unhardened Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"L46-50 verifies the 1.84 X hardened Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"L19 and L73-77 keep exact-promise identity UNPROVED and distinct from the audit union."}, + {"id":"P6","decision":"PASS","evidence":"L54-68 defines Base over all seven axes and D_S as Base intersect Scarlet."}, + {"id":"P7","decision":"PASS","evidence":"L54-68 defines Base over all seven axes and D_I as Base intersect Indigo."}, + {"id":"P8","decision":"PASS","evidence":"L69-75 separately proves D_S subseteq Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L69-75 separately proves D_I subseteq Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L90-93 shows every full f=true,t=W case is outside Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L90-93 shows every full f=true,t=W case is outside Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L85-100 combines exact-version all/cfg/compile_error contracts with the accepted mapping across the full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L84 and L104-112 apply unwrap_or to both exhaustive valid inputs."}, + {"id":"P14","decision":"PASS","evidence":"L84 and L114-119 trace value into the immediate Some(value) receiver and rule out None."}, + {"id":"P15","decision":"PASS","evidence":"L114-122 composes unwrap_or and unwrap_unchecked return contracts to obtain g(i)."}, + {"id":"P16","decision":"PASS","evidence":"L54-70 states Required over complete Base tuples."}, + {"id":"P17","decision":"PASS","evidence":"L135-141 defines Covered_sound with every Base coordinate."}, + {"id":"P18","decision":"PASS","evidence":"L106-122 and L143-144 prove both source branches admitted by Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L143-148 maps all Required cases and states Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L16, L18, and L143-149 provide the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L135-141 defines Covered_post over the complete Base tuple."}, + {"id":"P22","decision":"PASS","evidence":"L106-122 proves g(i) on every branch included in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L143-148 independently proves Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L17-18 and L143-149 conclude the full-domain postcondition with the same TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L155-160 gives the exact bundled-Cargo identity, supplied artifact, mappings, consumers, and exclusions."}, + {"id":"P26","decision":"PASS","evidence":"L16-18, L95-100, and L155-160 conspicuously qualify every mapping-dependent conclusion."}, + {"id":"P27","decision":"PASS","evidence":"L81-86 supplies exact-version URLs and quotations for Option, all/not/cfg, and compile_error semantics."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L124-131 labels the replacement as documentation debt and the proof does not depend on it."}, + "tcb_authority_defect": {"present":false,"evidence":"L81-86 and L155-160 keep exact Rust authority separate from the accepted mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 confines the audit to the supplied target materials."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L23-33 gives Scarlet's exact bounded predicate and all disjuncts."}, + {"id":"P2","decision":"PASS","evidence":"L35-42 gives Indigo's exact bounded predicate and all disjuncts."}, + {"id":"P3","decision":"PASS","evidence":"L44-48 correctly checks (1.84.0,A,true,true) as Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"L44-48 correctly checks (1.84.0,X,true,true) as Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"L12 and L17-19 leave policy identity UNPROVED and refuse to rename the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"L53-60 defines D_S over every profile, both debug states, and all valid Option inputs."}, + {"id":"P7","decision":"PASS","evidence":"L53-60 defines D_I over every profile, both debug states, and all valid Option inputs."}, + {"id":"P8","decision":"PASS","evidence":"L66-80 separately proves Scarlet cases imply the selected full superset."}, + {"id":"P9","decision":"PASS","evidence":"L66-80 separately proves Indigo cases imply the selected full superset."}, + {"id":"P10","decision":"PASS","evidence":"L82-88 universally excludes f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L82-88 universally excludes f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L82-88 and L95-107 apply exact mapping, all/cfg selection, and compile_error failure to the full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L108-116 and L125-129 apply exact-version unwrap_or behavior to both variants."}, + {"id":"P14","decision":"PASS","evidence":"L131-139 traces y into the syntactically immediate Some(y) receiver."}, + {"id":"P15","decision":"PASS","evidence":"L131-139 composes both Option contracts to prove the documented result."}, + {"id":"P16","decision":"PASS","evidence":"L66-72 defines Required with all seven dimensions explicit."}, + {"id":"P17","decision":"PASS","evidence":"L148-155 retains the full F(c) tuple in Covered_sound."}, + {"id":"P18","decision":"PASS","evidence":"L125-139 and L151-154 completely prove both L0 and L1 soundness regions."}, + {"id":"P19","decision":"PASS","evidence":"L157-164 exhausts f and proves Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L13, L17-19, and L157-164 certify soundness over Required relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L148-155 retains the full F(c) tuple in Covered_behavior."}, + {"id":"P22","decision":"PASS","evidence":"L125-139 proves the documented return on every L0 and L1 case."}, + {"id":"P23","decision":"PASS","evidence":"L157-164 separately proves Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L14, L17-19, and L157-164 certify the full-domain behavior theorem with TCB relativity."}, + {"id":"P25","decision":"PASS","evidence":"L168-173 confines BUILD-MAP-POLICY to exact releases, mappings, consumers, and excludes Rust/backend claims."}, + {"id":"P26","decision":"PASS","evidence":"L13-18 and L82-88 explicitly qualify all mapping-dependent verdicts."}, + {"id":"P27","decision":"PASS","evidence":"L92-116 pairs every material cfg/compile_error/Option premise with exact-version links and quotes."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L175-186 labels the replacement documentation-only and does not use it for current proof."}, + "tcb_authority_defect": {"present":false,"evidence":"L168-173 narrowly scopes the accepted mapping and keeps CFG/CE/OPTION as exact Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"L5-8 states a source-only review of the supplied target and no external execution evidence."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L37-44 reproduces the complete bounded Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"L45-49 reproduces the complete bounded Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"L51-55 verifies the Scarlet-only 1.84 X unhardened witness."}, + {"id":"P4","decision":"PASS","evidence":"L53-55 verifies the Indigo-only 1.84 X hardened witness."}, + {"id":"P5","decision":"PASS","evidence":"L17 and L19-24 leave project-promise identity UNPROVED and distinguish the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"L57-65 defines D_S over all seven requested coordinates."}, + {"id":"P7","decision":"PASS","evidence":"L57-65 defines D_I over all seven requested coordinates."}, + {"id":"P8","decision":"PASS","evidence":"L67-70 separately proves D_S subseteq Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L67-70 separately proves D_I subseteq Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L103-107 substitutes f=true,t=W and excludes all Scarlet cases."}, + {"id":"P11","decision":"PASS","evidence":"L103-107 substitutes f=true,t=W and excludes all Indigo cases."}, + {"id":"P12","decision":"PASS","evidence":"L76-101 combines exact-version all/cfg/compile_error quotations with exact BUILD-MAP-POLICY mapping."}, + {"id":"P13","decision":"PASS","evidence":"L111-126 applies per-release unwrap_or prose to every valid input."}, + {"id":"P14","decision":"PASS","evidence":"L111-127 traces the produced byte into immediate Some(y) and rules out None."}, + {"id":"P15","decision":"PASS","evidence":"L111-128 composes unwrap_or and unwrap_unchecked returns to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L57-65 defines Required as a predicate on v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"L137-145 defines Covered_sound with all Base coordinates retained."}, + {"id":"P18","decision":"PASS","evidence":"L124-133 proves the no-unsafe and turbo unsafe-obligation regions underlying Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L147-158 maps every Required policy arm into Compiles and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L15, L19-21, and L147-161 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L137-145 defines Covered_post with every full-case coordinate."}, + {"id":"P22","decision":"PASS","evidence":"L124-133 proves Q on every case admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L147-158 separately proves Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L16, L19-21, and L147-161 conclude the documented postcondition on the whole domain under the same qualification."}, + {"id":"P25","decision":"PASS","evidence":"L91-94 and L165-171 limit BUILD-MAP-POLICY to its exact mapping and listed source-selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"L15-16, L106, L129, and L165-171 carry BUILD-MAP-POLICY into every dependent conclusion."}, + {"id":"P27","decision":"PASS","evidence":"L76-89 and L111-120 provide exact-release URLs and supplying quotations for all material Rust semantics."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L173-183 explicitly calls the replacement documentation-only while the current implementation remains proved."}, + "tcb_authority_defect": {"present":false,"evidence":"L165-171 keeps the accepted mapping within its consumers and uses exact-version Rust authority separately."}, + "visible_scope_defect": {"present":false,"evidence":"L5-11 limits scope to the supplied target and its visible surfaces."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L31-37 states Scarlet exactly with V/T bounds and both turbo arms."}, + {"id":"P2","decision":"PASS","evidence":"L39-41 states Indigo exactly with V/T bounds and both versioned arms."}, + {"id":"P3","decision":"PASS","evidence":"L43-47 verifies the Scarlet-only 1.84 X unhardened configuration."}, + {"id":"P4","decision":"PASS","evidence":"L48-50 verifies the Indigo-only 1.84 X hardened configuration."}, + {"id":"P5","decision":"PASS","evidence":"L25-27 and L65-66 leave exact promise identity UNPROVED and distinguish R from policy."}, + {"id":"P6","decision":"PASS","evidence":"L31-33 and L52-56 define D_S with all full-case dimensions."}, + {"id":"P7","decision":"PASS","evidence":"L31-33 and L52-56 define D_I with all full-case dimensions."}, + {"id":"P8","decision":"PASS","evidence":"L58-64 separately proves D_S subseteq R by union introduction."}, + {"id":"P9","decision":"PASS","evidence":"L58-64 separately proves D_I subseteq R by union introduction."}, + {"id":"P10","decision":"PASS","evidence":"L115-117 universally excludes f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L115-117 universally excludes f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L83-95 and L119-125 apply exact mapping, all/cfg, and compile_error authority over all remaining axes."}, + {"id":"P13","decision":"PASS","evidence":"L70-80 and L138-143 prove unwrap_or's result for None and every Some(n)."}, + {"id":"P14","decision":"PASS","evidence":"L145-152 traces x into an immediate Some(x) receiver and discharges the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L145-152 uses both exact Option return contracts to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L52-60 states Required=R on the complete tuple c."}, + {"id":"P17","decision":"PASS","evidence":"L164-176 defines Covered_sound=R and explicitly retains v,t,f,h,p,d,i."}, + {"id":"P18","decision":"PASS","evidence":"L138-152 and L171-176 establish valid soundness proofs on both exhaustive R branches."}, + {"id":"P19","decision":"PASS","evidence":"L171-180 exhausts f, maps to proved lemmas, and states Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L22, L24, and L178-184 conclude whole-domain soundness relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L164-176 defines Covered_post=R with every coordinate retained."}, + {"id":"P22","decision":"PASS","evidence":"L138-152 and L171-176 prove Q throughout both Covered_post branches."}, + {"id":"P23","decision":"PASS","evidence":"L178-181 independently proves Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L23-24 and L178-184 provide the TCB-relative whole-domain postcondition conclusion."}, + {"id":"P25","decision":"PASS","evidence":"L97-105 confines BUILD-MAP-POLICY to exact bundled releases, supplied artifact, mappings, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"L22-24 and L119-125 explicitly carry the build-map qualification into all dependent verdicts."}, + {"id":"P27","decision":"PASS","evidence":"L70-95 gives exact-release URLs and quotations for all Option and conditional-compilation premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L154-162 labels the suggested replacement as documentation debt and proves current code separately."}, + "tcb_authority_defect": {"present":false,"evidence":"L97-105 narrowly scopes the sole TCB entry and separates authoritative Option/cfg semantics."}, + "visible_scope_defect": {"present":false,"evidence":"L5-8 confines review to supplied evidence and disclaims prior results."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L28-39 reproduces Scarlet with exact V/T bounds and all clauses."}, + {"id":"P2","decision":"PASS","evidence":"L41-49 reproduces Indigo with exact V/T bounds and all clauses."}, + {"id":"P3","decision":"PASS","evidence":"L51-53 states a correct Scarlet-minus-Indigo witness."}, + {"id":"P4","decision":"PASS","evidence":"L51-53 states a correct Indigo-minus-Scarlet witness."}, + {"id":"P5","decision":"PASS","evidence":"L22-24 and L68-71 leave the exact project domain unresolved and call Required only an audit union."}, + {"id":"P6","decision":"PASS","evidence":"L28-31 and L55-60 define D_S over every profile, debug state, and valid input."}, + {"id":"P7","decision":"PASS","evidence":"L28-31 and L55-60 define D_I over every profile, debug state, and valid input."}, + {"id":"P8","decision":"PASS","evidence":"L62-70 separately proves D_S implies Required."}, + {"id":"P9","decision":"PASS","evidence":"L62-70 separately proves D_I implies Required."}, + {"id":"P10","decision":"PASS","evidence":"L95-101 shows all f=true,t=W cases are outside Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L95-101 shows all f=true,t=W cases are outside Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L95-101 and L165-181 apply exact accepted mapping and exact-version all/cfg/compile_error contracts."}, + {"id":"P13","decision":"PASS","evidence":"L128-129 and L154-158 prove unwrap_or's exact two-variant behavior."}, + {"id":"P14","decision":"PASS","evidence":"L130 and L159-164 trace x into Some(x) and discharge the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L131 and L159-164 compose Option return facts to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L55-66 defines Required on the full seven-coordinate domains."}, + {"id":"P17","decision":"PASS","evidence":"L75-84 retains v,t,f,h,p,d,i in B, N, U, and Covered_SND."}, + {"id":"P18","decision":"PASS","evidence":"L90-94 and L126-131 prove applicable soundness derivations throughout N union U."}, + {"id":"P19","decision":"PASS","evidence":"L103-115 maps every Required case to N or U and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L17-20 and L103-115 provide the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L75-84 retains every coordinate in Covered_POST."}, + {"id":"P22","decision":"PASS","evidence":"L129, L131, and L133-135 prove Q throughout Covered_POST."}, + {"id":"P23","decision":"PASS","evidence":"L103-115 independently proves Required subseteq Covered_POST."}, + {"id":"P24","decision":"PASS","evidence":"L19-20 and L103-115 conclude POST over the full domain with the same TCB."}, + {"id":"P25","decision":"PASS","evidence":"L183-189 gives exact bundled releases, mappings, profile region, consumers, exclusions, and triggers."}, + {"id":"P26","decision":"PASS","evidence":"L17-20 and L95-101 conspicuously qualify all mapping-dependent conclusions."}, + {"id":"P27","decision":"PASS","evidence":"L150-181 supplies exact-version links and quotations for every material Option/cfg/compile_error premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L137-146 explicitly marks the replacement review-only and does not use it for implementation proof."}, + "tcb_authority_defect": {"present":false,"evidence":"L183-189 keeps BUILD-MAP-POLICY within exact identity and consumers, separate from Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 identifies only the supplied artifact and source-level claim."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L20-27 reproduces the exact bounded Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"L29-34 reproduces the exact bounded Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"L40 checks the Scarlet-only 1.84 X unhardened configuration against both formulas."}, + {"id":"P4","decision":"PASS","evidence":"L40 checks the Indigo-only 1.84 X hardened configuration against both formulas."}, + {"id":"P5","decision":"PASS","evidence":"L12 and L53 explicitly leave unique crate promise identity UNPROVED and separate Required_A."}, + {"id":"P6","decision":"PASS","evidence":"L16-18 and L36-38 define S(c) over the full seven-coordinate product."}, + {"id":"P7","decision":"PASS","evidence":"L16-18 and L36-38 define I(c) over the full seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"L42-51 separately proves S subseteq A by disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L42-51 separately proves I subseteq A by disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L45-51 and L69-70 show Scarlet contains no f=true,t=W case."}, + {"id":"P11","decision":"PASS","evidence":"L45-51 and L69-70 show Indigo contains no f=true,t=W case."}, + {"id":"P12","decision":"PASS","evidence":"L57-63 and L69-70 apply exact mapping, all/cfg, and compile_error contracts uniformly over the fiber."}, + {"id":"P13","decision":"PASS","evidence":"L61 and L72-75 apply unwrap_or's exact contract to both valid Option variants."}, + {"id":"P14","decision":"PASS","evidence":"L75 traces x into locally constructed Some(x) and discharges the None safety obligation."}, + {"id":"P15","decision":"PASS","evidence":"L75 uses unwrap_unchecked's contained-value return to establish q(i)."}, + {"id":"P16","decision":"PASS","evidence":"L16-18, L42, and L53 state Required_A=A on complete tuples."}, + {"id":"P17","decision":"PASS","evidence":"L87-99 defines Covered_sound with A(c), f/t, and the selected execution on i."}, + {"id":"P18","decision":"PASS","evidence":"L67 and L74-75 prove every non-turbo and turbo execution admitted to Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L101-102 exhausts f, carries the full tuple, and proves Required_A subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L9 and L101-102 give a complete TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L87-99 defines Covered_post with the complete A(c) tuple and input-sensitive result."}, + {"id":"P22","decision":"PASS","evidence":"L74-75 proves q(i) on every execution admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L101-102 independently establishes Required_A subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L10 and L101-102 conclude the whole-domain postcondition under the same TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L63 confines BUILD-MAP-POLICY to exact bundled releases, supplied artifact, mappings, profiles, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"L9-12 and L63 explicitly qualify every whole-case verdict and the rejection proof."}, + {"id":"P27","decision":"PASS","evidence":"L57-61 provides exact-version URLs and quotations for all conditional-compilation and Option premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L77-83 offers a comment replacement only after independently proving the current implementation."}, + "tcb_authority_defect": {"present":false,"evidence":"L57-63 separates exact-version Rust authority from the narrowly admitted build mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5 confines the audit to exact supplied target materials and disclaims outside execution evidence."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id":"P1","decision":"FAIL","evidence":"L49-56 labels S0 the exact Scarlet configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DS."}, + {"id":"P2","decision":"FAIL","evidence":"L61-68 labels I0 the exact Indigo configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DI."}, + {"id":"P3","decision":"PASS","evidence":"L73-76 gives a complete full case and correctly proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L76-79 gives a complete full case and correctly proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L20-23 and L89-91 leave the project promise UNPROVED and call A only an audit union."}, + {"id":"P6","decision":"PASS","evidence":"L42-59 conjoins Base's seven coordinates with S0, yielding the exact Scarlet full-case domain despite P1."}, + {"id":"P7","decision":"PASS","evidence":"L42-71 conjoins Base's seven coordinates with I0, yielding the exact Indigo full-case domain despite P2."}, + {"id":"P8","decision":"PASS","evidence":"L81-89 separately proves DS subseteq A by the left disjunct."}, + {"id":"P9","decision":"PASS","evidence":"L81-89 separately proves DI subseteq A by the right disjunct."}, + {"id":"P10","decision":"PASS","evidence":"L95-97 shows every Base case with f=true,t=W is outside DS."}, + {"id":"P11","decision":"PASS","evidence":"L95-97 shows every Base case with f=true,t=W is outside DI."}, + {"id":"P12","decision":"FAIL","evidence":"L99-112 claims universal rejection but quotes/cites only cfg-attribute and compile_error semantics; no exact-version all predicate authority supplies the two-leaves-to-true step."}, + {"id":"P13","decision":"PASS","evidence":"L124-143 supplies exact-version unwrap_or authority and proves both input cases on the non-turbo body."}, + {"id":"P14","decision":"PASS","evidence":"L124-149 traces x into the exact Some(x) receiver and uses the cited None/UB prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L144-149 composes both Option return contracts and establishes Q for every valid input."}, + {"id":"P16","decision":"PASS","evidence":"L42-46 and L81-85 state Required=A over v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"L158-166 retains every Base coordinate in Executable and Covered_sound."}, + {"id":"P18","decision":"FAIL","evidence":"L139-143 relies on an uncited complementary not cfg rule to select the non-turbo body, so the !f region admitted to Covered_sound lacks a complete authority-closed derivation."}, + {"id":"P19","decision":"FAIL","evidence":"L168-175 states the set inclusion, but its mapping of Required !f cases to a proved source branch inherits the missing exact-version not authority."}, + {"id":"P20","decision":"FAIL","evidence":"L11-14 claims whole-domain soundness PROVED, but L168-175 does not provide a valid authority-closed Required-to-Covered certificate."}, + {"id":"P21","decision":"PASS","evidence":"L158-166 retains every Base coordinate in Covered_post."}, + {"id":"P22","decision":"FAIL","evidence":"L139-143 leaves the non-turbo selection dependent on an uncited not cfg semantic premise, so Covered_post overclaims that region."}, + {"id":"P23","decision":"FAIL","evidence":"L168-175 states behavioral containment, but the !f mapping is not to a completely authority-closed branch proof."}, + {"id":"P24","decision":"FAIL","evidence":"L15-16 claims whole-domain behavior without conspicuous TCB relativity, and L168-175 also inherits the invalid behavioral coverage certificate."}, + {"id":"P25","decision":"PASS","evidence":"L180-185 restricts BUILD-MAP-POLICY to exact bundled Cargo identities, supplied artifact, mappings, and listed consumers."}, + {"id":"P26","decision":"FAIL","evidence":"L15-16 states the behavior verdict only on the same domain, not under the BUILD-MAP-POLICY qualification carried by soundness; later closure is likewise unqualified."}, + {"id":"P27","decision":"FAIL","evidence":"L99-112 and L139-140 use material all and not cfg semantics in positive proofs without exact-version quotations or applicable predicate-section URLs."} + ], + "hard_errors": [ + {"id":"PH4","evidence":"L11-16 and L173-175 claim whole-domain soundness/behavior although the Covered derivations rely on the unverified not cfg premise at L139-140."}, + {"id":"PH5","evidence":"L17-19 and L99-112 affirm universal turbo/wasm rejection without an applicable exact-version all implication."}, + {"id":"G11","evidence":"The positive rejection and non-turbo selection proofs at L99-112 and L139-140 necessarily rely on unchecked all/not Rust authority."} + ], + "proposal_laundering": {"present":false,"evidence":"L195-204 labels the comment replacement proof-artifact documentation and does not use it to certify current code."}, + "tcb_authority_defect": {"present":true,"evidence":"L99-112 and L139-140 omit exact-version all/not authority, and L15-16 omits conspicuous TCB qualification from behavior."}, + "visible_scope_defect": {"present":false,"evidence":"L5-9 confines inspection to supplied target files and explicitly says nothing was built, run, or tested."}, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/A.md new file mode 100644 index 0000000000..1fb5ea7ca5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/A.md @@ -0,0 +1,197 @@ +# Focused unsafe Rust source audit + +## Claim, snapshot, and verdicts + +This review covers the supplied `Cargo.toml`, `POLICY-SCARLET.md`, +`POLICY-INDIGO.md`, `TCB.md`, and `src/lib.rs` source snapshot, under Rust +1.84.0, 1.85.0, and 1.86.0. It is source-level only: no compiler/backend, +binary, tests, generated artifacts, dependencies, or prior audit are claimed. +Review date/audit cutoff: 2026-08-01. The support documents are static for this +snapshot, so the cutoff does not resolve their conflict. + +| Claim | Verdict | Qualification | +|---|---|---| +| Every well-typed safe call of `value_or_zero` in `Required` is free of Rust UB | **PROVED** | Relative to `TCB-BUILD-MAP` only for mapping policy configurations to source branches; branch correctness uses the version-specific Rust axioms below. | +| The call returns the contained byte, or zero for `None`, throughout `Required` | **PROVED** | Same qualification. | +| Every `turbo`/`wasm32` configuration is rejected before a library artifact is produced | **PROVED** | Conspicuously conditional on `TCB-BUILD-MAP`; this is a compilation claim, not a runtime-input claim. | +| One uniquely determined exact project support predicate can be recovered | **UNPROVED** | Scarlet and Indigo are incomparable current exact commitments, and no resolution rule is authorized. | + +The combined mandatory soundness-and-requested-behavior result is **PROVED over +the conservative audit domain `Required` defined below, relative to +`TCB-BUILD-MAP`**. `Required` is not asserted to be the crate's exact support +promise. + +## Exact predicates and full-case domains + +Let + +* `V = {1.84.0, 1.85.0, 1.86.0}`; +* `X = x86_64-unknown-linux-gnu`, `A = aarch64-unknown-linux-gnu`, and + `W = wasm32-unknown-unknown`; +* `B = {false,true}`; `f` means `turbo`, and `h` means `hardened`; +* `P` be the symbolic set of **all Cargo profiles** (no finite enumeration is + substituted); and +* `O = {None} union {Some(n) | n is any u8}`, exactly every valid `Option`. + +For the full case `c=(v,t,f,h,p,d,o)`, with `d` the state of debug assertions, +the separately reproduced configuration predicates are + +```text +S(v,t,f,h) := v in V and t in {X,A,W} and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) + +I(v,t,f,h) := v in V and t in {X,A,W} and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +Their induced full-case domains, preserving every dimension, are + +```text +D_S(c) := S(v,t,f,h) and p in P and d in B and o in O +D_I(c) := I(v,t,f,h) and p in P and d in B and o in O. +``` + +Neither contains the other. `(1.84.0,X,true,false)` satisfies Scarlet's +`t=X and !h` term but not Indigo's `h or v>=1.86.0`, so `S` is not a subset of +`I`. Conversely, `(1.84.0,X,true,true)` satisfies Indigo's `t=X and h` term but +not Scarlet's `!h or v>=1.85.0`, so `I` is not a subset of `S`. Extending either +witness with any `p in P`, `d in B`, and `o in O` separates the full-case +domains. Thus they are unequal and incomparable. + +Select the least union as the conservative audit configuration predicate: + +```text +U(v,t,f,h) := S(v,t,f,h) or I(v,t,f,h) + = v in V and t in {X,A,W} and + (!f or (f and + (t = X or (t = A and (h or v >= 1.85.0))))) + +Required(c) := U(v,t,f,h) and p in P and d in B and o in O. +``` + +The equality follows by cases. For `!f`, both policies admit every listed +`v,t,h`. For `f,t=X`, Scarlet admits every `h=false` case and Indigo every +`h=true` case, hence all `v,h`. For `f,t=A`, Scarlet admits all `h=true` cases, +while Indigo admits precisely `h=false,v>=1.85.0`, yielding +`h or v>=1.85.0`. Neither admits `f,t=W`. Separately, `D_S subseteq Required` +because `S implies S or I`, and `D_I subseteq Required` because +`I implies S or I`; the other full-case conjuncts are identical. This proves +both required containments without resolving which policy is authoritative. + +## Authority and TCB audit log + +For each of 1.84.0, 1.85.0, and 1.86.0, the applicable Reference pages are: +[conditional predicates 1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), +and [`cfg` attribute 1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +They state, respectively, “It is true if all of the given predicates are true” +and “It is true if its predicate is false”; for item selection: “If the +predicate is true, the thing is rewritten to not have the cfg attribute ... If +the predicate is false, the thing is removed”. These are `AX-CFG-{84,85,86}`. + +The exact-version `compile_error!` pages +([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)) say: +“Causes compilation to fail with the given error message when encountered.” +These are `AX-COMPILE-ERROR-{84,85,86}`. + +The exact-version `Option` pages are +[`unwrap_or` 1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), +and [`unwrap_unchecked` 1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +Each says `unwrap_or` “Returns the contained `Some` value or a provided +default”; `unwrap_unchecked` “Returns the contained `Some` value”, while +“Calling this method on `None` is undefined behavior.” These are +`AX-OPTION-{84,85,86}` and supply separate exhaustive version coverage—no +cross-version compatibility assumption is used. + +`TCB-BUILD-MAP` is the sole non-axiom entry: the accepted `BUILD-MAP-POLICY` in +`TCB.md`, with the exact three toolchain-bundled Cargo releases, manifest, named +features, targets, and all supported profiles. It admits only that enabled and +disabled features set and do not set their matching feature predicates, and +that `X/A/W` set `target_arch` to `x86_64/aarch64/wasm32`. It is consumed only +to map policy cases to source reachability and to prove effective rejection. +It supplies no Rust semantics, branch correctness, compatibility, or binary +correctness. Its disposition is accepted by the authorized human reviewer. +No other TCB premise is consumed. + +## API, rejection, and obligation proofs + +The complete exposed surface is one safe free function, `value_or_zero`, with +two mutually exclusive `cfg` definitions. There are no public fields, +constructors, traits/impls, macros generating APIs, hidden items, callbacks, +FFI, allocation, concurrency, or invariant-bearing state. The only unsafe +operation is `Option::unwrap_unchecked` at `src/lib.rs:18`. No generated code or +tool-derived evidence exists. + +Define `Q(None)=0` and `Q(Some(n))=n`, and define the actually proved source +case predicate without dropping any axes: + +```text +K(c) := v in V and t in {X,A,W} and f in B and h in B + and p in P and d in B and o in O +Covered_sound(c) := K(c) and (!f or t != W) +Covered_behavior(c) := K(c) and (!f or t != W). +``` + +* **Non-turbo branch (`!f`).** `TCB-BUILD-MAP` plus `AX-CFG-v` selects only + lines 7-10. `o.unwrap_or(0)` returns the contained `n` for `Some(n)` and the + provided `0` for `None`, so it returns `Q(o)`. There is no unsafe operation. +* **Turbo, non-wasm branch (`f and t!=W`).** The same reachability premises + select lines 13-19 and do not encounter the compile error. The first + `unwrap_or(0)` establishes local fact `r=Q(o)`. The unsafe receiver is then + constructed syntactically as `Some(r)`. Its exact safety obligation is “the + receiver is not `None`”; construction proves it. `AX-OPTION-v` then gives + both absence of the documented UB and return value `r=Q(o)`. This proof is + parametric in `h,p,d,o` and partitioned exhaustively by each exact `v` axiom. +* **Every turbo/wasm case.** Both policies exclude it: when `f` is true, their + only target terms require `X` or `A`. Independently, for every `v in V`, + `h,p,d`, and would-be `o`, `TCB-BUILD-MAP` makes both operands of the + crate-level `all(feature="turbo",target_arch="wasm32")` true; + `AX-CFG-v` retains the macro and `AX-COMPILE-ERROR-v` makes compilation fail. + Thus no call/input execution exists. This enforcement conclusion must not be + detached from its accepted TCB premise. + +`U` implies `!f or t=X or t=A`, hence `U implies (!f or t!=W)`. All remaining +conjuncts of `Required`, `Covered_sound`, and `Covered_behavior` are identical. +Therefore, separately, +`Required subseteq Covered_sound` and +`Required subseteq Covered_behavior`. The aggregate coverage predicate is their +intersection, which is the same predicate, so `Required` is contained in it. +This is the whole-domain certificate for both **PROVED** verdicts. + +## Findings, residual scope, and maintenance + +`F-POLICY`: the support-promise identity remains **UNPROVED**. The smallest +missing premise is an authorized rule selecting, merging, or otherwise +reconciling Scarlet and Indigo. The conservative union prevents that policy +defect from leaving either candidate domain unaudited, but does not repair it. + +The implementation obligation at line 18 is proved. Its adjacent safety +comment records the decisive local `Some` construction, but omits the callee's +exact “not `None`” obligation. A proof-grade replacement is: + +```rust +// SAFETY: `unwrap_unchecked` requires this receiver not to be `None`. +// It is constructed immediately here as `Some(value)`, so that holds. +``` + +This is proof-documentation debt, not an implementation defect. No UB witness +or UB-free postcondition counterexample exists in the audited domain. + +Residual scope excludes unsupported configurations and all binary/backend +correctness. Re-audit is required for any source/manifest/policy change, +resolution of the policy conflict, Rust or cited-documentation version change, +feature/target/profile scope change, or any change to `TCB-BUILD-MAP` identity, +mapping, disposition, or consumers. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/B.md new file mode 100644 index 0000000000..0a338f08b0 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/B.md @@ -0,0 +1,106 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-only audit of the exact supplied `Cargo.toml`, `src/lib.rs`, two policy documents, and `TCB.md`, cut off 2026-08-01. No generated code, dependencies, tests, execution, macro expansion, backend, or binary claim is in scope. The public surface is the safe free function `value_or_zero(Option) -> u8`, with mutually conditional definitions. The only unsafe operation is `Option::unwrap_unchecked` in the `turbo` definition. There are no public fields, constructors, traits, callbacks, FFI items, invariant-bearing representations, or other exported items. + +Verdicts: + +- **PROVED, relative to accepted `BUILD-MAP-POLICY` and the version-specific Rust axioms below:** every well-typed call in the conservative full-case audit domain is free of Rust undefined behavior. +- **PROVED under the same qualification:** every such call returns the contained byte, or zero for `None`. +- **PROVED under the same qualification:** every `turbo`/`wasm32` compilation in the stated version/feature/profile/debug domain is rejected before a library artifact is produced. +- **UNPROVED (policy identity only):** which one set, if any, is the crate's exact support promise. Scarlet and Indigo are incomparable current commitments and no resolution rule is authorized. The conservative audit domain below is not a resolution or a new support promise. + +## Exact domains and relationships + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the triples defined by the policies, `B={false,true}`, `P` be all Cargo profiles, and +`O={None} union {Some(n) | n is a valid u8}`. A full case is +`c=(v,t,f,h,p,d,i) in V x T x B x B x P x B x O`. + +The exact configuration predicates are: + +```text +S_cfg(v,t,f,h) := v in V and t in T and ( + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h) +) + +I_cfg(v,t,f,h) := v in V and t in T and ( + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0) +) +``` + +Their induced full-case domains are +`S(c):=S_cfg(v,t,f,h) and p in P and d in B and i in O` and identically +`I(c):=I_cfg(v,t,f,h) and p in P and d in B and i in O`. + +Neither contains the other. The configuration `(1.84.0,X,true,false)` is in Scarlet: its `X and !h` term is true; it is not in Indigo because both `h` and `v>=1.86.0` are false. Conversely `(1.84.0,X,true,true)` is in Indigo by `X and h`, but not Scarlet because both `!h` and `v>=1.85.0` are false. Each satisfies the common `V,T` bounds; choosing any `p,d,i` lifts each witness to the corresponding full-case difference. + +Select the conservative audit domain `A(c):=S(c) or I(c)`. Equivalently its configuration part is + +```text +A_cfg := v in V and t in T and ( + !f or (f and t = X) or + (f and t = A and (h or v >= 1.85.0)) +). +``` + +Proof of equality: `S_cfg or I_cfg` has no `f,W` disjunct; for `f,X`, `h` selects Indigo and `!h` selects Scarlet, so every `v,h` is included; for `f,A`, Scarlet contributes `h` and Indigo contributes `!h and v>=1.85.0`. Conversely, each displayed normalized case selects the named policy term: `!f` selects both; `f,X,h` selects Indigo; `f,X,!h` selects Scarlet; `f,A,h` selects Scarlet; and `f,A,!h,v>=1.85.0` selects Indigo. Thus both directions hold. Separately, `S subseteq A` and `I subseteq A` follow by disjunction introduction, with every `p,d,i` unchanged. + +Accordingly `Required_S(c)=S(c)` and `Required_I(c)=I(c)`. There is no authorized unique crate-level `Required`. For the conservative audit theorem only, `Required_A(c)=A(c)`. + +## Authorities and TCB + +For each of Rust 1.84.0, 1.85.0, and 1.86.0, the exact-version Conditional Compilation pages state: “The predicate is true if the option is set and false if it is unset”; for `all`, “It is true if all of the given predicates are true, or if the list is empty”; and for `not`, “It is true if its predicate is false and false if its predicate is true.” The `cfg`-attribute section states: “The `cfg` attribute conditionally includes the thing it is attached to based on a configuration predicate” and “If the predicate is false, the thing is removed from the source code.” ([1.84 predicate](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.84 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute); [1.85 predicate](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), [1.85 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute); [1.86 predicate](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), [1.86 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute).) + +At each exact version, `compile_error!` “causes compilation to fail with the given error message when encountered.” ([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html).) + +At each exact version, `unwrap_or` “Returns the contained `Some` value or a provided default.” ([1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or).) `unwrap_unchecked` “Returns the contained `Some` value ... without checking that the value is not `None`,” and its Safety clause says: “Calling this method on `None` is undefined behavior.” ([1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked).) Direct per-release citations avoid any compatibility premise. + +`BUILD-MAP-POLICY` is the sole admitted non-axiom premise. The authorized reviewer accepts, only for the three bundled Cargo releases, supplied manifest/source, all supported profiles, named feature cfgs, and three target-to-`target_arch` mappings, exactly the mapping recorded in `TCB.md`. It is consumed only for source selection and rejection. It supplies no Rust semantics or branch correctness. Every whole-case verdict above depends on it; local reasoning about an already-selected definition does not. No tool-derived evidence or other premise is used. + +## Selection, rejection, and local proofs + +Under the TCB mapping and cited cfg rules, `f=false` selects exactly the `not(feature="turbo")` definition; `f=true` selects exactly the other definition. Neither `h`, `p`, `d`, `v`, nor a non-wasm target changes either value computation. + +For every hypothetical full `turbo`/`wasm32` case +`E(c):=v in V and t=W and f and h in B and p in P and d in B and i in O`, both policies exclude it: `!f`, `t=X`, and `t=A` are all false in each predicate. Independently, the TCB makes both leaves of `all(feature="turbo",target_arch="wasm32")` true; the cited `all` and cfg rules therefore include `compile_error!`, whose cited contract fails compilation. This proof is uniform over `v,h,p,d`; rejection precedes and is independent of runtime `i`. Thus `E` contains no shippable library case and is not silently counted as covered API execution. + +Define `q(None)=0` and `q(Some(n))=n`. + +- Non-turbo: `value.unwrap_or(0)` returns the contained `n` for `Some(n)` and the supplied default `0` for `None`. It is the documented safe operation, so every `i in O` is UB-free and the result is `q(i)`. +- Turbo: the first `unwrap_or(0)` produces `x=q(i)`. The unsafe receiver is then constructed locally as `Some(x)`, hence is not `None`. This proves the entire cited safety obligation for `unwrap_unchecked`; its return contract yields the contained `x=q(i)`. Thus every `i in O` is UB-free and satisfies the postcondition. + +The existing safety comment records the decisive local fact (`Some` construction), so the implementation obligation is proved, but the proof artifact is deficient: it does not state the callee's `None`/UB obligation or the consumed return guarantee. Proposed replacement: + +```rust +// SAFETY: `unwrap_unchecked` is UB only when its receiver is `None`. +// This receiver is constructed immediately as `Some(value)`, so it is not +// `None`; the call returns that contained `value`. +``` + +## Full-case coverage certificate + +Without projecting any dimension away, define + +```text +Covered_sound(c) := A(c) and ( + (!f and the selected non-turbo execution on i is UB-free) or + (f and t in {X,A} and the selected turbo execution on i is UB-free) +) + +Covered_post(c) := A(c) and ( + (!f and the selected non-turbo result on i equals q(i)) or + (f and t in {X,A} and the selected turbo result on i equals q(i)) +). +``` + +Take arbitrary `c` with `Required_A(c)`. If `!f`, selection plus the non-turbo lemma puts the same complete `(v,t,f,h,p,d,i)` in both Covered predicates. If `f`, normalized `A_cfg` implies `t=X` or `t=A`; selection plus the turbo lemma does likewise. These cases exhaust `B`. The lemmas quantify every `v,t,h,p,d,i`; irrelevance of `v,h,p,d` follows from their absence from the selected computations, not from projection. Hence +`Required_A subseteq Covered_sound intersect Covered_post`. Conversely both Covered predicates include `A(c)` by definition, so each equals `A`; aggregate closure is exact. Since `S subseteq A` and `I subseteq A`, the same proofs close each published policy domain separately. + +## Residual scope and review triggers + +Only the identity of the single governing support promise is unresolved; authorized policy resolution is required. Re-audit on any change to the supplied source, manifest, either policy, feature/target/profile scope, any of the three Rust/Cargo identities or cited contracts, `BUILD-MAP-POLICY` disposition/mapping, or the documented postcondition. No code change was made. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/C.md new file mode 100644 index 0000000000..09ad3b77c3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/C.md @@ -0,0 +1,117 @@ +# Focused unsafe-Rust source audit + +## Claim and results + +This audit covers the complete supplied `focused-predicate-target` source snapshot: `Cargo.toml`, `src/lib.rs`, both published policies, and `TCB.md`. It is a source-level claim under the documented Rust abstract semantics, not a compiler-backend or binary claim. Audit cutoff: 2026-08-01. TCB log identity is the supplied `TCB.md` snapshot; no revision identifier is stated. Skill identity is the supplied `unsafe-rust` package; no revision identifier is stated. No generated code, dependencies, FFI, macros, stateful invariants, tests, builds, or prior audit results are in scope or used. + +| Claim | Required domain | Result | Qualification | +|---|---|---|---| +| Every well-typed safe call of `value_or_zero` is free of Rust UB | conservative domain `R` below | **PROVED** | Relative to accepted `BUILD-MAP-POLICY` and the exact-version Rust axioms quoted below | +| The return is the contained byte, or zero for `None` | `R` | **PROVED** | Same qualification | +| Either published policy is *the* exact crate support promise | identity of Scarlet versus Indigo | **UNPROVED** | The documents are incomparable and no resolution rule is authorized | + +The combined mandatory soundness-and-behavior result is **PROVED over `R`**, relative to that TCB. This does not resolve or redefine the project's exact support promise. + +## Exact domains and policy relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the triples' meanings exactly as in the policies, `B={false,true}`, `P` be all Cargo profiles, `D=B` be both debug-assertion states, and + +`O={None} union {Some(n) | n is a u8}`. + +A full case is `c=(v,t,f,h,p,d,i)` in `K=V x T x B x B x P x D x O`. Comparisons of versions below are only over the finite set `V`. + +The exact Scarlet configuration predicate is + +`S(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (!h or v>=1.85.0)) or (f and t=A and h)]`. + +The exact Indigo configuration predicate is + +`I(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (h or v>=1.86.0)) or (f and t=A and !h and v>=1.85.0)]`. + +Their induced full-case domains are + +`D_S(c) := c in K and S(v,t,f,h)` and `D_I(c) := c in K and I(v,t,f,h)`. + +They are unequal and incomparable: + +* `(1.84.0,X,true,false)` is in Scarlet because its `X` clause has `!h`; it is not in Indigo because `h` and `v>=1.86.0` are both false. +* `(1.84.0,X,true,true)` is in Indigo because its `X` clause has `h`; it is not in Scarlet because `!h` and `v>=1.85.0` are both false. + +Thus neither `D_S subseteq D_I` nor `D_I subseteq D_S`; adding any `p in P`, `d in D`, and `i in O` lifts each witness to a full-case witness. + +Select the conservative audit domain + +`R(c) := D_S(c) or D_I(c)`. + +For every `c`, `D_S(c)` implies `R(c)` by the left disjunct, and `D_I(c)` implies `R(c)` by the right disjunct. Hence `D_S subseteq R` and `D_I subseteq R` separately. `R` is the union of the candidate commitments, used only as an audit requirement; it is not asserted to be the exact project promise. + +## Exact-version semantic premises + +For each of Rust 1.84.0, 1.85.0, and 1.86.0, the Reference states: “The `cfg` attribute conditionally includes the thing it is attached to based on a configuration predicate.” It further states: “If the predicate is true, the thing is rewritten to not have the `cfg` attribute on it. If the predicate is false, the thing is removed from the source.” It defines `all()` as true when all its predicates are true, and `not()` as true when its predicate is false. ([1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute); predicate definitions: [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation)). + +Each exact-version standard-library page says: “The `compile_error!` macro causes compilation to fail with the given error message when encountered.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). + +For `Option::unwrap_or`, each exact-version page says: “Returns the contained `Some` value or a provided default.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or)). For `Option::unwrap_unchecked`, each says: “Returns the contained `Some` value, consuming the `self` value, without checking that the value is not `None`,” and its Safety section says: “Calling this method on `None` is undefined behavior.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked)). These are three release-specific premise sets; no cross-release compatibility premise is used. + +## Selection and effective rejection + +`BUILD-MAP-POLICY` is consumed only here. For every `v in V` and `p in P`, it maps enabled `turbo`/`hardened` to their like-named feature cfgs and maps `X,A,W` to `x86_64,aarch64,wasm32`. With the quoted cfg rules, complete source inspection gives this exhaustive partition: + +* `!f`: the non-turbo function is included, the turbo function removed, and the compile error removed. +* `f and t in {X,A}`: the turbo function is included, the non-turbo function removed, and the compile error removed. +* `f and t=W`: both predicates in `all(feature="turbo",target_arch="wasm32")` are true, so `compile_error!` is included and compilation fails before a library API can execute. + +The source predicates mention neither `h`, profile, debug assertions, nor input; the partition is therefore parametric over those dimensions. Input exists only for an emitted API call. + +Policy-level exclusion is independent: for `f=true,t=W`, `!f` is false and every `X` or `A` conjunct is false in both `S` and `I`. Thus every such full case is absent from both policy domains. Source-level rejection additionally covers every such build in `K`, for either `h`, every profile and debug state, and any hypothetical input, relative to `BUILD-MAP-POLICY`. + +## API inventory and obligation ledger + +The sole language-reachable crate API is one configuration-selected safe free function `pub fn value_or_zero(Option)->u8`. There are no public fields, constructors, traits or impls, hidden items, callbacks, exported macros, unsafe APIs, or persistent invariant-bearing state. The only unsafe operation is `Some(value).unwrap_unchecked()` on the turbo branch. + +Define `spec(None)=0` and `spec(Some(x))=x`. + +| ID | Domain and obligation | Proof | Status | +|---|---|---|---| +| O-NT | Every `c in K` with `!f`: no UB and result `spec(i)` | `i.unwrap_or(0)` is a safe call and, by its quoted contract, returns `x` for `Some(x)` and the supplied `0` for `None` | **PROVED** | +| O-T-UNSAFE | Every `c in K` with `f,t in {X,A}`: receiver of `unwrap_unchecked` is not `None` | First `unwrap_or(0)` yields a `u8` named `value`; the receiver is then constructed at the call site as the `Some(value)` variant. It is therefore not `None`, satisfying the complete quoted safety obligation | **PROVED** | +| O-T-POST | Same cases: result `spec(i)` | The quoted contract returns the contained value, hence the unsafe call returns `value`; the first call made `value=spec(i)` | **PROVED** | +| O-REJECT | Every `c in K` with `f,t=W`: no shippable API case | Selection/rejection proof above | **PROVED**, relative to `BUILD-MAP-POLICY` | + +The local `SAFETY` comment records the decisive source fact but omits the callee obligation and returned-value consequence. The implementation proof is complete; the proof artifact is deficient under proof-grade documentation. Proposed replacement: + +```rust +// SAFETY: `unwrap_unchecked` requires the receiver not to be `None`. +// This receiver is constructed here as `Some(value)`, so that requirement +// holds; the operation returns the contained `value`. +``` + +This is a documentation finding, not an implementation defect or a caller-facing hidden precondition. + +## Full-case coverage and closure + +For this audit, `Required(c) := R(c)`. The soundness derivation covers + +`Covered_sound(c) := c in K and [!f or (f and t in {X,A})]`, + +and the behavioral derivation covers the identical full-case predicate + +`Covered_post(c) := c in K and [!f or (f and t in {X,A})]`. + +These predicates retain `v,t,f,h,p,d,i` through membership in `K`; O-NT and O-T quantify parametrically over every omitted fiber value, including every valid `Option`. + +For any `c in Required`, either its Scarlet or Indigo predicate holds. If `!f`, it is in both covered predicates by O-NT. If `f`, inspection of every positive disjunct of either exact policy shows `t=X` or `t=A`, so it is in both covered predicates by O-T-UNSAFE and O-T-POST. Therefore + +`Required subseteq Covered_sound intersection Covered_post`. + +This is the required whole-domain certificate for both **PROVED** verdicts. No sampled enumeration substitutes for it; version applicability is an exhaustive three-member partition backed by the three exact-version documentation sets. + +## TCB audit log, residual scope, and triggers + +* **BUILD-MAP-POLICY (IMPLEMENTATION/build tool): accepted.** Exact identity, proposition, scope, consumers, exclusions, and re-audit trigger are those in supplied `TCB.md`. Consumers here are only branch reachability and effective rejection. It supplies no Rust semantics or branch correctness. +* **AXIOM-CFG-{1.84,1.85,1.86}, AXIOM-COMPILE-{1.84,1.85,1.86}, AXIOM-OPTION-{1.84,1.85,1.86}: authoritative Rust premises.** Exact propositions, identities, quotations, version scopes, links, and consumers appear above. +* No other build-tool, compiler-implementation, dependency, environment, tool-derived, probabilistic, or compatibility premise is consumed. No test or tool evidence is claimed. + +Residual scope is compiler/backend/binary correctness and unsupported configurations. The exact project support-promise identity remains unresolved; an authorized precedence, supersession, intersection, union, or other rule is required to resolve it. Re-audit on any supplied source, manifest, policy, accepted TCB disposition/mapping, supported version/target/feature/profile/debug domain, or consumed authoritative contract change. + +All in-scope surfaces, configuration paths, unsafe obligations, mandatory postconditions, policy relationships, and full-case dimensions have a disposition above. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/D.md new file mode 100644 index 0000000000..abfd83fba2 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/D.md @@ -0,0 +1,196 @@ +# Focused unsafe-Rust source audit + +## Claim, snapshot, and verdicts + +The audited artifact is exactly the supplied `Cargo.toml`, `src/lib.rs`, two +published policies, and `TCB.md`: package `focused-predicate-target` 0.1.0, +edition 2021, with no dependencies or generated artifacts. The toolchain domain +is the three exact Rust/standard-library releases below. This is a source-level +claim under documented Rust abstract semantics, not a claim about compiler +backends or binaries. + +For a full case `c = (v,t,f,h,p,d,i)`, the claims are: (SND) every well-typed +safe call of the selected `value_or_zero` implementation is free of Rust UB; +and (POST) if it returns `r`, then +`Q(i,r) := (i=None => r=0) and (i=Some(n) => r=n)`. + +- **SND: PROVED** over `Required(c)` defined below, relative to accepted + `BUILD-MAP-POLICY` and the exact-version Rust axioms recorded below. +- **POST: PROVED** over the same domain and TCB. +- **Combined mandatory result: PROVED**, with the same qualification. + +Each published policy-induced domain is therefore covered separately. This +does **not** resolve which domain is the crate's exact support promise: both +policies are current and no rule chooses or combines them. + +## Exact policy predicates and full-case domains + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, where `X`, `A`, and `W` have the +exact triples defined in the policies; let `f,h,d` be Booleans, `P` be all +Cargo profiles, and `O` be every valid `Option` (`None` and every +`Some(n)` for valid `u8` `n`). Scarlet's exact configuration predicate is + +```text +C_S(v,t,f,h) := v in V and t in {X,A,W} and ( + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h) +) +``` + +Indigo's exact configuration predicate is + +```text +C_I(v,t,f,h) := v in V and t in {X,A,W} and ( + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0) +) +``` + +They are unequal and incomparable. `(1.84.0,X,true,false)` is Scarlet but not +Indigo. `(1.84.0,X,true,true)` is Indigo but not Scarlet. Thus neither +`C_S subseteq C_I` nor `C_I subseteq C_S`. + +The policy-induced full-case domains, without dropping any dimension, are + +```text +D_S(c) := C_S(v,t,f,h) and p in P and d in {false,true} and i in O +D_I(c) := C_I(v,t,f,h) and p in P and d in {false,true} and i in O +``` + +I select the conservative audit domain + +```text +Required(c) := D_S(c) or D_I(c). +``` + +Separately, `D_S(c) => Required(c)` by left disjunction introduction, and +`D_I(c) => Required(c)` by right disjunction introduction. Hence it contains +both candidate commitments. It is their audit union, not an authorized union +of support promises. + +## Configuration and API closure + +Define the dimension-preserving base + +```text +B(c) := v in V and t in T and f,h,d in {false,true} + and p in P and i in O +N(c) := B(c) and !f +U(c) := B(c) and f and t in {X,A} +Covered_SND(c) := N(c) or U(c) +Covered_POST(c) := N(c) or U(c) +``` + +Relative to `BUILD-MAP-POLICY`, feature and target values set the correspondingly +named `cfg` options. The exact-version `cfg` axioms then give this exhaustive +source partition: + +- On `N`, `#[cfg(not(feature="turbo"))]` includes lines 8--10 and removes lines + 14--19. The `compile_error!` item is removed. +- On `U`, the non-turbo definition is removed, the turbo definition at lines + 14--19 is included, and the `compile_error!` item is removed because the + target is not `wasm32`. +- For every `f=true,t=W` combination (all `v,h,p,d`), both policies exclude the + configuration: `!f` is false and both remaining disjuncts require `X` or + `A`. Independently, and conspicuously **relative to BUILD-MAP-POLICY**, the + source `all(feature="turbo",target_arch="wasm32")` predicate is true, so + lines 3--4 are included and `compile_error!` fails compilation. Thus every + turbo/wasm case is both policy-excluded and effectively source-rejected; no + runtime input is reached. + +For closure, take arbitrary `c` with `Required(c)`. Either policy conjunct +implies `B(c)`. If `!f`, then `N(c)`. If `f`, inspection of either exact policy +shows its satisfied turbo disjunct requires `t=X` or `t=A`, hence `U(c)`. +Therefore + +```text +Required subseteq Covered_SND +Required subseteq Covered_POST. +``` + +This argument is parametric in `h,p,d,i` rather than silently projecting them +away. The code contains no profile, hardened, or debug-assertion selector, so +those axes do not change either branch proof. + +The complete language-reachable API surface is one safe free function, +`pub fn value_or_zero(Option) -> u8`, with exactly one definition in each +buildable case above. There are no public fields, constructors, user traits, +macros, reexports, hidden items, FFI, allocation, concurrency, or invariant- +bearing state. The sole unsafe operation is the turbo definition's +`Option::unwrap_unchecked` call. + +## Obligation ledger and proofs + +| ID | Domain | Obligation | Derivation | Status | +|---|---|---|---|---| +| N-SND | `N(c)` | safe implementation has no UB | `unwrap_or(0)` is a safe standard-library call with the exact behavior below; there is no unsafe operation | PROVED | +| N-POST | `N(c)` | `Q(i,r)` | `unwrap_or` returns the contained value for `Some(n)` and the supplied `0` for `None` | PROVED | +| U-SND | `U(c)` | `unwrap_unchecked` receiver is not `None` | first `x=i.unwrap_or(0)`; the receiver is then syntactically constructed as `Some(x)`, so the sole stated safety prohibition is false | PROVED | +| U-POST | `U(c)` | `Q(i,r)` | `x=n` for `Some(n)` and `x=0` for `None`; unwrapping `Some(x)` returns its contained `x` | PROVED | + +These proofs quantify over every `i in O`. The `N` and `U` lemmas union to each +`Covered` predicate; the two containment results above supply the required +whole-domain certificates. + +The implementation proof at lines 17--18 is correct, but its `SAFETY` comment +is proof-documentation deficient: it gives the decisive local fact but omits +the callee's exact obligation and resulting postcondition. Proposed replacement +(review only; the source was not changed): + +```rust +// SAFETY: `Option::unwrap_unchecked` is UB when called on `None`. This +// receiver is constructed immediately as `Some(value)`, so it is not `None`; +// the call returns that contained `value`. +``` + +## Rust axioms and TCB audit log + +All quotations below were verified with identical relevant wording in the +three exact releases; no version interpolation or compatibility assumption is +used. + +- **AX-OR** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), + [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or): + “Returns the contained `Some` value or a provided default.” This proves both + case equations for the first operation on each branch. +- **AX-UNCHECKED** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked): + “Returns the contained `Some` value ... without checking that the value is + not `None`.” “Calling this method on `None` is undefined behavior.” These + supply the exact local prohibition, return fact, and UB consequence. +- **AX-CFG-PRED** — conditional-compilation pages for + [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), + [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), and + [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation): + a configuration-option predicate is “true if the option is set”; `all` is + “true if all of the given predicates are true”; `not` is “true if its + predicate is false.” +- **AX-CFG-ATTR** — `cfg`-attribute pages for + [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), and + [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute): + it “conditionally includes the thing it is attached to”; when false, “the + thing is removed from the source code.” +- **AX-COMPILE-ERROR** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), and + [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html): + “Causes compilation to fail with the given error message when encountered.” + +**BUILD-MAP-POLICY (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exactly the +toolchain-bundled Cargo releases for 1.84.0, 1.85.0, and 1.86.0 map the two +named features and three targets to the source `cfg` options as stated in +`TCB.md`, for every supported profile. It is consumed only by branch +reachability and effective rejection, never as a Rust semantic or branch- +correctness premise. Its identity, manifest/source/cfg changes, or human +disposition trigger re-audit. No other implementation premise is consumed. + +No tests, compilation, execution, macro expansion, or tool-derived proof was +used. Residual scope is the unresolved identity of the exact published support +promise and all backend/binary behavior; neither weakens the proved source +claims over the explicitly conservative audit domain. Re-audit is required for +changes to source, policies or conflict resolution, manifest/features/targets, +the accepted TCB mapping, supported Rust versions, or any cited contract. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/E.md new file mode 100644 index 0000000000..5906b3a8ab --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/E.md @@ -0,0 +1,191 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-only review of the supplied `Cargo.toml`, `src/lib.rs`, two +published policies, and `TCB.md`, at the 2026-08-01 audit cutoff. No generated +artifact, dependency, build, execution, test, backend, or binary claim is in +scope. + +| Claim | Verdict | +|---|---| +| Which policy is the crate's exact support promise | **UNPROVED**: Scarlet and Indigo are both current, are incomparable, and no resolution rule is authorized. | +| Freedom from Rust UB for every `value_or_zero` call in `Required` below | **PROVED relative to accepted `BUILD-MAP-POLICY`** and the exact-version Rust axioms below. | +| Documented result: contained byte, or zero for `None`, throughout `Required` | **PROVED relative to accepted `BUILD-MAP-POLICY`** and those axioms. | +| Source rejection of every named `turbo`/`wasm32` configuration | **PROVED relative to accepted `BUILD-MAP-POLICY`** and the cfg/`compile_error!` axioms. | + +Thus the combined source theorem over the explicitly conservative audit domain +is **PROVED relative to `BUILD-MAP-POLICY`**. This does **not** resolve or rename +that domain as the crate's published support promise. + +## Exact policies and full-case domains + +Let `V = {1.84.0, 1.85.0, 1.86.0}`, `X = +x86_64-unknown-linux-gnu`, `A = aarch64-unknown-linux-gnu`, and `W = +wasm32-unknown-unknown`. Let Boolean `f` and `h` mean `turbo` and `hardened`. +The exact Scarlet configuration predicate is + +```text +v in V and t in {X,A,W} and +(!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) +``` + +The exact Indigo configuration predicate is + +```text +v in V and t in {X,A,W} and +(!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +Write these predicates as `S(v,t,f,h)` and `I(v,t,f,h)`. They are neither +equal nor contained in one another: + +* `(1.84.0,A,true,true)` satisfies Scarlet but not Indigo. +* `(1.84.0,X,true,true)` satisfies Indigo but not Scarlet. + +Either witness becomes a separating full case, for example, by adding +`profile=dev`, `debug_assertions=false`, and `input=None`. + +Let `P` be the symbolic set of every Cargo profile, `B={false,true}`, and +`O={None} union {Some(x) | x is any valid u8}`. For +`c=(v,t,f,h,p,d,i)`, the two policy-induced full domains are exactly + +```text +D_S(c) := S(v,t,f,h) and p in P and d in B and i in O +D_I(c) := I(v,t,f,h) and p in P and d in B and i in O. +``` + +No input, profile, or debug-assertion dimension has been projected away. + +## Conservative domain and exclusions + +Define + +```text +F(c) := v in V and t in {X,A,W} and f,h in B + and p in P and d in B and i in O +Required(c) := F(c) and not(f and t = W). +``` + +This is the selected conservative audit domain. Separately for Scarlet: if +`D_S(c)` and `f` is false, `not(f and t=W)` follows immediately; if `f` is +true, Scarlet's only true turbo disjunct has `t=X` or `t=A`. Hence +`D_S subset Required`. The identical split for Indigo uses its turbo +disjuncts, also restricted to `X` or `A`, so `D_I subset Required`. The other +three full-case dimensions are universally identical in each policy and in +`Required`. This proves both containments without claiming policy equality. + +At policy level, setting `f=true,t=W` falsifies every disjunct in both policies, +for every `v,h,p,d,i`. At source level, `BUILD-MAP-POLICY` maps exactly that +feature/target selection to both cfg atoms; `all(...)` is true, the cfg keeps +the `compile_error!`, and compilation fails. Thus every such full case is both +policy-excluded and effectively rejected before an executable library is +produced. This rejection statement, unlike the Boolean policy calculation, +depends on the accepted build-map premise. + +## Applicable Rust axioms + +The following quoted prose is identical on each linked exact release; no +cross-release compatibility inference is used. + +* CFG-84/85/86: the Reference describes `cfg` as “conditionally includes”; + `all` is “true if all of the given predicates are true”; `not` is “true if + the given predicate is false”; a false cfg is “removed from the source.” + Sources: [1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), + [1.84 cfg attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), + [1.85 cfg attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), + [1.86 cfg attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +* CE-84/85/86: `compile_error!` “Causes compilation to fail with the given error + message when encountered.” Sources: [1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), + [1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), + [1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). +* OPTION-84/85/86: `unwrap_or` “Returns the contained `Some` value or a provided + default.” `unwrap_unchecked` “Returns the contained `Some` value”; “Calling + this method on `None` is undefined behavior.” Sources: + [1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), + [1.84 unchecked](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), + [1.85 unchecked](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), + [1.86 unchecked](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). + +## Branch proofs and obligation ledger + +The only language-reachable crate API is the safe free function +`value_or_zero(Option) -> u8`, with exactly one cfg-selected definition. +There are no public fields, user constructors, methods, traits/impls, callbacks, +macros exported by this crate, hidden items, FFI, or invariant-bearing state. + +**Non-turbo lemma (`F(c) and !f`).** CFG plus `BUILD-MAP-POLICY` selects the +first definition and removes the second. There is no unsafe operation. +OPTION-84/85/86 entails that `Some(x).unwrap_or(0)` returns `x` and +`None.unwrap_or(0)` returns `0`. This proves UB freedom and the documented +postcondition for every `v,t,h,p,d,i` in this lemma. + +**Turbo lemma (`F(c) and f and t in {X,A}`).** The accepted mapping and CFG +select the second definition; the wasm compile error is absent. First, +`i.unwrap_or(0)` produces `y=x` for `i=Some(x)` and `y=0` for `i=None`. +The receiver of the sole unsafe operation is then syntactically and immediately +constructed as `Some(y)`. It is therefore not `None`, discharging the complete +documented safety precondition of `unwrap_unchecked`; OPTION-84/85/86 says it +returns the contained `y`. Thus the operation is free of its documented UB and +the function returns `x` for `Some(x)`, otherwise `0`, for every retained +version, target, hardened state, profile, debug-assertion state, and input. + +`h`, profile, and debug assertions occur in neither body nor source-selection +predicate, and the proof is parametric over them. Target affects only the +separately proved compile-error gate. Each exact version has its own cited +premises. + +## Covered predicates and closure certificates + +Keeping every case dimension explicit, define + +```text +L0(c) := F(c) and !f +L1(c) := F(c) and f and t in {X,A} +Covered_sound(c) := L0(c) or L1(c) +Covered_behavior(c) := L0(c) or L1(c). +``` + +The two branch proofs establish their respective lemmas for both obligations. +If `Required(c)`, either `!f`, giving `L0`, or `f`; then `t` is one of +`{X,A,W}` and the exclusion forces `t in {X,A}`, giving `L1`. Conversely each +lemma satisfies `Required`. Hence +`Required = Covered_sound = Covered_behavior`, proving separately +`Required subset Covered_sound` and `Required subset Covered_behavior`. +Their pointwise intersection also equals `Required`, which is the combined +closure certificate. + +## TCB, documentation finding, and residual scope + +TCB log identity is the supplied `TCB.md`. `BUILD-MAP-POLICY` is accepted only +for the three exact Cargo/Rust releases, named feature-to-cfg mappings, +target-to-`target_arch` mappings, and the selection/rejection consumers above. +It supplies no Rust semantics or backend correctness. CFG, CE, and OPTION are +exact-version authoritative axioms, not implementation assumptions. No other +premise or tool evidence is consumed. + +The unsafe implementation is proved, but its adjacent safety comment is +proof-documentation deficient: it states the local `Some` fact without naming +the callee's `None`/UB obligation, cited contract, or resulting value. A compact +replacement is: + +```rust +// SAFETY: Option::unwrap_unchecked is UB only for None. This receiver is +// constructed immediately as Some(value), so it is not None; the call returns +// that contained value. +``` + +This documentation finding changes neither implementation verdict. There is no +proved UB witness and no UB-free postcondition counterexample. Residual scope is +the unresolved identity of the published support promise and all backend, +binary, custom-target, non-named-version, or changed-toolchain claims. Re-audit +is required by any source/manifest/policy/TCB change, support-domain expansion, +different Cargo or Rust release, or material change to a consumed Rust page. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/F.md new file mode 100644 index 0000000000..688b849351 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/F.md @@ -0,0 +1,194 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This source-only review covers the supplied `Cargo.toml`, `POLICY-SCARLET.md`, +`POLICY-INDIGO.md`, `TCB.md`, and `src/lib.rs` snapshot, with audit cutoff +2026-08-01. There are no dependencies, generators, expansions, or prior results +in the supplied evidence. No build, execution, test, or backend claim is made. + +For a full case + +`c = (v,t,f,h,p,d,i) = (version,target,turbo,hardened,profile,debug_assertions,input)`, + +the soundness theorem is: every well-typed safe call to the selected +`value_or_zero` in every required case is free of Rust undefined behavior. The +behavioral theorem is: if the call returns `r`, then + +`Q(i,r) := (i = None => r = 0) and (for every n, i = Some(n) => r = n)`. + +Results over the conservative domain `R` defined below: + +* **Soundness: PROVED relative to `BUILD-MAP-POLICY`.** +* **Documented postcondition `Q`: PROVED relative to `BUILD-MAP-POLICY`.** +* **Combined mandatory result: PROVED relative to `BUILD-MAP-POLICY`.** +* **Identity of the crate's exact support promise: UNPROVED.** Scarlet and + Indigo are both current, conflict, and have no authorized resolution. `R` is + an audit domain, not a resolution or newly inferred project promise. + +## Exact policy predicates and relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, with `X`, `A`, and `W` denoting +the three exact triples in the policies. Let `B={false,true}`, `P` be all Cargo +profiles, and `O` be every valid `Option`. + +The exact Scarlet configuration predicate is + +`S(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (!h or v>=1.85.0)) or (f and t=A and h)]`. + +The exact Indigo configuration predicate is + +`I(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (h or v>=1.86.0)) or (f and t=A and !h and v>=1.85.0)]`. + +They are **incomparable**, hence unequal: + +* `(1.84.0,X,true,false)` is in Scarlet: its `X` clause has `!h`; it is not in + Indigo because both `h` and `v>=1.86.0` are false. Thus `S` is not contained + in `I`. +* `(1.84.0,X,true,true)` is in Indigo: its `X` clause has `h`; it is not in + Scarlet because both `!h` and `v>=1.85.0` are false. Thus `I` is not + contained in `S`. + +The induced full-case domains, retaining every requested dimension, are + +`D_S(c) := S(v,t,f,h) and p in P and d in B and i in O`, and + +`D_I(c) := I(v,t,f,h) and p in P and d in B and i in O`. + +Select the conservative audit domain + +`R(c) = Required(c) := D_S(c) or D_I(c)`. + +For every full case, `D_S(c) => D_S(c) or D_I(c)` and independently +`D_I(c) => D_S(c) or D_I(c)`. Therefore `D_S` is contained in `R` and `D_I` +is contained in `R`; these are full-case, not configuration-projection, +containments. Conversely, `R = D_S union D_I` by definition, but that equality +does not resolve which current policy controls the project's promise. + +## Authorities and TCB + +For each exact release, its `Option` page states that `unwrap_or` “Returns the +contained `Some` value or a provided default”; `unwrap_unchecked` “Returns the +contained `Some` value”; and “Calling this method on `None` is undefined +behavior”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or). +The corresponding unsafe-method anchors are +[1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and +[1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +These separate exact-version axioms avoid any cross-release compatibility +assumption. + +For each release, the Reference says an option predicate is “true if the +configuration option is set”; `all` requires “all of the given predicates” to +be true, `not` is true when “its predicate is false,” and `cfg` “conditionally +includes” its attached item: [1.84.0 predicates](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.84.0 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85.0 predicates](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.85.0 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86.0 predicates](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), and +[1.86.0 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +Each exact-version macro page says `compile_error!` “causes compilation to fail +with the given error message when encountered”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). + +`BUILD-MAP-POLICY` is the sole additional TCB entry. It is accepted by the +authorized human and admits, only for the toolchain-bundled Cargo at the three +releases and supplied manifest/source, that feature enablement maps exactly to +the two feature cfgs and the three triples map respectively to `x86_64`, +`aarch64`, and `wasm32`. This audit consumes it only in source selection and +effective rejection below; it supplies no Option semantics or branch +correctness. Its limitations and re-audit triggers are exactly those in +`TCB.md`. No implementation, backend, dependency, tool-result, or environmental +premise is admitted. + +## Selection, exclusion, and effective rejection + +By the build mapping and cited cfg semantics, `!f` selects exactly the +`#[cfg(not(feature="turbo"))]` definition, while `f` selects exactly the +`#[cfg(feature="turbo")]` definition. Neither profile, `d`, `h`, nor `i` +occurs in these selectors, so this argument is parametric over their complete +fibers and is repeated under each release's exact Reference text. + +At policy level, if `f` and `t=W`, every disjunct in both `S` and `I` is false: +`!f` is false and each remaining disjunct requires `t=X` or `t=A`. Thus neither +policy induces such a full case and `R` excludes all of them. + +Independently, for every `v in V`, `h,d in B`, `p in P`, and `i in O`, the TCB +maps `f=true,t=W` to both `feature="turbo"` and `target_arch="wasm32"` being +set. `all(...)` is therefore true, its cfg includes `compile_error!`, and the +cited macro contract makes compilation fail. No library artifact or runtime +input is reached. This proves source-level effective rejection across the +entire stated `turbo`/`wasm32` case fiber, relative to the TCB; it is not used +to pretend those policy-excluded cases are members of `R`. + +For every `R(c)` with `f=true`, either policy's only possible true turbo +disjunct requires `t=X` or `t=A`. Hence the rejection condition is false and +the turbo source branch is the relevant branch. + +## Branch-local proofs and obligation ledger + +The sole public safe surface is `value_or_zero(Option) -> u8`, with one of +two configuration-specific definitions. There are no fields, constructors, +traits, impls, exported macros, hidden items, callbacks, FFI surfaces, or +stateful invariants. + +**OBL-NONTURBO (`R(c) and !f`).** The selected body is +`i.unwrap_or(0)`. For each `v` the exact-version safe-method contract yields +`0` when `i=None` and the contained `n` when `i=Some(n)`. Thus `Q` holds. The +body contains no unsafe operation, and the safe standard-library call is made +with its typed receiver and argument; soundness is proved for every `t,h,p,d,i` +in this fiber. + +**OBL-TURBO (`R(c) and f`).** First, the same release-specific `unwrap_or` +contract establishes a local byte `x=0` for `None`, or `x=n` for `Some(n)`. +Next the receiver at the unsafe site is syntactically and immediately +constructed as `Some(x)`. Therefore it is not `None`, discharging the exact +`unwrap_unchecked` safety obligation. Its documented result is the contained +value `x`; substitution of the first step proves `Q`. This proves both UB +freedom and behavior for every `t in {X,A}`, `h,p,d,i` admitted by `R` and for +each separately cited release. + +**DOC-1 (proof artifact deficient; implementation proved).** The existing +`SAFETY` comment records the decisive local fact but omits the callee's exact +`None`-UB obligation and the result used for `Q`. Suggested replacement: + +> SAFETY: `unwrap_unchecked` is UB on `None`. The receiver is exactly +> `Some(value)`, hence not `None`; the call returns its contained `value`. + +This is documentation debt, not a hidden caller obligation or implementation +defect. + +## Full-case Covered predicates and closure + +The two branch lemmas are universal over every omitted-dimension fiber, so no +dimension is projected away. State the proved predicates extensionally as + +`Covered_sound(c) := R(c)`, and `Covered_post(c) := R(c)`. + +Their derivation is the exhaustive partition `R(c) and !f` versus `R(c) and f`. +Boolean totality covers every `f`; the first is OBL-NONTURBO, and in the second +`R=>t in {X,A}` followed by OBL-TURBO applies. Each lemma retains `v,t,f,h,p,d,i`; +`p,d,h` are irrelevant because they neither select nor alter the body, while +`i` is handled parametrically as `None` or `Some(n)`. The release dimension is +exhausted by three release-specific authority/derivation instances. + +For soundness, `Required(c)=R(c)=Covered_sound(c)`, hence +`Required` is contained in `Covered_sound`. Independently, +`Required(c)=R(c)=Covered_post(c)`, hence `Required` is contained in +`Covered_post`. Claim-level coverage is their pointwise conjunction, not a +union: `Covered_sound(c) and Covered_post(c) = R(c)`. Therefore +`Required` is contained in aggregate `Covered`, certifying both PROVED verdicts +relative to `BUILD-MAP-POLICY`. + +## Residual scope and review triggers + +The unresolved item is solely which conflicting policy defines the exact +project promise; an authorized precedence/merge decision is required. Cases +outside `R`, including all turbo/wasm32 cases, versions outside `V`, targets +outside `T`, non-Cargo/custom build mappings, compiler/backend correctness, and +binary behavior are not affirmative audit claims. Re-audit on any source, +manifest, policy/resolution, supported-axis, feature/target mapping, TCB +disposition, or consumed exact-version Rust documentation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/G.md new file mode 100644 index 0000000000..0b6b32f772 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/G.md @@ -0,0 +1,116 @@ +# Focused unsafe-Rust source audit + +## Claim, scope, and verdicts + +The audited artifact is the complete supplied `focused-predicate-target` 0.1.0 source snapshot (`Cargo.toml`, both policy files, `TCB.md`, and `src/lib.rs`), edition 2021. This is a source-level Rust-abstract-semantics review at cutoff 2026-08-01; no build, execution, expansion, backend, or binary claim is made. There are no dependencies, generators, FFI, traits, fields, statics, or macros authored by the crate. The sole public surface is the safe function `value_or_zero(Option) -> u8`; its two definitions are configuration alternatives. The sole unsafe operation is `Option::unwrap_unchecked` at `src/lib.rs:18`. + +* **Soundness: PROVED** for every full case in `D_A` below, relative to accepted `BUILD-MAP-POLICY` and the exact-version Rust axioms quoted below. +* **Documented postcondition: PROVED** on `D_A`: the result is the contained byte for `Some(byte)` and zero for `None`, under the same qualification. +* **Effective turbo/wasm32 rejection: PROVED** on `R_W` below, relative to `BUILD-MAP-POLICY`. +* **Identity of the crate's exact support promise: UNPROVED.** Scarlet and Indigo are current, incomparable commitments and no resolution rule is authorized. `D_A` is an audit envelope, not a declaration that union is the project's resolved promise. + +There is no invariant-bearing state. The existing adjacent `SAFETY` comment is proof-documentation-deficient but the implementation obligation is proved by the reconstructed derivation below. + +## Exact policy predicates and relationships + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the policy-defined triples, and `B={false,true}`. Writing `f` for turbo and `h` for hardened, the exact Scarlet predicate is + +```text +S(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f + or (f and t=X and (!h or v>=1.85.0)) + or (f and t=A and h)) +``` + +and the exact Indigo predicate is + +```text +I(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f + or (f and t=X and (h or v>=1.86.0)) + or (f and t=A and !h and v>=1.85.0)). +``` + +They are unequal and incomparable. Witness `s=(1.84.0,X,true,false)` is in Scarlet because its `X` clause has `!h`, but not Indigo because both `h` and `v>=1.86.0` are false; hence `S⊄I`. Witness `i=(1.84.0,X,true,true)` is in Indigo because `h`, but not Scarlet because both `!h` and `v>=1.85.0` are false; hence `I⊄S`. + +Let `P` be all Cargo profiles, `O=Val(Option)={None}∪{Some(x)|x∈0..=255}`, and a full case be the requested + +```text +c=(v,t,f,h,p,d,input), where p∈P, d∈B, input∈O. +D_S(c) := S(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +D_I(c) := I(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +``` + +Select the conservative configuration predicate + +```text +U(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f or (f and t=X) or (f and t=A and (h or v>=1.85.0))) +``` + +and full audit domain + +```text +D_A(c) := U(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +Required(c) := D_A(c). +``` + +Separate containment certificates: every Scarlet disjunct implies the corresponding `U` disjunct (`!f`; `f∧t=X`; or `f∧t=A∧h`), so `D_S⊆D_A`. Every Indigo disjunct likewise implies `!f`, `f∧t=X`, or `f∧t=A∧v>=1.85.0`, so `D_I⊆D_A`. All four remaining case dimensions are preserved unchanged in both arguments. + +In fact `U=S∨I`: conversely, `!f` belongs to both; for `f∧t=X`, `h` selects Indigo and `!h` selects Scarlet; for `f∧t=A∧(h∨v>=1.85.0)`, `h` selects Scarlet, while `!h` forces `v>=1.85.0` and selects Indigo. This equality describes the chosen envelope; it does not resolve which published policy controls. + +## Applicable Rust premises and TCB + +For each exact release, the Reference says `cfg` “conditionally includes the thing it is attached to”; `all` is “true if all predicates are true,” and `not` is “true if its predicate is false”: [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). Each exact `compile_error!` page says it “Causes compilation to fail with the given error message when encountered”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). + +For each exact release, `unwrap_or` “Returns the contained `Some` value or a provided default”; `unwrap_unchecked` “Returns the contained `Some` value,” and its Safety section says, “Calling this method on `None` is undefined behavior”: [1.84.0 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.84.0 unchecked](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0 unchecked](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86.0 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), [1.86.0 unchecked](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). These are per-release premises; no cross-release compatibility inference is used. + +`BUILD-MAP-POLICY` is accepted human trust, limited exactly to Cargo 1.84.0/1.85.0/1.86.0 mapping the two named feature selections and the three named targets to their source `cfg` options for every supported profile. It is consumed only below for branch reachability and rejection. It supplies no Rust semantics or implementation correctness. No other non-authoritative premise is consumed. Re-audit on any trigger listed in `TCB.md`. + +## Selection, rejection, and branch proofs + +Define + +```text +R_W(c) := v∈V ∧ t=W ∧ f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +C_N(c) := v∈V ∧ t∈T ∧ !f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +C_T(c) := v∈V ∧ t∈{X,A} ∧ f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +``` + +**Turbo/wasm32.** Policy-level: with `f=true,t=W`, every non-`!f` disjunct in both `S` and `I` requires `t=X` or `t=A`; hence `R_W∩D_S=R_W∩D_I=∅`. Source-level: on every `R_W` case, `BUILD-MAP-POLICY` makes both leaves of `all(feature="turbo",target_arch="wasm32")` true. The exact-version `cfg` rules include the item and `compile_error!` rejects compilation. This is independent of `h,p,d,input`; the API is never executed. Thus every such policy-excluded configuration is also effectively rejected, rather than merely undocumented. + +**Non-turbo branch (`C_N`).** The build mapping plus exact-version `cfg` semantics includes lines 8–10 and excludes lines 14–19. For arbitrary full-case `input`, `input.unwrap_or(0)` returns its contained `x` for `Some(x)` and the provided `0` for `None`. There is no unsafe operation on this branch, and the documented postcondition holds. + +**Turbo non-wasm branch (`C_T`).** The rejection predicate is false because `t∈{X,A}`; the build mapping and `cfg` semantics include lines 14–19 and exclude lines 8–10. Let `r=input.unwrap_or(0)`. The cited contract gives `r=x` for `Some(x)` and `r=0` for `None`. The receiver of the unsafe call is constructed at that expression as `Some(r)`, so it is not `None`; the sole documented safety obligation is satisfied. The call returns the contained `r`, proving both absence of UB at the unsafe site and the public postcondition. + +Profiles and `debug_assertions` do not occur in source predicates or operations, and `h` affects policy membership but not selected code. The proofs therefore quantify parametrically over every `p,d,h,input`; no dimension is projected away. + +## Covered predicates and closure + +Let `Q(input,result)` mean `(input=None ∧ result=0) ∨ ∃x∈0..=255.(input=Some(x) ∧ result=x)`. The preceding per-release derivations establish, retaining the complete tuple: + +```text +Covered_sound(c) := C_N(c) ∨ C_T(c). +Covered_behavior(c) := C_N(c) ∨ C_T(c), with Q established. +``` + +For arbitrary `c` with `Required(c)=D_A(c)`: if `!f`, then `c∈C_N`; if `f`, predicate `U` forces `t=X` or `t=A`, hence `c∈C_T`. Every other coordinate is carried unchanged. Therefore + +```text +Required ⊆ Covered_sound +Required ⊆ Covered_behavior. +``` + +This supplies both whole-domain `PROVED` certificates. It also covers each candidate promise separately by `D_S⊆D_A` and `D_I⊆D_A`. The source-selection partition is exhaustive on `Required`; the separately proved `R_W` rejection lies outside it. + +## Finding: local proof text is incomplete + +`src/lib.rs:17` records the decisive local fact but does not state the callee's exact safety obligation or the postcondition used to prove the wrapper's behavior. This is documentation debt, not an implementation defect. Suggested adjacent replacement: + +```rust +// SAFETY: `unwrap_unchecked` requires that its receiver is not `None`. +// This receiver is constructed here as `Some(value)`, so that requirement +// holds; the operation returns the contained `value`. +``` + +No code change was authorized. Re-audit if source, either policy, the accepted build mapping, supported versions/targets/features/profiles, or any consumed Rust documentation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/H.md new file mode 100644 index 0000000000..f6d59e89a4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/H.md @@ -0,0 +1,210 @@ +# Focused unsafe-Rust source audit + +## Claim, snapshot, and verdicts + +This review covers the supplied `Cargo.toml`, `src/lib.rs`, both published +policy documents, and `TCB.md`, source-only, as inspected on 2026-08-01. The +crate is `focused-predicate-target` 0.1.0, edition 2021, with no dependencies, +build script, generator, or generated artifact. Nothing was built, expanded, +run, or tested. + +- **PROVED — source soundness:** every well-typed safe call to the selected + `value_or_zero` implementation is free of Rust undefined behavior over the + conservative audit domain `A` below, relative to accepted + `BUILD-MAP-POLICY` and the exact-version Rust axioms cited below. +- **PROVED — documented behavior:** on that same domain, normal return is the + contained byte for `Some(n)` and zero for `None`. +- **PROVED, TCB-qualified — effective rejection:** every considered + `turbo`/`wasm32` compilation is rejected, relative specifically to + `BUILD-MAP-POLICY` and the cited `cfg`/`compile_error!` contracts. +- **UNPROVED — identity of the project's exact support promise:** Scarlet and + Indigo are current, incomparable commitments, and no merge or precedence + rule is authorized. `A` is an audit domain, not a resolution of that + governance question. + +There is no `UNSOUND` or `CONTRACT-BROKEN` finding. + +## Exact policy and full-case domains + +Let + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +X = x86_64-unknown-linux-gnu +A = aarch64-unknown-linux-gnu +W = wasm32-unknown-unknown +B = {false, true} +P = the set of all Cargo profiles +O = {None} union {Some(n) | n is any u8, 0 <= n <= 255} +``` + +A full case is `c=(v,t,f,h,p,d,i)`, where `f` is `turbo`, `h` is +`hardened`, `p` is profile, `d` is `debug_assertions`, and `i` is input. Define + +```text +Base(c) := v in V and t in T and f,h,d in B and p in P and i in O. +``` + +The exact Scarlet configuration predicate is + +```text +S0(v,t,f,h) := + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h). +``` + +Its induced full-case domain is +`DS(c) := Base(c) and S0(v,t,f,h)`. + +The exact Indigo configuration predicate is + +```text +I0(v,t,f,h) := + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0). +``` + +Its induced full-case domain is +`DI(c) := Base(c) and I0(v,t,f,h)`. + +They are unequal and neither contains the other. The full case +`(1.84.0,X,true,false,dev,true,None)` is in `DS` because Scarlet's +`X and !h` clause holds, but not `DI` because both `h` and +`v >= 1.86.0` are false. Conversely, +`(1.86.0,A,true,false,dev,true,None)` is in `DI` because Indigo's +`A and !h and v >= 1.85.0` clause holds, but not `DS` because Scarlet's +`A` clause requires `h`. + +Select the conservative full-case audit domain + +```text +Required(c) := A(c) := DS(c) or DI(c). +``` + +The two required containments are immediate but separate: if `DS(c)`, then +the left disjunct establishes `A(c)`; if `DI(c)`, the right disjunct establishes +`A(c)`. Thus `DS subseteq A` and `DI subseteq A`. This exact union is chosen +only to audit every case promised by either document; it is not asserted to be +the project's support promise. + +## Policy exclusion and effective rejection + +For any `Base(c)` with `f=true` and `t=W`, neither policy holds: every `f=true` +disjunct in both `S0` and `I0` requires `t=X` or `t=A`. Hence no such case is in +`DS`, `DI`, or `Required`, for every `v,h,p,d,i`. + +Source rejection is independently stronger within `Base`. Accepted +`BUILD-MAP-POLICY` maps `f=true` to `cfg(feature="turbo")` and `t=W` to +`target_arch="wasm32"` for each exact release and every profile. The enclosing +`cfg(all(...))` therefore includes `compile_error!` for every such case, +independently of `h,d,i`. For each exact release, the Reference says: “The +`cfg` attribute conditionally includes the thing it is attached to based on a +configuration predicate.” ([1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute)). +The corresponding macro pages say: “Causes compilation to fail with the given +error message when encountered.” ([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). Thus no +library artifact containing a callable function is produced for these cases. + +## Surface and obligation inventory + +The complete crate-defined callable surface is one safe public free function, +`value_or_zero(Option) -> u8`, with mutually exclusive non-`turbo` and +`turbo` definitions. There are no public fields, constructors, user-defined +types or traits, callbacks, FFI items, reexports, hidden items, or exported +macros. `compile_error!` is the rejection site. The sole unsafe operation is +`Some(value).unwrap_unchecked()` in the `turbo` definition. There is no +persistent invariant-bearing state. + +For each `r` in `V`, the exact `Option` pages provide the same three premises: +“Returns the contained `Some` value or a provided default” for `unwrap_or`, +“Returns the contained `Some` value” for `unwrap_unchecked`, and “Calling this +method on `None` is undefined behavior.” See +[1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and +[1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +Using each release's own pages is an exhaustive three-member partition; no +cross-version compatibility premise is used. + +Let `Q(i,r)` mean `(i=None and r=0) or (there exists n: i=Some(n) and r=n)`. + +1. **Non-`turbo` branch.** For every full case with `f=false`, the build-map + premise and complementary `cfg` select this definition. If `i=None`, + `i.unwrap_or(0)` returns the provided zero; if `i=Some(n)`, it returns `n`. + The call is safe and establishes `Q` for every `i in O`; there is no unsafe + operation. +2. **`turbo` executable branch.** For every full case with `f=true` and + `t in {X,A}`, the `turbo` definition is selected and the rejection predicate + is false. The first `unwrap_or(0)` produces `x=0` from `None` and `x=n` from + `Some(n)`. The unsafe receiver is then syntactically constructed as + `Some(x)`, not `None`; therefore the exact `unwrap_unchecked` safety + obligation holds. It returns `x`, establishing `Q` in both input cases. + +These derivations are parametric in `t,h,p,d,i` where stated. `h`, profile, and +debug assertions do not occur in either function body; target affects only the +proved `W` rejection. Version is discharged by the exhaustive exact-document +partition above. + +## Covered predicates and closure certificates + +Without dropping any full-case dimension, define + +```text +Executable(c) := Base(c) and (!f or (f and t in {X,A})). +Covered_sound(c) := Executable(c). +Covered_post(c) := Executable(c). +Required_sound(c) := Required(c). +Required_post(c) := Required(c). +``` + +The branch lemmas prove soundness and `Q`, respectively, for every case in the +two `Executable` disjuncts, so these are the applicable aggregate coverage +predicates. If `Required(c)`, then `DS(c)` or `DI(c)`. Both imply `Base(c)`; if +`!f`, the first `Executable` disjunct holds, while if `f`, inspection of every +`f`-disjunct in both exact policy predicates gives `t in {X,A}`. Consequently +`Required_sound subseteq Covered_sound` and +`Required_post subseteq Covered_post`. These two pointwise containments certify +the whole-domain soundness and behavioral verdicts; coverage is not a union of +different obligations proved on different regions. + +## TCB, findings, and residual scope + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. Its human disposition +is accepted; its identity is the toolchain-bundled Cargo for exactly Rust +1.84.0, 1.85.0, and 1.86.0 acting on the supplied manifest/source. This report +uses it only for feature/target `cfg` reachability, branch selection, and +effective rejection, exactly its listed consumers. It is not used for Rust +semantics, branch correctness, compatibility, or binary/backend correctness. +The versioned Reference/std propositions above are authoritative Rust axioms, +not compatibility assumptions. There is no dependency, tool-result, external, +deployment, or probabilistic TCB entry. + +**POLICY-1 (UNPROVED governance claim).** The smallest missing premise is an +authorized rule selecting or combining Scarlet and Indigo. Resolution requires +a published precedence/supersession/merge decision; it would change domain +identity, not the proofs over `A` unless it adds cases outside `A`. + +**DOC-1 (proof-artifact deficiency; implementation proved).** The existing +SAFETY comment records the decisive local fact—construction as `Some`—but does +not state the consumed callee precondition. A proof-grade replacement is: + +```rust +// SAFETY: `unwrap_unchecked` requires the receiver not to be `None`. +// It is constructed immediately here as `Some(value)`, so that holds. +``` + +No implementation change is required for this finding. + +Excluded from the claims are configurations outside `Required`, emitted binary +correctness, compiler/backend/linker behavior, performance, and undocumented +robustness. Re-audit is required for any source, manifest, policy-resolution, +feature/target/profile support, TCB disposition or mapping, Rust-version scope, +or materially consumed authoritative-documentation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/I.md new file mode 100644 index 0000000000..f22113b8b0 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/I.md @@ -0,0 +1,190 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-level audit of the supplied `Cargo.toml` and `src/lib.rs` under +the two supplied policies, for Rust/standard-library releases 1.84.0, 1.85.0, +and 1.86.0. Scope comprises the public safe function `value_or_zero`, its two +conditionally selected definitions, the one `unwrap_unchecked` operation, its +documented return-value postcondition, and the `turbo`/`wasm32` rejection. There +are no dependencies, generated sources, build scripts, public fields, traits, +impls, exported macros, FFI surfaces, or representation invariants. + +| Claim | Verdict | Qualification | +|---|---|---| +| Freedom from Rust undefined behavior for every case in the conservative audit domain `Required` below | **PROVED** | Source semantics; relative to accepted `BUILD-MAP-POLICY` solely for mapping policy configurations to Rust `cfg`s/source selection | +| “Returns the contained byte, or zero when `value` is `None`” over that same domain | **PROVED** | Same qualification | +| Identity of the crate's exact support promise | **UNPROVED** | Scarlet and Indigo are incomparable current commitments and no resolution rule is authorized | + +Thus the mandatory soundness and behavioral claims are also **PROVED** +separately over each policy-induced domain, by their proved containment in +`Required`. This does not resolve which policy, union, intersection, or other +set is the actual project promise. No backend, binary, future-release, or +unsupported-configuration correctness is claimed. Audit cutoff: 2026-08-02; +the supplied policies contain no moving component. + +## Exact policy and full-case domains + +Let + +- `V = {1.84.0, 1.85.0, 1.86.0}`; +- `T = {X, A, W}`, with the triples defined exactly as in the policies; +- `B = {false, true}`; +- `P` be all Cargo profiles (as quantified by both policies); and +- `O = Valid(Option)`, including `None` and every `Some(x)` with valid + `x: u8`. + +For configuration `q=(v,t,f,h)`, the policies' exact predicates are + +```text +Scarlet(q) := v in V and t in T and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) + +Indigo(q) := v in V and t in T and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +They are unequal and incomparable. `(1.84.0,X,true,false)` is Scarlet: its +Scarlet `X` arm holds through `!h`; it is not Indigo because both `h` and +`v>=1.86.0` are false. Conversely `(1.84.0,X,true,true)` is Indigo through its +`h` term, but not Scarlet because both `!h` and `v>=1.85.0` are false. These +are explicit witnesses to `Scarlet ⊈ Indigo` and `Indigo ⊈ Scarlet`. + +A full case is exactly +`c=(v,t,f,h,p,d,i)`, for `p in P`, `d in B` (the `debug_assertions` state), +and `i in O`. Define + +```text +D_S(c) := Scarlet(v,t,f,h) and p in P and d in B and i in O +D_I(c) := Indigo(v,t,f,h) and p in P and d in B and i in O +Required(c) := D_S(c) or D_I(c) +``` + +`Required` is the selected conservative audit domain, not an asserted project +promise. For arbitrary full `c`, `D_S(c) => Required(c)` by left disjunction +introduction, and `D_I(c) => Required(c)` by right disjunction introduction; +these separately prove `D_S ⊆ Required` and `D_I ⊆ Required`. The same +two witnesses, extended with any `p,d,i`, show the full-case domains remain +incomparable. + +## Configuration selection and rejection + +For each exact release, the Reference says `all()` is “true if all … predicates +are true”, `not()` is “true if its predicate is false”, and a `cfg` attribute +“conditionally includes the thing … based on a configuration predicate”: +[1.84 predicates](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.84 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85 predicates](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.85 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86 predicates](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), +[1.86 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +The exact-version `compile_error!` pages identically state: “Causes compilation +to fail with the given error message when encountered.” +([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). + +Applying only the accepted `BUILD-MAP-POLICY`, `f` supplies +`cfg(feature="turbo")`, `h` supplies the analogous `hardened` option, and +`X/A/W` supply `target_arch="x86_64"/"aarch64"/"wasm32"`, for each listed +release and profile. Combining that admitted leaf mapping with the cited Rust +semantics proves: + +- if `!f`, exactly the `cfg(not(feature="turbo"))` function is included; +- if `f` and `t` is `X` or `A`, exactly the turbo function is included and the + `compile_error!` predicate is false; and +- if `f` and `t=W`, both operands of `all(...)` are true, so the error macro is + included and compilation fails. This rejection is independent of `h,p,d,i`. + +Policy-level exclusion is independent: substituting `f=true,t=W` makes `!f` +false and every `t=X`/`t=A` arm false in both predicates. Hence no such case is +in `D_S`, `D_I`, or `Required`. The source additionally rejects every such +build effectively, relative to `BUILD-MAP-POLICY`; it supplies no callable +library execution to which the runtime postcondition could apply. + +## Branch proofs and obligation ledger + +The exact 1.84/1.85/1.86 `Option` pages use identical controlling prose: +`unwrap_or` “Returns the contained `Some` value or a provided default”; +`unwrap_unchecked` “Returns the contained `Some` value”; and “Calling this +method on `None` is undefined behavior.” +([1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.84 `unwrap_unchecked`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.85 `unwrap_unchecked`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), +[1.86 `unwrap_unchecked`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked)). + +Let `Q(i,r)` mean `r=x` when `i=Some(x)`, and `r=0` when `i=None`. + +| Obligation | Full applicability | Derivation | Status | +|---|---|---|---| +| Non-turbo soundness and `Q` (`lib.rs:7-9`) | `v in V,!f,t in T,h,d in B,p in P,i in O` | Safe `unwrap_or(0)` returns the contained value or `0`; no unsafe operation occurs | **PROVED** | +| Turbo unsafe precondition (`lib.rs:16`) | `v in V,f,t in {X,A},h,d in B,p in P,i in O` | First `unwrap_or(0)` produces some byte `y`; the receiver is then constructed immediately as `Some(y)`, therefore it is not `None` | **PROVED** | +| Turbo `Q` (`lib.rs:13-16`) | same | `unwrap_unchecked` returns the contained `y`; the preceding `unwrap_or(0)` establishes `y=x` for `Some(x)` and `y=0` for `None` | **PROVED** | +| `turbo`/`W` effective rejection (`lib.rs:3-4`) | `v in V,f,t=W,h,d in B,p in P,i in O` | cfg derivation above; failure precedes any runtime input | **PROVED relative to BUILD-MAP-POLICY** | + +The branch proofs are parametric in target within their stated branch, +`h`, profile, debug assertions, and every valid input; none of those omitted +dimensions changes the source operations or the cited contracts. + +## Exact coverage and closure + +Define, without projecting any dimension, + +```text +Base(c) := v in V and t in T and f in B and h in B + and p in P and d in B and i in O +Compiles(c) := !f or (f and t in {X,A}) +Covered_sound(c) := Base(c) and Compiles(c) +Covered_post(c) := Base(c) and Compiles(c) +``` + +Here `Covered_sound` denotes exactly the full cases covered by the two +source-level absence-of-UB lemmas above, and `Covered_post` those covered by +their `Q` lemmas, within the audited versions/targets. For arbitrary `c` with +`Required(c)`, either policy predicate holds. If `!f`, `Compiles(c)` holds. If +`f`, every surviving arm in either exact predicate explicitly requires +`t=X` or `t=A`; hence `Compiles(c)` again holds. All other `Base` conjuncts are +retained verbatim by `D_S` and `D_I`. Therefore + +```text +Required ⊆ Covered_sound +Required ⊆ Covered_post. +``` + +These containments, the exhaustive `f` branch split, and the per-branch proofs +are the certificates for both whole-domain **PROVED** verdicts. + +## TCB disposition, finding, and residual scope + +TCB identity is the supplied `TCB.md`, entry `BUILD-MAP-POLICY`; disposition: +accepted. It is consumed only in source-selection and effective-rejection +lemmas. It supplies no Option semantics, branch correctness, version +compatibility, or backend correctness. The version-matched Reference/std +quotations above are authoritative `AXIOM` entries, each restricted to its +named release. No compatibility interpolation is used and no other assumption +or tool-derived evidence is consumed. + +**Documentation finding (implementation still PROVED).** The existing safety +comment records the decisive local fact—construction as `Some`—but omits the +callee's exact precondition and the result used for `Q`; the audit had to +reconstruct those material links. A proof-grade replacement is: + +```rust +// SAFETY: `Option::unwrap_unchecked` requires this receiver not to be `None`. +// It is constructed immediately as `Some(value)`, so that requirement holds; +// the call returns the contained `value`. +unsafe { Some(value).unwrap_unchecked() } +``` + +Re-audit on any source/manifest/policy/TCB change; a change to the three Rust +versions or cited contracts; or a change to feature names, targets, supported +profiles, or debug-assertion policy. Residual scope comprises invalid +`Option` values, versions/targets outside the stated sets, rejected builds, +compiler/backend/binary behavior, and resolution of the conflicting support +commitments. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/J.md new file mode 100644 index 0000000000..a78897af64 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/P/reports/J.md @@ -0,0 +1,168 @@ +# Focused unsafe-code audit + +## Claim, scope, and verdicts + +This audit covers the supplied `Cargo.toml`, `src/lib.rs`, two policy files, and +`TCB.md`, at the 2026-08-01 cutoff. It covers the public safe function +`value_or_zero`, its two configuration-selected implementations, the one +`unsafe` call, and the compile-time rejection item. There are no dependencies, +generated artifacts, unsafe public APIs, fields, traits, impls, callbacks, FFI, +assembly, or representation invariants in the supplied source. + +For the conservative audit domain `Required` defined below: + +| Claim | Verdict | Qualification | +|---|---|---| +| Every well-typed call with any valid `Option` is free of Rust UB | **PROVED** | Source-level Rust semantics; relative to accepted `BUILD-MAP-POLICY` for policy-to-`cfg` reachability | +| The call returns its contained byte, or zero for `None` | **PROVED** | Same domain and qualification | +| Combined mandatory claim | **PROVED** | `Required ⊆ Covered_sound ∩ Covered_post` is proved below | +| A single exact project support predicate can be selected from Scarlet and Indigo | **UNPROVED** | No precedence or conflict-resolution rule is authorized; the audit union is not such a resolution | + +These are source-level conclusions, not compiler-backend, binary, or platform +correctness claims. + +## Exact policy predicates and relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, where `X`, `A`, and `W` have the +triples defined in the policies, and let `f` and `h` be Boolean `turbo` and +`hardened` states. Scarlet supports exactly `v∈V ∧ t∈T` and: + +```text +!f +or (f and t = X and (!h or v >= 1.85.0)) +or (f and t = A and h) +``` + +Indigo supports exactly `v∈V ∧ t∈T` and: + +```text +!f +or (f and t = X and (h or v >= 1.86.0)) +or (f and t = A and !h and v >= 1.85.0) +``` + +They are unequal and incomparable. The configuration +`(1.84.0,X,true,false)` is Scarlet-only: Scarlet's `X ∧ !h` disjunct holds, +whereas every Indigo disjunct is false. Conversely, +`(1.84.0,X,true,true)` is Indigo-only: Indigo's `X ∧ h` disjunct holds, +whereas Scarlet requires `!h` or `v>=1.85.0`. Thus neither predicate contains +the other. Each separator extends to every policy-supported profile, +debug-assertion state, and valid input. + +## Full-case domains + +Let: + +```text +B = {false,true} +P = the symbolic set of all Cargo profiles +O = {None} ∪ {Some(n) | n∈{0,…,255}} +c = (v,t,f,h,p,d,i) +Base(c) := v∈V ∧ t∈T ∧ f∈B ∧ h∈B ∧ p∈P ∧ d∈B ∧ i∈O +``` + +Writing the displayed policy bodies as `S(v,t,f,h)` and `I(v,t,f,h)`: + +```text +D_S(c) := Base(c) ∧ S(v,t,f,h) +D_I(c) := Base(c) ∧ I(v,t,f,h) +Required(c) := D_S(c) ∨ D_I(c) +``` + +`D_S` and `D_I` are the exact Scarlet- and Indigo-induced full-case domains. +`Required` is the selected conservative audit domain. Separately, +`D_S⊆Required` and `D_I⊆Required` follow by disjunction introduction for +every complete tuple `c`; hence it contains both domains. No equality between +`Required` and an exact crate support promise is asserted: the latter remains +unresolved by the controlling documents. + +## Authoritative semantic premises + +The following wording was checked separately at every exact release, so no +cross-version compatibility assumption is used. + +* On the exact Option pages for [1.84.0 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), and [1.86.0 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), the contract says: “Returns the contained `Some` value or a provided default.” The corresponding [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked) `unwrap_unchecked` pages say “Returns the contained `Some` value” and, under Safety, “Calling this method on `None` is undefined behavior.” +* Each exact conditional-compilation Reference—[1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), and [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation)—defines `all()` as “true if all of the given predicates are true” and `not()` as “true if its predicate is false.” Their `cfg`-attribute sections ([1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute)) say it “conditionally includes” its attached item and that when the “predicate is false, the thing is removed.” +* The exact [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), and [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html) macro pages all state: “Causes compilation to fail with the given error message when encountered.” + +## Exclusion and effective rejection + +Define the full rejected region +`E(c):=Base(c) ∧ f ∧ t=W`. Both policies exclude every member: with +`f=true`, `!f` is false, and with `t=W`, every `t=X` or `t=A` turbo disjunct is +false. Therefore `E∩D_S=E∩D_I=∅`, independently of `h,p,d,i`. + +Source-level rejection is a separate fact. Relative to the accepted +`BUILD-MAP-POLICY`, every `c∈E` sets both `feature="turbo"` and +`target_arch="wasm32"`. The `all(...)` predicate is therefore true, its `cfg` +item is included, and the encountered `compile_error!` makes compilation fail. +Thus no `E` case produces a callable library artifact. `h`, profile, +`debug_assertions`, and runtime input do not occur in this rejection condition. + +## Branch and obligation proofs + +Define `g(None)=0` and `g(Some(n))=n`. + +**Non-turbo branch (`Base(c) ∧ !f`).** `BUILD-MAP-POLICY` plus the versioned +`cfg` rules selects the safe implementation. The exact-version `unwrap_or` +contract gives `value.unwrap_or(0)=g(i)` for both exhaustive input cases. +There is no unsafe operation on this branch, and it returns `g(i)`, proving +soundness and the documented postcondition. The argument is parametric in +`v,t,h,p,d` after applying the appropriate one of the three exact-version +premises. + +**Turbo, non-W branch (`Base(c) ∧ f ∧ t≠W`).** The mapping and `cfg` rules +select the turbo implementation without encountering the rejection item. +First, safe `unwrap_or(0)` establishes the local `value=g(i)`. The receiver of +the unsafe call is then the expression `Some(value)`, hence is not `None`. +This discharges the complete documented safety obligation of +`unwrap_unchecked`; its return contract yields the contained `value=g(i)`. +The execution is UB-free and returns exactly the documented result for every +`i∈O`. Again `h,p,d` and the non-W target identity do not affect the dataflow, +and each `v` uses its own exact documentation. + +The existing safety comment records the decisive checked fact, but omits the +callee's explicit not-`None` obligation. This is proof-documentation debt, not +an implementation defect. A complete adjacent replacement would be: + +```rust +// SAFETY: `unwrap_unchecked` requires its receiver not be `None`. +// The receiver is constructed here as `Some(value)`, so it is not `None`. +``` + +## Covered predicates and closure certificates + +Without projecting away any full-case dimension, let: + +```text +Covered_sound(c) := Base(c) ∧ !(f ∧ t=W) +Covered_post(c) := Base(c) ∧ !(f ∧ t=W) +Covered_reject(c):= Base(c) ∧ f ∧ t=W +``` + +For each of the first two obligations, `Covered` is the union of the exhaustive +`!f` proof case and the `f ∧ t≠W` proof case. For every `c∈Required`, the +full `Base(c)` conjunct holds. The policy-exclusion proof above also gives +`!(f ∧ t=W)`. Hence `Required⊆Covered_sound` and independently +`Required⊆Covered_post`; pointwise conjunction gives +`Required⊆Covered_sound∩Covered_post`. This is the certificate for both +whole-domain `PROVED` verdicts. `Covered_reject` records the disjoint, +effectively rejected source region; it is not treated as a callable-behavior +case. + +## TCB, evidence, residual scope, and triggers + +`BUILD-MAP-POLICY` is the sole additional accepted premise. Its identity is +the toolchain-bundled Cargo for exactly Rust 1.84.0, 1.85.0, and 1.86.0 on the +supplied manifest/source. Only its named feature-to-`cfg` and target-to- +`target_arch` mappings are consumed, solely for branch reachability and +effective rejection. No Rust semantics, backend behavior, or versions outside +`V` are inferred from it. The exact-version Rust pages above are authoritative +axioms, not a compatibility bridge. No test, execution, build, expansion, or +tool-derived result was used. + +Residual scope comprises configurations outside `Base`, binary/backend +correctness, and the unresolved identity of the crate's single support promise. +Re-audit is required by any source, manifest, policy, TCB disposition/mapping, +feature or target set, supported Rust release, relevant Rust documentation, or +documented `value_or_zero` contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/PACKET.json new file mode 100644 index 0000000000..4a88043bea --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/PACKET.json @@ -0,0 +1,26 @@ +{ + "allowlist_sha256": "3dc7862cdc2fdc1d44fd97235ad043602bd26ab3b428209b94fe9fb0602c14f8", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "Q", + "raw_score_sha256": { + "s1": "f0a834ba924f88ce435031c3c3e30ec2aee1cb2d24b09eb032bc8fd861b508e0", + "s2": "33efb931c53a108e1ce6f6d396e88e382f64a70e00ce6f8478ab8b42378c3e98" + }, + "report_sha256": { + "A": "2f12ab5921c09f2eaf84d142758c151a33e35e8868fb9d7e0ddb3e1b15667c50", + "B": "56557faf2342dc507d6f1e13ad3c9976b04c74f555ba8071dfb4797b453cd4e8", + "C": "70aa95c476fb1d5b79ce3af822cf0dea84ad8134ecedee859aa09c98b5c51a36", + "D": "31b3e62080d847ce3a1005a6f3e1a8359578a5859fd56f1e4fc3bbf6a95784ea", + "E": "645f68d41c35811515b578645d72dce0dfe469bc7d123d4676c6f2779043409c", + "F": "cd6f9c0f3aeec081ba035b4f2f88168c5b3fb6143535dc1ebee925f270f4d9b5", + "G": "d967f1aa39439c98ad3848738c66656c708d763c1a00a16a40ef58197b885149", + "H": "67ff2058c11c9555d9ad9f940d58a5bcf773dcdcff0120d3cab8e22f71f9ab7e", + "I": "92773944d416bd3170da772c79531168275c351ce858b54ffed8558f55a83d68", + "J": "6a1aad4f07b372199c6b991e19332f67e30230c93e695d407ce30d97d0fc5df4" + }, + "rubric_sha256": "e18aba632c0f7bd3f4f2725e9a2515b2e2f5f561e7ed3320df6ad8b5154df98e", + "schema_sha256": "c7720030785e0d87c17d1a1ed44a9ecf260571a459be50b0fd2df15931ffa8e5", + "schema_version": 1, + "source_score_packet_sha256": "418ce57d0626b1211595f845c4f664871ec1ff9cfce6729c94dde09780e06eb7", + "target_byte_tree_sha256": "35bb6be0402f9d81918c3afc850dd54cde012865bba90d0cd8d7042d78a582ee" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/RUBRIC.md new file mode 100644 index 0000000000..503229e427 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/RUBRIC.md @@ -0,0 +1,78 @@ +# Mode Q Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file to a report agent. + +Let `C_Q` be Rust 1.80.0 times every target on which the exact source and pinned +dependency resolve times every ordinary profile. + +- `Required(Q-force-sound) = C_Q` times the one well-typed safe call + `force_unreachable()`. +- `Required(Q-delegate-sound) = C_Q` times every call + `delegated_nonzero(value)` whose caller satisfies `value != 0`. + +## Atoms + +- **Q1 — Domain and claim separation:** State both valid-use domains and audit + the two APIs independently. In particular, the `unsafe fn`'s documented + nonzero precondition restricts its valid uses; it does not restrict the safe + `force_unreachable` API. + - `scope_basis`: `REQUEST.md` explicitly asks for two separate claims and + supplies their common compilation scope; each API's signature/contract + determines its valid-use domain. + - `dependencies`: none. +- **Q2 — Complete UB certificate:** For `force_unreachable`, give all four + links explicitly or by an equivalently exact chain: (1) the safe call is + well-typed and valid; (2) its only body path reaches the executed + `unreachable_unchecked` call; (3) that call requires its site not to be + reached and that proposition is false; and (4) applicable Rust 1.80.0 std + documentation says reaching it is UB. + - `scope_basis`: necessary certificate for the requested soundness verdict + on the safe API. + - `dependencies`: Q1. +- **Q3 — Existential closure:** Report `Q-force-sound` **UNSOUND**. The complete + in-scope witness refutes universal soundness; do not weaken it to `UNPROVED` + merely because no universal positive proof was built. + - `scope_basis`: `REQUEST.md` asks for the strongest justified verdict. + - `dependencies`: Q2. +- **Q4 — Exact missing premise:** For `delegated_nonzero`, recognize that a + valid caller supplies the dependency API's nonzero caller precondition, but + the selected unsafe dependency body is absent and no accepted `UNSAFE-DEP` + entry establishes that it honors its contract. The pin and caller-facing + docs establish the logical coordinate and propagated obligation, not + authenticated implementation identity or correctness. The smallest missing + proposition is that every valid nonzero call to the selected + `peer-unsafe-dep` 3.4.5 implementation is UB-free over this domain. + - `scope_basis`: the supplied evidence packet and TCB policy are expressly + part of the requested dependency claim review. + - `dependencies`: Q1. +- **Q5 — No fabricated witness or silent trust:** Report + `Q-delegate-sound` **UNPROVED**, not `PROVED` or `UNSOUND`. Its required cases + lack the dependency-soundness premise, while the unavailable body supplies no + proved UB execution. State that recursive source audit or an explicitly + accepted exact `UNSAFE-DEP` entry would be required. + - `scope_basis`: `REQUEST.md` asks for the strongest packet-supported verdict + and smallest missing proposition. + - `dependencies`: Q4. + +## Hard errors + +- **QH1:** Call `force_unreachable` sound or only `UNPROVED` after establishing + all four Q2 links. +- **QH2:** Issue `UNSOUND` for it without a valid call, reachability, false exact + safety proposition, and authoritative UB consequence. +- **QH3:** Silently trust the unavailable unsafe dependency, treat the pin as + implementation proof, or report `delegated_nonzero` `PROVED`. +- **QH4:** Fabricate dependency body behavior or a UB execution and report + `delegated_nonzero` `UNSOUND`. +- **QH5:** Treat violation of the dependency's documented caller precondition + as itself an executed UB event. + +## Checked authority + +- `https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety` + — reaching `unreachable_unchecked` is UB; applicable to Rust 1.80.0 without a + target/profile qualification relevant here. + +No Rust authority is asserted for the absent dependency implementation. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/allowlist.txt new file mode 100644 index 0000000000..d467a88cf6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/allowlist.txt @@ -0,0 +1 @@ +https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/consistency.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/consistency.schema.json new file mode 100644 index 0000000000..04f2f75ba5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/consistency.schema.json @@ -0,0 +1,72 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-consistency-review-v1", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "mode", + "atom_family_attestations", + "defect_family_attestations", + "challenges", + "ambiguities" + ], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "atom_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["atom_id", "all_ten_reports_compared", "evidence"], + "properties": { + "atom_id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "defect_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["field", "all_ten_reports_compared", "evidence"], + "properties": { + "field": { + "type": "string", + "pattern": "^(hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "challenges": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "recommended_decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "recommended_decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/raw-scores/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/raw-scores/s1.json new file mode 100644 index 0000000000..70c98a5b44 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/raw-scores/s1.json @@ -0,0 +1,448 @@ +{ + "schema_version": 1, + "mode": "Q", + "scorer_id": "s1", + "reports": [ + { + "label": "C", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table gives safe force_unreachable calls no caller precondition, limits delegated_nonzero valid uses to value != 0, and says the APIs are separate claims." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's numbered certificate states valid public-safe invocation, unconditional reachability, falsity of the not-reached requirement, and the checked Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports F UNSOUND and explicitly calls the witness an existential refutation, not merely a failed universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the unchanged nonzero argument meets the peer precondition, notes the body and accepted UNSAFE-DEP entry are absent, and states the exact quantified provider-UB-freedom premise missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports D UNPROVED, rejects an invented UB witness, and requires recursive audit or an authorized exact UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Proposed repairs are expressly future changed artifacts requiring fresh audit and are not used for either current verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It consumes only the accepted exact Rust 1.80.0 URL proposition and conspicuously refuses unavailable dependency implementation trust." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report describes only supplied packet files and the permitted exact Rust URL; it disclaims binaries, dependency source, generated artifacts, and tools." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Its verdict table independently defines C1 as every safe invocation and C2 as unsafe invocations with value in 1..=255 satisfying value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1's proof gives a valid safe call, straight-line execution of unreachable_unchecked, the false unreachability proposition, and the applicable Rust 1.80.0 UB rule." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It concludes C1 UNSOUND across D and says the completed existential refutation is stronger than failure of a universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It derives the peer precondition from the wrapper contract and unchanged value, distinguishes the pin and documentation from implementation correctness, and quantifies the smallest missing UB-freedom proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It returns UNPROVED for C2, says no dependency UB witness is supplied, and identifies exact implementation audit or precise TCB acceptance as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Its repair suggestions are not treated as implemented evidence and it calls for a new audit after repair." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report uses the version-matched accepted std authority for C1 and expressly declines any peer implementation premise for C2." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It identifies only supplied artifacts and the allowed versioned Rust page and expressly says unavailable external artifacts were not inspected." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The Full valid-use domains section separately covers every well-typed safe force call and only delegated calls whose unsafe caller satisfies value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Its four-step F certificate explicitly connects valid safe use, necessary line-6 reachability, falsity of site-unreachability, and AXIOM-UU's Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports force_unreachable UNSOUND and says the four links close the required witness chain." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-CALL is proved from the identical nonzero contracts and unchanged value; D-SOUND remains the explicitly quantified missing exact-provider premise despite the version pin." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, rejects UNSOUND without a dependency execution, and requires exact recursive audit or accepted UNSAFE-DEP trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "No unimplemented proposal supports a current conclusion; suggested changes are coupled to re-audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is tied to the exact allowed Rust 1.80.0 page and the unavailable peer implementation is explicitly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Hashes concern supplied files, and the report limits external inspection to the permitted Rust citation while disclaiming source, builds, binaries, and tools." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claims table gives the safe API every well-typed invocation with no precondition and the unsafe API exactly nonzero u8 calls, then says the claims are separate." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "OBL-FORCE explicitly supplies valid safe invocation, immediate reachability, false unreachability, and the verified Rust 1.80.0 rule that reaching the function is UB." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It labels force_unreachable UNSOUND and describes the derivation as a complete existential certificate in every actual configuration." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the dependency call's nonzero precondition locally but leaves exact 3.4.5 provider correctness missing because no implementation, audit, or accepted trust exists." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED rather than fabricating behavior, and names exact implementation/generated-artifact audit or equally scoped accepted UNSAFE-DEP as the needed evidence." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Potential redesigns are presented only as future resolution and the report requires fresh audit of any changed artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its TCB log confines the std premise to the checked exact versioned URL and marks peer provider trust expressly not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It says no build, execution, expansion, dependency implementation, prior audit, or binary was inspected and uses only packet evidence plus the allowed URL." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdicts separately quantify every well-typed safe force call with no precondition and every unsafe delegated call with value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "CLAIM-FU's certificate enumerates valid use, unconditional reachability, the false not-reached proposition, and AXIOM-UR-180's applicable UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives CLAIM-FU the verdict UNSOUND and explicitly states that the valid safe use reaches the authoritative UB event." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "OBL-DN-LOCAL proves the unchanged nonzero argument; OBL-DN-IMPL states the exact quantified provider premise and explains why neither the declaration, pin, nor rejected trust supplies it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports CLAIM-DN UNPROVED, says the absent body cannot yield a UB execution, and requires exact recursive audit, local replacement, or precise accepted trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Repairs are prospective and are never certified as the supplied current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It uses the independently checked Rust 1.80.0 Safety section only for force and explicitly rejects relying on the unavailable peer body." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines the snapshot to supplied files and the permitted citation and says no lockfile, dependency source, prior audit, binary, or tool result is available or reused." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Its claims table gives C1 every safe call without a caller obligation and C2 only calls with value != 0, and the text calls them separate verdicts." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1/O1 supplies valid safe invocation, unconditional execution, falsity of the required unreachability, and the exact Rust 1.80.0 documentation's UB classification." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports C1 UNSOUND, explicitly not merely unproved, on the complete certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "C2/O2 proves the identical nonzero precondition, while O3 precisely quantifies missing 3.4.5 implementation UB-freedom and rejects pinning as provider proof." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports C2 UNPROVED, notes no dependency UB execution exists, and calls for exact recursive audit or an authorized precise UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "It does not rely on its suggested remediation; any implementation change is said to require audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact versioned Rust authority is applied only to O1, and unsafe-dependency trust is marked not proposed or accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "All named evidence is supplied packet material or the allowed exact URL, with unavailable implementation and tool evidence expressly excluded." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Claim F covers every safe invocation without a precondition, Claim D covers every nonzero valid unsafe invocation, and each is independently quantified over D." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "F-OBL-1 lists the public-safe witness, necessary execution, the false not-reached requirement, and AXIOM-UU's applicable Rust UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It declares force_unreachable UNSOUND and says the four-link certificate covers every configuration member." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-OBL-1 derives the peer precondition from valid use; D-OBL-2 identifies exact-provider UB-freedom as missing because body/audit/trust is absent and the pin proves no semantics." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, explicitly denies an existential counterexample, and requires implementation audit or exact human TCB acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested future resolution is not used as proof of the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is the verified exact Rust 1.80.0 proposition, while UNSAFE-DEP-345 is conspicuously rejected and not consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines itself to the supplied source/evidence and permitted citation and says no dependency internals, builds, binaries, or tools were used." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Required_F includes every well-typed safe call with no precondition; Required_D separately includes exactly unsafe calls with nonzero u8 values." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's numbered certificate explicitly gives valid use, unconditional line-6 reachability, falsity of unreachability, and AXIOM-UU-180's UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports force_unreachable UNSOUND and states each required configuration has the witness." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The local derivation proves the peer's nonzero precondition; DEP-SOUND exactly states provider UB-freedom and remains missing because body/generated output and accepted trust are absent." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, refuses UNSOUND without a valid execution, and identifies recursive exact-implementation audit or precise accepted UNSAFE-DEP as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "No suggested implementation or trust proposal is certified as already present." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact accepted Rust proposition is used within its version/domain, and the unavailable peer implementation proposition is expressly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports only the supplied snapshot and allowed Rust URL and expressly disclaims prior audits, dependency implementation, expansions, binaries, and tools." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "R_force covers well-typed safe calls without a precondition, while R_delegate independently covers only nonzero u8 calls satisfying the unsafe API contract." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "The force verdict row gives the valid safe expression, unconditional execution, false site-unreachability proposition, and AXIOM-UU-180's UB implication." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It assigns force_unreachable UNSOUND for every configuration on that complete certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The delegate row proves unchanged nonzero dataflow, then states the smallest missing universal UB-freedom premise for exact peer 3.4.5 and notes no accepted entry or body supplies it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, says absence of universal proof is no UB witness, and requires exact recursive audit or explicit precise UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Future remediation is not used to narrow or certify the current source obligation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report verifies and scopes the exact Rust 1.80.0 axiom and treats proposed dependency trust as rejected and non-consumable." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It identifies only supplied artifacts and the allowed citation and says no generated body, prior audit, test, build, or tool result was used." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The surface table and claims table independently define all safe force calls as valid and delegated calls as valid exactly when value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C-F's four numbered links state valid safe invocation, unconditional call-site reachability, falsity of the not-reached condition, and the exact Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives C-F UNSOUND and explicitly distinguishes this completed witness from mere failure to prove." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "C-D proves the identical nonzero caller obligation and unchanged forwarding, then precisely quantifies the missing exact-provider UB-freedom premise and explains why no packet fact entails it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports C-D UNPROVED, rejects UNSOUND without an executable counterexample, and requires recursive exact implementation audit or exact human UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Replacement and trust options are presented as future resolutions, not evidence for the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is version-matched, citation-checked, and applied only to force; missing dependency trust is explicitly rejected." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines review to submitted files and the allowed exact Rust authority and says no build, execution, expansion, dependency implementation, binary, or prior audit was inspected." + }, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/raw-scores/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/raw-scores/s2.json new file mode 100644 index 0000000000..d2344c1f9e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/raw-scores/s2.json @@ -0,0 +1,448 @@ +{ + "schema_version": 1, + "mode": "Q", + "scorer_id": "s2", + "reports": [ + { + "label": "I", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table separates safe force_unreachable calls with no precondition from delegated_nonzero calls restricted to nonzero values." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "CLAIM-FU gives valid safe use, unconditional sole-path reachability, falsity of the not-reached requirement, and Rust 1.80.0 UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports CLAIM-FU UNSOUND and calls the chain a completed existential certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the forwarded nonzero precondition but identifies the absent implementation and rejected UNSAFE-DEP premise as the exact provider-correctness gap." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports CLAIM-DN UNPROVED, rejects inventing a UB witness, and requires recursive audit or an accepted exact UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Remediation is explicitly presented as a changed snapshot requiring fresh audit, not evidence about the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report consumes only the exact Rust 1.80.0 unreachable_unchecked proposition and expressly rejects dependency implementation trust." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states that no dependency body, prior audit, binary, or tool result was used and evidences only supplied artifacts and the allowed URL." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "R_force has every well-typed safe call with no precondition, while R_delegate independently restricts valid calls to v in 1..=255." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "The force verdict gives a valid safe witness, unconditional execution, the false unreachable proposition, and AXIOM-UU-180's UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives force_unreachable the strongest verdict UNSOUND for every configuration." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "O2 proves unchanged nonzero dataflow; O3 states the exact unavailable 3.4.5 implementation's universal UB-freedom as the missing proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, says absence supplies no UB witness, and names recursive audit or precise UNSAFE-DEP acceptance as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested source changes and trust acceptance are future resolutions, not support for a current positive verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU-180 is exact and version-matched; the proposed dependency entry is explicitly rejected and not consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report disclaims use of dependency source, prior audits, tools, and generated artifacts and shows no prohibited evaluator access." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Claim F covers all safe invocations without a caller precondition; Claim D separately covers only nonzero-valid unsafe invocations." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F enumerates valid safe use, necessary execution, falsity of unreachability, and the applicable Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The report concludes Claim F is UNSOUND over the full symbolic domain." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-OBL-1 discharges nonzero locally, while D-OBL-2 identifies universal valid-call UB-freedom of the absent exact implementation as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED, not UNSOUND; the report requires exact recursive implementation audit or acceptance of the precisely scoped dependency premise." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report treats audit or trust acceptance only as future resolution and does not certify either unimplemented option." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It uses the checked versioned Rust proposition for Claim F and labels the exact dependency premise rejected and not admitted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports reviewing supplied files only and explicitly says no dependency body, prior audit, binary, or tool result was used." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Required_F includes every well-typed safe invocation without a precondition; Required_D separately includes nonzero values satisfying the unsafe contract." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Its numbered certificate explicitly supplies valid use, body reachability, the false not-reached requirement, and AXIOM-UU-180's UB classification." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "Claim F receives the explicit verdict UNSOUND over all Required_F." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The local derivation proves the identical nonzero precondition, then states DEP-SOUND for every valid exact-implementation execution as the missing premise." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED; no falsifying execution is invented, and exact implementation audit or accepted precise UNSAFE-DEP trust is required." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Proposed remediation is not used to narrow or certify the supplied implementation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Only the exact accepted Rust authority is consumed; dependency documentation is expressly not treated as provider-correctness evidence." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report says no dependency implementation, prior audit, expansion, binary, or tool result was reused and reveals no prohibited source access." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table independently defines C1 as all well-typed safe calls and C2 as unsafe calls with value in 1..=255." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1 supplies the valid direct safe call, unconditional control flow, false unreachability requirement, and applicable Rust 1.80.0 UB statement." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It concludes C1 is UNSOUND and explicitly distinguishes this from failure of a universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves unchanged nonzero forwarding but says the absent body and declined UNSAFE-DEP entry leave exact valid-call provider UB-freedom missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C2 is UNPROVED, with no fabricated UB witness, and resolution is recursive audit or explicit acceptance of the exact dependency proposition." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Repair and trust options are identified as requiring a new audit or explicit acceptance, not as current proof." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact versioned Rust proposition is used in its accepted region, while implementation trust is expressly absent." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It says no dependency implementation, generated output, binary, prior audit, or tool-derived result was supplied or inspected." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Domains F and D separately quantify all safe force calls and only nonzero-valid delegated calls." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's four numbered steps establish a valid call, unconditional execution, false site-unreachable proposition, and authoritative UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The report gives force_unreachable the explicit verdict UNSOUND." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-CALL proves nonzero forwarding, while D-SOUND is the exact implementation's universal UB-free behavior and remains unsupported." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "The delegated claim is UNPROVED; absence yields no execution or UB consequence, and recursive audit or accepted dependency trust is required." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Future repair and trust paths are not used as evidence for either current verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is exact, version-matched, and scoped to F-UB; PEER-IMPL is expressly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Hashing and naming supplied artifacts are in scope, and the report disclaims dependency source, prior audit, generated output, and tool evidence." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "C1 covers every well-typed safe call without a precondition; C2 separately covers calls satisfying value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1 explicitly identifies valid invocation, necessary call-site execution, falsity of the operation's requirement, and the exact Rust UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports C1 UNSOUND rather than merely unproved." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "O2 proves the identical nonzero precondition; O3 gives universal UB-freedom of exact version 3.4.5 as the smallest absent provider proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C2 is UNPROVED, no dependency UB execution is asserted, and the stated resolutions are exact recursive audit or authorized UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested API changes and dependency evidence are prospective and do not certify the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The accepted Rust entry has exact version, proposition, domain, and consumer; proposed dependency trust is not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report uses supplied artifact hashes and the allowed citation while disclaiming tools, dependency source, binaries, and prior audits." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claim table states all well-typed safe force invocations and, independently, all nonzero-valid delegated invocations." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "OBL-FORCE proves the valid safe witness reaches the operation, falsifies unreachability, and triggers the checked Rust 1.80.0 UB rule." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The force claim is explicitly UNSOUND in every nonempty required configuration fiber." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "OBL-DELEGATE-CALL proves the nonzero precondition, while OBL-DELEGATE-IMPL states exact universal provider UB-freedom as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, rejects a fabricated existential witness, and requires exact audit or accepted equally scoped trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Potential implementation or boundary changes are explicitly new artifacts needing fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact Rust 1.80.0 proposition is the only consumed authority and the dependency proposition is expressly not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report states no source was executed, built, expanded, or edited and no dependency implementation or prior audit was supplied." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "API-F permits every well-typed safe call; API-D independently requires value != 0 with no ongoing or terminal obligation." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C-F's four steps give valid safe use, sole-path reachability, the false not-reached requirement, and exact Rust 1.80.0 UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "C-F is reported UNSOUND, explicitly not merely a failure to prove." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves unchanged nonzero forwarding and states exact-version valid-call UB-freedom as the smallest proposition absent from source and TCB." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C-D is UNPROVED; the report declines an executable counterexample and requires recursive audit or exact human-accepted UNSAFE-DEP trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Replacement and trust options are framed only as minimal future resolutions." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is exact and citation-checked for its consumer; UNSAFE-DEP-345 is rejected and not admitted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines review to submitted source and evidence and says no build, execution, dependency implementation, binary, or prior audit was inspected." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claim table separately states all safe force calls with no precondition and delegated calls limited to value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F lists a valid safe invocation, immediate operation reachability, falsity of the exact safety proposition, and AXIOM-UU-180's UB result." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports Claim F UNSOUND and identifies the derivation as an existential refutation." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It closes the identical nonzero caller obligation but identifies exact selected-implementation UB-freedom for every valid call as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED, no implementation behavior is fabricated, and exact recursive audit or accepted precise UNSAFE-DEP trust is prescribed." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report does not consume any proposed repair as evidence for the supplied source." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The allowed Rust 1.80.0 authority is used only for Claim F, and the absent dependency premise is not trusted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It limits itself to supplied files and the allowed Rust page and disclaims binaries, generated artifacts, tools, and dependency implementation access." + }, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/A.md new file mode 100644 index 0000000000..ec0057b4af --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/A.md @@ -0,0 +1,57 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, and domain + +The audited artifact is the submitted `lib.rs` for `quantifier-target` 0.1.0, edition 2021, together with `Cargo.toml`, `DEPENDENCY-API.md`, `EVIDENCE.md`, and `TCB.md`. The manifest pins `peer-unsafe-dep = "=3.4.5"`. No dependency implementation, generated output, binary, prior audit, or tool-derived result was supplied or inspected. + +Let + +`D = {(t,p) | Rust/stdlib = 1.80.0, this source and peer-unsafe-dep 3.4.5 resolve on target t, and p is an ordinary debug or ordinary release profile}`. + +This is the controlling `Required` predicate from `REQUEST.md`; it is retained symbolically rather than replaced by an unproved target inventory. There are no `cfg`, feature, generated-source, target, or profile branches in `lib.rs`. Thus its two function bodies are identical throughout `D`. The exact dependency implementation may vary only within the resolution already quantified by `D`; its absence matters to Claim 2. Audit cutoff: this submitted source/evidence snapshot on 2026-08-01. + +The complete exported surface is the safe free function `force_unreachable` and unsafe free function `delegated_nonzero`. There are no exported fields, constructors, types, traits/impls, statics, macros, hidden items, callbacks, FFI declarations, or owned representation invariants in the submitted source. + +## Verdicts + +| Claim | Valid-use domain | Compilation domain | Verdict | +|---|---|---|---| +| C1: every permitted execution of `force_unreachable()` is free of Rust UB | Every well-typed safe invocation; there is no caller safety precondition | `D` | **UNSOUND**, on every member of `D` | +| C2: every permitted execution of `delegated_nonzero(value)` is free of Rust UB | Unsafe invocations with a valid `u8` value satisfying the complete documented obligation `value != 0`, i.e. `value in 1..=255`; no ongoing or terminal obligation is documented | `D` | **UNPROVED** | + +## C1 proof and UB certificate + +`lib.rs:4` exposes `force_unreachable` as safe. Therefore a safe caller may directly invoke it, and that invocation is a valid in-scope use. Its body has no branch, check, argument, callback, or earlier operation: control reaches the call to `std::hint::unreachable_unchecked()` at `lib.rs:6`. + +Accepted TCB entry **AXIOM-UU-180** is the verified Rust 1.80.0 standard-library Safety statement: “Reaching this function is Undefined Behavior.” ([exact versioned page](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). The submitted evidence and accepted trust decision give this proposition every-target/ordinary-profile applicability, hence all of `D`. + +Thus, for each `(t,p) in D`: (1) a direct safe call is valid; (2) source control flow necessarily executes the unsafe operation; (3) its required proposition, that the call site is unreachable, is false because the invocation reached it; and (4) AXIOM-UU-180 entails UB. This is a complete existential refutation for each configuration, stronger than merely failing a universal proof. The `SAFETY` comment “assumed to be unreachable” supplies no premise and is contradicted by the public safe entry path. + +Minimum repair: remove the unchecked operation (for example, use a defined panic path) or establish an actually enforced control-flow invariant before it. Documentation alone cannot impose a hidden precondition on this safe API. + +## C2 derivation and smallest gap + +For every valid C2 call, `value != 0` holds by the exported unsafe contract at `lib.rs:11-14`. The wrapper passes that same, unchanged `value` to `peer_unsafe_dep::duplicate_nonzero` at `lib.rs:17`. The submitted exact 3.4.5 dependency declaration requires precisely `value != 0`. Therefore the local caller-side safety obligation for the dependency call is proved throughout `D`; the adjacent `SAFETY` comment accurately states this part. + +That is not a proof of the unsafe dependency provider. A third-party unsafe call additionally requires the exact implementation to uphold its contract for every valid call. `DEPENDENCY-API.md` expressly says its implementation and generated output are absent and supplies no assertion about its body. `TCB.md` expressly declines any `UNSAFE-DEP` admission for 3.4.5. An exact pin establishes identity, not undocumented implementation correctness. + +The smallest missing soundness proposition is: + +> For every `(t,p) in D` and every `v in 1..=255`, every permitted execution of the exact resolved `peer-unsafe-dep` 3.4.5 implementation of `duplicate_nonzero(v)` is free of Rust undefined behavior. + +Neither source proof nor an accepted TCB entry entails it. No valid UB witness against that implementation is supplied, so **UNSOUND** is not justified; failure of the universal derivation yields **UNPROVED**. Resolution requires either a recursive audit of the exact dependency implementation/generated artifact over `D`, or explicit human acceptance of that precise `UNSAFE-DEP` proposition. + +The wrapper documents no result-equals-input postcondition; it only syntactically forwards the callee result. The dependency documentation separately says it returns `value`. That dependency postcondition is also **UNPROVED** for the same missing implementation evidence, though it is not needed to prove the wrapper’s caller-side precondition. + +## Obligation and trust closure + +| Obligation | Premises/coverage | Status | +|---|---|---| +| O1: safe C1 callers reach no UB | local unconditional call + AXIOM-UU-180, all `D` | Refuted; C1 UNSOUND | +| O2: C2 establishes callee precondition | exported `value != 0` contract + unchanged argument, all `D` | PROVED | +| O3: exact unsafe dependency honors its safety contract | implementation proof or accepted `UNSAFE-DEP` required; neither supplied | UNPROVED; blocks C2 | +| O4: dependency honors “Returns value” | same missing provider evidence | UNPROVED | + +TCB revision is the supplied `TCB.md`: AXIOM-UU-180 is accepted; unsafe-dependency, implementation, compatibility, tool, and deployment premises are absent. No testing evidence contributes. Aggregate coverage is all `D` for the C1 refutation and O2, but O3 covers no established region, so `Required subseteq Covered` cannot be certified for C2. + +Re-audit is required if either function or its documentation changes; the supported Rust/target/profile predicate changes; the Rust authority changes; the dependency identity, contract, features, implementation, or generated output becomes available or changes; or the TCB trust decision changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/B.md new file mode 100644 index 0000000000..f43cd2c513 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/B.md @@ -0,0 +1,130 @@ +# Focused source-only unsafe Rust review + +## Claim, snapshot, and domain + +Audited artifacts are `lib.rs` (SHA-256 +`778d644359b84bc0e519ed7220bfcadfbba578e2c9fd4c474ce742c4b0021ceb`) and +`Cargo.toml` (SHA-256 +`57b66359b9447d371fa68a2cfdc04f49176b1a3ce815bb96027b2f76d917d0a7`), +package `quantifier-target` 0.1.0, edition 2021. The manifest exactly pins +`peer-unsafe-dep =3.4.5`; the submitted declaration/contract is available, but +its source, generated output, build behavior, prior audit, and binary are not. + +Let `T = { t | this source and the exact peer dependency resolve for target t }` +and `P = {ordinary-debug, ordinary-release}`. The exact configuration domain is +`Required_cfg = {Rust 1.80.0} × T × P`, directly from `REQUEST.md`; no finite +enumeration of `T` is asserted. There are no features, `cfg` branches, +generators, build scripts, macros, target operations, or profile-sensitive +checks in the submitted crate source. Thus the local source is selected +uniformly and the arguments below are parametric in `(t,p) ∈ T×P`. Unknown +dependency configuration remains material to the second claim. + +The full valid-use domains are: + +* `F`: each `(t,p)` above and every otherwise-valid, well-typed safe execution + that invokes `force_unreachable()`; a safe API has no hidden caller safety + precondition. +* `D`: each `(t,p)` above, every `value ∈ 1..=255`, and every execution whose + caller invokes unsafe `delegated_nonzero(value)` while satisfying its sole + documented safety obligation, `value != 0`. + +The claims concern source-level freedom from Rust undefined behavior under Rust +1.80.0 abstract semantics. Compiler/backend correctness and broader behavior +not documented by these APIs are excluded. No test, build, execution, or tool +result is evidence. + +## Evidence and TCB log + +TCB identity is the supplied `TCB.md`, SHA-256 +`86796b85804436595c0f6ffbfa773dac4fce5cbfe28e02223c802a055037d0f4`. + +* **AXIOM-UU (accepted, Rust authority):** Rust 1.80.0 documents + `unreachable_unchecked` as: “Reaching this function is *Undefined Behavior*.” + The exact [Safety section](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety) + was opened and verified. The supplied authority makes this applicable to all + `(t,p) ∈ T×P`. Consumer: `F-UB`. Re-audit on Rust version or cited-contract + change. +* **PEER-IMPL (expressly unaccepted):** no proposition about what + `peer-unsafe-dep` 3.4.5 executes is admitted. In particular, the human + reviewer declined an `UNSAFE-DEP` entry. Its exact pin freezes a version; its + documentation establishes the caller contract, not implementation + correctness. Consumers blocked: `D-SOUND` and, if relied upon, `D-RET`. + Re-audit on dependency identity, source/features/generated output, contract, + implementation audit, or trust decision change. + +There are no other admitted implementation, compatibility, deployment, or tool +premises. + +## Boundary and obligation inventory + +The complete exported surface is the safe free function `force_unreachable` +and unsafe free function `delegated_nonzero`. There are no exported fields, +types, constructors, methods, traits/impls, statics, macros, hidden APIs, +callbacks, FFI items, or owned representation invariants. Nonzeroness in `D` +is a per-call precondition, not a type invariant. + +| ID | Site | Exact obligation | Disposition | +|---|---|---|---| +| `F-UB` | `lib.rs:6` | Execution must not reach `unreachable_unchecked`. | False on every invocation. | +| `D-CALL` | `lib.rs:17` | The value passed to the peer must be nonzero. | PROVED for all `D`. | +| `D-SOUND` | peer call | The exact peer implementation must be UB-free for every valid call. | UNPROVED. | +| `D-RET` | peer contract | The exact peer implementation returns its input for every valid returning call. | UNPROVED; not needed for wrapper soundness. | + +## Claim F — `force_unreachable` + +**Verdict: UNSOUND** over `F`, relative to `AXIOM-UU`. + +Existential UB certificate (indeed parametric over every supported +configuration): + +1. `force_unreachable()` is public and safe, so calling it from an + otherwise-valid safe execution is a valid in-scope use. +2. Its body has no condition or earlier exit; that call reaches line 6 and + executes `std::hint::unreachable_unchecked()`. +3. That site's required proposition—“the site is unreachable”—is false in this + execution precisely because step 2 reaches it. +4. `AXIOM-UU`, applicable to Rust 1.80.0 on every `(t,p)`, entails undefined + behavior. This closes the required witness chain. + +The existing safety comment merely assumes the needed conclusion and is false +for every invocation; it is both proof-artifact deficient and accompanies an +implementation defect. Replacing the operation with defined safe behavior +(for example, a panic), or changing the API and contract so invocation itself +has an enforceable unsafe obligation, requires a new audit. No UB-containing +execution establishes `CONTRACT-BROKEN`, and none is claimed. + +## Claim D — `delegated_nonzero` + +**Verdict: UNPROVED** for soundness over `D`, relative to the supplied TCB. + +The local call obligation is complete: valid use gives `value != 0`; line 17 +passes that same unmodified `u8` to `duplicate_nonzero`; the submitted peer +contract requires exactly `value != 0`. Thus `D-CALL` covers all of `D`, and +the adjacent safety comment correctly explains this caller-side step. + +That is insufficient for a third-party unsafe API. The smallest missing +soundness proposition is: + +> For the exact `peer-unsafe-dep` 3.4.5 implementation selected in every +> `(t,p) ∈ T×P`, and every `v ∈ 1..=255`, executing +> `duplicate_nonzero(v)` is free of Rust undefined behavior. + +Neither submitted source/evidence proves this proposition nor an accepted +`UNSAFE-DEP` entry admits it. Therefore aggregate `Covered` lacks `D-SOUND` and +`Required_D ⊆ Covered_D` cannot be derived. Absence of the implementation also +provides no valid execution, false safety proposition, or UB consequence, so +`UNSOUND` is not established. + +The wrapper does not explicitly promise that its return equals `value`; the +peer documentation does. If that provider guarantee is intended to be exposed +or consumed, the additionally missing proposition is that the exact peer +implementation returns `v` for every valid returning call. No UB-free +counterexample is supplied, so `CONTRACT-BROKEN` is not established. + +## Aggregate result and review triggers + +The two claims remain separate: `F` is **UNSOUND** and `D` is **UNPROVED**; no +combined `PROVED` result exists. Re-audit on any audited-source or contract +change, Rust/toolchain or target/profile-policy change, dependency resolution, +feature/source/generated-artifact change, accepted TCB change, or newly +available peer implementation audit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/C.md new file mode 100644 index 0000000000..44b850bbaa --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/C.md @@ -0,0 +1,129 @@ +# Focused unsafe-Rust source review + +## Snapshot, scope, and domain + +Audited at 2026-08-01: the exact supplied `lib.rs` and `Cargo.toml` for +`quantifier-target` 0.1.0, plus the submitted contracts and trust decision in +`DEPENDENCY-API.md`, `EVIDENCE.md`, and `TCB.md`. The manifest selects edition +2021 and exactly `peer-unsafe-dep =3.4.5`. This is only a source-level Rust +abstract-semantics review; no binary, backend, dependency implementation, or +generated artifact was available or claimed. + +Let `T = { t | this exact source and peer-unsafe-dep 3.4.5 resolve for target +t under Rust 1.80.0 }`, and `P = {ordinary debug, ordinary release}`. The exact +compilation domain is + +`D = {exact supplied source, edition 2021, Rust/stdlib 1.80.0, dependency +resolution peer-unsafe-dep =3.4.5, t in T, p in P}`. + +This is the controlling expression from `REQUEST.md`, conjoined only with +identities stated by the manifest; hence the normalization is equality, not an +inferred exclusion. `T` is deliberately retained symbolically. `lib.rs` has no +`cfg`, feature, target, profile, assertion, macro, generated-code, allocator, +FFI, concurrency, or build-script branch. Consequently the source reasoning +below is parametric in `t` and `p`; no target inventory is needed. + +The complete exported surface is the safe free function +`force_unreachable()` and unsafe free function `delegated_nonzero(u8) -> u8`. +There are no exported fields, types, traits, methods, statics, macros, +reexports, or hidden items, and no invariant-bearing state. + +## Claims and verdicts + +| Claim | Exact valid-use theorem over `D` | Verdict | +|---|---|---| +| F | Every well-typed safe call of `force_unreachable()` (no caller safety precondition) is free of Rust UB. | **UNSOUND** | +| D | For every `value: u8` with `value != 0` (the sole initial safety obligation; no ongoing or terminal obligation), every call of `delegated_nonzero(value)` is free of Rust UB. | **UNPROVED** | + +For D, the dependency's documented normal-return postcondition, “Returns +`value`,” is also **UNPROVED**, not `CONTRACT-BROKEN`. + +## TCB and evidence disposition + +`AXIOM-UU-180` is accepted exactly as authorized in `TCB.md`. The opened Rust +1.80.0 standard-library Safety section says: “Reaching this function is +Undefined Behavior.” It states no narrower target/profile qualification: +[`std::hint::unreachable_unchecked`](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). +It is consumed only by Claim F and applies throughout `D`. + +The submitted dependency declaration and caller contract identify the callee +and its precondition; they do not establish its implementation's correctness. +No `UNSAFE-DEP` proposition for `peer-unsafe-dep` 3.4.5 is accepted. The human +trust decision expressly rejects relying on its unavailable implementation. +There are no other admitted implementation, compatibility, tool, deployment, +or probabilistic premises. No tests or tool-derived evidence were supplied or +used. + +## Proof and obligation ledger + +### Claim F — complete UB certificate + +1. **Valid in-scope use.** In every case in `D`, downstream safe code may call + the public safe function `force_unreachable()`; its type and documentation + impose no safety precondition. +2. **Reachability.** On entry, lines 4–6 have no check, branch, earlier + divergence, or caller-controlled condition. The body immediately evaluates + `std::hint::unreachable_unchecked()`; thus that operation is reached by the + valid call. +3. **False required proposition.** `AXIOM-UU-180` requires that the function not + be reached. Step 2 proves the opposite. +4. **UB consequence.** `AXIOM-UU-180` directly entails UB on reaching it. + +These local facts are source-identical for every `t in T` and `p in P`, and the +axiom covers that whole domain. Thus each compilation case in `D` has the same +valid safe-call witness. This is an existential refutation, so the verdict is +`UNSOUND`, not merely a failed universal proof. The line-5 comment—“This site +is assumed to be unreachable”—is circular and false for the exported safe +entrypoint; it proves no obligation. There is no defined normal-return +execution from which to certify a separate return postcondition. + +### Claim D — local call proof closes; provider proof does not + +The controlling wrapper contract requires `value != 0`. The submitted exact +callee contract requires the identical proposition. For every valid wrapper +call, that fact follows directly from the wrapper's unsafe precondition, and +line 17 passes the same `u8` unchanged. Therefore the dependency call's entire +documented caller-side precondition is proved throughout `D`. Lines 15–16 +correctly summarize this local implication. + +The remaining soundness obligation is not a caller precondition: the selected +dependency implementation must honor its unsafe API contract. The smallest +missing proposition is: + +> For the exact resolved implementation of `peer-unsafe-dep` 3.4.5, every +> execution of `duplicate_nonzero(v)` with `v: u8` and `v != 0` is free of Rust +> UB, for every target/profile case in `D`. + +Neither inspected source nor an accepted `UNSAFE-DEP` entry proves it. An exact +version pin freezes identity but does not establish this semantic proposition. +Because no dependency body or trusted implementation fact exists, there is +also no proved valid execution reaching a false safety proposition and hence +no `UNSOUND` certificate. Aggregate coverage is therefore incomplete: +`Required_D` is covered for caller-precondition discharge but not for provider +correctness, so `Required_D` is not contained in complete `Covered_D`. + +The separate smallest missing postcondition proposition is that every normal, +UB-free valid call to that exact implementation returns `v`. Without it there +is no wrapper result proof; without an independently established UB-free +falsifying execution there is no `CONTRACT-BROKEN` certificate. + +## Findings, resolution, and residual scope + +- **F-1, implementation defect:** `force_unreachable` exposes unconditional UB + through safe code. A comment cannot repair it. Replace the unchecked + operation with defined behavior such as `unreachable!()`/panic, remove the + entrypoint, or otherwise enforce a sound boundary; then audit the new + artifact. Changing safe behavior or safety classification requires API + compatibility review. +- **D-1, missing dependency proof/TCB:** recursively audit the exact 3.4.5 + implementation over `D`, or obtain authorized acceptance of a precise + `UNSAFE-DEP` entry covering both UB freedom and, if promised, return-value + correctness. Re-audit after any dependency identity, contract, feature, + target/profile support, or trust-decision change. + +Unavailable and therefore excluded from any affirmative claim are the +dependency implementation/generated output, compiler/backend correctness, +binaries, and deployment behavior. Re-audit is also required for changes to +`lib.rs`, the manifest/domain, Rust version or cited authority, exported +surface, or supplied evidence. Every in-scope obligation has the status above; +the combined two-API soundness result is **F: UNSOUND; D: UNPROVED**. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/D.md new file mode 100644 index 0000000000..55398ad246 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/D.md @@ -0,0 +1,57 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, and domain + +Audited snapshot: the submitted `lib.rs`, `Cargo.toml`, dependency contract, evidence policy, and TCB decision. The package is edition 2021 and fixes `peer-unsafe-dep` to exactly 3.4.5. No generated/expanded artifact, dependency body, prior audit, lockfile, build script, feature, conditional source, or test/tool result was supplied or used. This is a Rust-abstract-semantics source claim, not a compiler-binary claim. Audit cutoff: 2026-08-01. TCB log ID: `TCB-SUBMITTED-1`. + +Let + +`C = {Rust compiler and std 1.80.0} × T_resolve × {ordinary debug, ordinary release}`, + +where `T_resolve` is exactly every target on which this source and exact dependency resolve. This is `Required_cfg` by literal transcription of `REQUEST.md`: each member of either set satisfies precisely those three conjuncts, proving both containments and hence equality. Edition 2021, dependency identity 3.4.5, and the submitted source are fixed rather than varying axes. There is no `cfg` or profile-sensitive branch; both proofs below are parametric in target and profile, so no enumeration of `T_resolve` is needed. + +For a full case, retain configuration, input, call validity, and permitted execution: + +- `R_force(c,e) := c∈C ∧ e is a permitted execution of a well-typed safe call to force_unreachable()`; there is no caller safety precondition. +- `R_delegate(c,v,e) := c∈C ∧ v∈{1,…,255} ∧ e is a permitted execution of delegated_nonzero(v)`; `v != 0` is its sole documented initial safety obligation, with no ongoing or terminal obligation. + +## Verdicts + +| Claim | Strongest verdict | Certificate or smallest gap | +|---|---|---| +| `force_unreachable` soundness over `R_force` | **UNSOUND**, for every `c∈C` | For each `c`, the safe expression `force_unreachable()` is a valid witness. `lib.rs:4-6` enters the function and unconditionally executes `std::hint::unreachable_unchecked()`. `AXIOM-UU-180` says reaching that function is UB. Thus valid safe use → reachability → false required proposition (“the call site is unreachable”) → UB. | +| `delegated_nonzero` soundness over `R_delegate` | **UNPROVED** | `lib.rs:14-17` passes unchanged `v` to the dependency. From `R_delegate`, `v != 0`, exactly discharging the submitted callee precondition. The remaining smallest missing proposition is: for every `c∈C`, every nonzero `v:u8`, and every permitted execution, `peer-unsafe-dep` 3.4.5's `duplicate_nonzero(v)` is UB-free. Its implementation is unavailable and that proposition has no accepted TCB entry. Absence of this universal proof supplies no UB witness, so `UNSOUND` is not justified. | + +The first verdict is profile- and target-independent: the same unconditional call is selected, and the authority applies throughout `C`. The source comment “This site is assumed to be unreachable” proves nothing and is contradicted by every invocation: entry into this zero-argument function dominates the call. + +For the second API, the adjacent safety comment adequately proves only the caller-side precondition of the unsafe dependency call. It cannot prove provider correctness. The API's literal description of delegation is established syntactically: line 17 calls the selected function with the unchanged argument and directly yields its normal result. It does not state `result == value`. The dependency documentation separately promises “Returns `value`”; that dependency postcondition is likewise unproved without its implementation or an accepted `UNSAFE-DEP` proposition, is not promoted into the wrapper contract, and is not needed for the wrapper soundness argument. + +## Boundary and obligation inventory + +The complete exported surface in the supplied source is two public free functions: safe `force_unreachable` and unsafe `delegated_nonzero`. No public fields, types, constructors, methods, trait surfaces/implementations, callbacks, macros/generated APIs, hidden items, FFI, state, or destruction path is present. There is no invariant-bearing representation. + +| ID | Site | Exact obligation | Domain | Status | +|---|---|---|---|---| +| O1 | `lib.rs:6` | The `unreachable_unchecked` site is not reached. | Every `R_force` case | **False**; every call reaches it. | +| O2 | `lib.rs:17` | Argument to `duplicate_nonzero` is nonzero. | Every `R_delegate` case | **PROVED**: `v∈{1,…,255}` and unchanged dataflow imply `v != 0`. | +| O3 | dependency call at line 17 | Exact dependency implementation is UB-free for valid calls. | Every `R_delegate` case | **UNPROVED**; `F-DEP`. | +| O4 | wrapper description | Invoke selected peer with `v` and yield its normal result. | Every normally returning `R_delegate` case | **PROVED** directly by line 17; no provider return-value equality inferred. | + +For `force_unreachable`, the existential certificate settles soundness while all independent sites above remain inventoried. For `delegated_nonzero`, aggregate `Covered = Covered(O2) ∩ Covered(O3)`; O2 covers all `R_delegate`, but O3 has no established cases, so `Required ⊆ Covered` is not proved. + +## TCB and evidence audit + +| ID | Category/disposition | Exact proposition, scope, source, consumer | +|---|---|---| +| `AXIOM-UU-180` | AXIOM / accepted by submitted human decision; citation independently verified | Rust 1.80.0 std states: “Reaching this function is Undefined Behavior.” It applies on every required target/profile. Source: [`unreachable_unchecked` Safety](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). Consumer: O1. Re-audit on Rust version, supported domain, source, or material documentation change. | +| `UNSAFE-DEP-345` | UNSAFE-DEP / expressly rejected, not consumable | Proposed proposition would be the O3 universal provider-correctness statement for exact package 3.4.5. The exact pin establishes identity only. No body, recursive audit, generated output, binary, or out-of-band promise supports it. Consumer blocked: O3. | + +No safe-dependency, tool, implementation, compatibility, deployment, or probabilistic premise is admitted. The packet-supplied dependency declaration establishes the caller contract under review, not implementation correctness. No tool-derived evidence exists. + +## Findings and resolutions + +`F-FORCE` (critical, **UNSOUND**): a public safe API unconditionally executes an operation whose checked contract says reaching it is UB. The local proof artifact is false, not merely incomplete. Minimal resolution: remove the unsafe call and use defined behavior such as a panic, or redesign control flow so a real dominating invariant proves the site unreachable. No truthful `SAFETY` rewrite can validate the current body. + +`F-DEP` (**UNPROVED**): provider correctness of third-party unsafe code is hidden trust that the reviewer declined. Resolve by supplying and recursively auditing the exact 3.4.5 implementation for all `C`, or by explicit human acceptance of a precise `UNSAFE-DEP` entry covering O3 (and the dependency's return-equality promise if that promise is to be relied upon). Re-audit both the call contract and provider proof on dependency identity, feature/configuration, or contract change. + +Residual scope is exactly the unavailable dependency implementation and its generated/build inputs. Changes to either API/source documentation, Rust/std version, supported targets/profiles, dependency resolution or API, TCB disposition, or newly supplied generated/tool evidence trigger re-audit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/E.md new file mode 100644 index 0000000000..bb68e8b3f5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/E.md @@ -0,0 +1,127 @@ +# Focused unsafe-Rust source audit + +Reviewed 2026-08-01. This report concerns the submitted `lib.rs`, manifest, +dependency contract, evidence policy, and TCB only. It is a source-level review; +no build, execution, expansion, dependency implementation, binary, or prior +audit was inspected. + +## Domain, snapshot, and boundary + +Let `Dcfg(c)` mean: the compiler and standard library are exactly Rust 1.80.0, +the crate uses edition 2021, the profile is an ordinary debug or release +profile, and the target is one on which this exact source and +`peer-unsafe-dep = 3.4.5` resolve. This is exactly the support expression in +`REQUEST.md:8-11`, with dependency identity fixed by `Cargo.toml:6-7` and +`DEPENDENCY-API.md:3-4`; no target enumeration is inferred. The source contains +no `cfg`, feature, generator, macro, target, or profile branch, so both source +paths below are parametric over every `c` in `Dcfg`. Dependency internals may +still vary and are not silently covered. + +The complete exported surface in the submitted source is: + +| ID | Surface | Boundary | +|---|---|---| +| API-F | `pub fn force_unreachable()` (`lib.rs:4-7`) | Safe: every well-typed safe call is valid; there is no caller safety obligation. | +| API-D | `pub unsafe fn delegated_nonzero(value: u8) -> u8` (`lib.rs:9-18`) | Unsafe: a call is valid exactly when `value != 0`; no ongoing or terminal obligation is documented. | + +There are no representation fields, constructors, traits/impls, callbacks, +reexports, hidden items, generated APIs, or state invariants in the supplied +source. The two calls at `lib.rs:6` and `lib.rs:17` are the complete unsafe-site +inventory. + +## Claims and strongest verdicts + +| Claim | Exact full valid-use domain | Verdict | +|---|---|---| +| C-F | Every `(c, call)` with `c in Dcfg` and any well-typed safe invocation of `force_unreachable()` | **UNSOUND** | +| C-D | Every `(c, v, state, execution)` with `c in Dcfg`, `v: u8`, `v != 0`, and every permitted execution of `delegated_nonzero(v)` | **UNPROVED** | + +### C-F — complete existential UB certificate + +1. **Valid use.** `force_unreachable` is exported as a safe, zero-argument + function. Thus `force_unreachable()` is a valid safe invocation for any + `c in Dcfg`; the packet states an exact resolved dependency, so the declared + supported set is not being replaced by an invented configuration. +2. **Reachability.** On entry, the body has no condition or alternative exit: + its first and only statement calls `std::hint::unreachable_unchecked()` + (`lib.rs:4-6`). Therefore that call site is reached. +3. **False required proposition.** The callee requires that it not be reached; + step 2 proves the opposite. The comment “This site is assumed to be + unreachable” is an unsupported assumption and is directly falsified by the + safe-call witness. +4. **UB consequence.** The checked Rust 1.80.0 standard-library Safety text + states: “Reaching this function is Undefined Behavior.” + ([exact versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). + The page identifies Rust 1.80.0 and gives no narrower target/profile + qualification. Hence the witness reaches UB for every `c in Dcfg`. + +This establishes `UNSOUND`, not merely failure to prove. The UB-containing +execution cannot establish a separate contract-broken witness. No broader safe +API behavior was requested. Minimal remediation is to remove +`unreachable_unchecked` (for example, use a defined panic) or introduce a real +compiler-enforced unsafe boundary with a sufficient contract. + +### C-D — proved forwarding obligation; smallest missing proposition + +The controlling wrapper precondition is exactly `v != 0` (`lib.rs:11-14`). The +submitted dependency contract requires exactly the same proposition +(`DEPENDENCY-API.md:9-12`). For every valid wrapper call, substitution of the +same unchanged `value` into the direct call at `lib.rs:17` therefore proves the +dependency caller-side safety precondition. It also proves the wrapper's stated +delegation behavior: the selected function is called with that same value. +There is no branch, mutation, state invariant, or configuration-dependent +source path. The adjacent comment correctly records this local implication. + +That implication is insufficient to prove wrapper soundness. A third-party +unsafe API additionally requires proof that its exact implementation honors its +contract for every valid call. The smallest missing proposition is: + +> For every `c in Dcfg` and every `v: u8` with `v != 0`, every permitted +> execution of the exact `peer-unsafe-dep` 3.4.5 +> `duplicate_nonzero(v)` implementation is free of Rust undefined behavior. + +No supplied fact entails it: `DEPENDENCY-API.md:15-17` says the implementation +and generated output are absent and supplies no body assertion; `TCB.md:5-7` +expressly declines an `UNSAFE-DEP` entry. Absence of such a universal proof does +not prove an executable counterexample, so `UNSOUND` is not justified. The +dependency documentation also says “Returns `value`”; if that provider +postcondition is treated as a wrapper return guarantee, its implementation +proof is missing for the same reason. The wrapper itself does not explicitly +document a return-value postcondition. + +Minimal resolution is either a recursive audit proving the proposition over +all `Dcfg`, or human acceptance of that exact proposition as an +`UNSAFE-DEP` TCB entry. An exact version pin freezes identity but supplies +neither result. Replacing the delegation with a locally proved safe operation +would remove this trust requirement. + +## Obligation and TCB reconciliation + +| Obligation | Status | Basis | +|---|---|---| +| O-F1: do not reach `unreachable_unchecked` | **Refuted** | C-F steps 1-3 | +| O-F2: reaching it entails UB | **Proved** | AXIOM-UU below | +| O-D1: pass nonzero to dependency | **Proved** | Wrapper contract plus unchanged dataflow | +| O-D2: exact unsafe dependency is UB-free for every valid call | **Unproved** | Missing/rejected UNSAFE-DEP proposition | +| O-D3: invoke selected peer with the same value | **Proved** | Direct call expression at `lib.rs:17` | + +**TCB-SUBMITTED revision:** the supplied `TCB.md`. + +| ID | Category/disposition | Exact proposition and scope | Consumer/trigger | +|---|---|---|---| +| AXIOM-UU | AXIOM, accepted and independently citation-checked | On Rust 1.80.0 across `Dcfg`, reaching `std::hint::unreachable_unchecked` is UB. | O-F2; recheck if Rust version/domain or cited text changes. | +| UNSAFE-DEP-345 | UNSAFE-DEP, rejected/not admitted | The missing O-D2 proposition above. | Blocks C-D; revisit on implementation audit or explicit trust decision. | + +No tool-derived evidence or other accepted implementation, compatibility, +deployment, or dependency premise exists. The dependency contract is controlling +API text, not evidence that its unavailable unsafe implementation fulfills it. + +## Residual scope and re-audit triggers + +Dependency source/generated output, binaries, compiler/backend correctness, +custom profiles, targets outside `Dcfg`, and behavioral properties not stated +above remain unaudited. Re-audit on any source or safety-contract change, +dependency identity/implementation/trust change, Rust or support-domain change, +or newly supplied generated artifact or evidence. Every in-scope surface and +unsafe site has a disposition; C-F has the required existential certificate, +while C-D remains fail-closed at its single explicit missing premise. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/F.md new file mode 100644 index 0000000000..019b26bd42 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/F.md @@ -0,0 +1,65 @@ +# Focused unsafe-Rust audit + +## Claims, domain, and verdicts + +**Snapshot.** This review covers exactly the submitted `quantifier-target` 0.1.0 source (`lib.rs`, edition-2021 `Cargo.toml`) and the submitted contracts/evidence. The manifest pins `peer-unsafe-dep = "=3.4.5"`; no dependency implementation, generated output, digest, binary, or prior audit was supplied. No source was executed, built, expanded, or edited. + +Define `T = {t | this exact source and peer-unsafe-dep 3.4.5 resolve on target t}`, `P = {ordinary debug, ordinary release}`, and + +`C = {Rust/compiler/stdlib 1.80.0, edition 2021, target t ∈ T, profile p ∈ P, exact submitted source and dependency resolution}`. + +This is the controlling compilation predicate stated by `REQUEST.md`, preserved symbolically rather than replaced by a sampled target inventory. There are no crate features, `cfg` branches, build scripts, or generated sources in the submitted crate. Both source paths are therefore parametric in `t` and `p`; optimization, debug assertions, and overflow checks do not alter either straight-line call. Dependency implementation behavior remains unavailable in every relevant fiber. + +| Claim | Exact valid-use domain | Verdict | +|---|---|---| +| `force_unreachable` soundness | For every `c ∈ C`, every well-typed safe invocation in any permitted caller state; there is no caller safety precondition. | **UNSOUND**, in every nonempty configuration fiber of `C`. | +| `delegated_nonzero` soundness | For every `c ∈ C`, every `value: u8` with `value != 0`, and every permitted execution of the unsafe call. That is its sole documented initial obligation; no ongoing or terminal obligation is stated. | **UNPROVED**. | + +The claims are separate: the first claim's refutation neither proves nor refutes the second. + +## Boundary and contract inventory + +The complete submitted crate surface consists of two exported free functions: safe `force_unreachable()` and unsafe `delegated_nonzero(u8) -> u8`. There are no exported fields, types, constructors, traits/impls, methods, macros, statics, callbacks, FFI declarations, hidden items, or crate-generated APIs. No representation invariant exists. The only external unsafe surface consumed is `peer_unsafe_dep::duplicate_nonzero(u8) -> u8`, documented to require a nonzero argument and return that argument. + +The unsafe wrapper documents `value != 0` and says it delegates the value. On a normal return, the source establishes only: the dependency was called with the unchanged `value`, and the wrapper returns the dependency's result. Treating the dependency's documented “Returns `value`” as a mandatory provider postcondition does not prove that its unavailable unsafe implementation fulfills it. + +## Obligation ledger and proofs + +### OBL-FORCE — direct UB certificate + +1. `force_unreachable` is public and safe, takes no argument, performs no check or branch, and its body immediately evaluates `std::hint::unreachable_unchecked()` (`lib.rs:4-6`). Thus `force_unreachable()` is a well-typed safe-use witness and invocation reaches that operation for each `c ∈ C`. +2. The checked Rust 1.80.0 standard-library Safety section states: “Reaching this function is Undefined Behavior.” ([versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). The page is Rust 1.80.0 documentation and states no target or profile qualification; the submitted TCB accepts this proposition over `C`. +3. Therefore the valid safe invocation reaches an executed operation whose exact required proposition—unreachability—is false, and the applicable authority entails UB. This completes the existential `UNSOUND` certificate parametrically for every actual `c ∈ C`. + +The adjacent comment, “This site is assumed to be unreachable,” is not a proof: public safe invocation establishes reachability. It also cannot become a hidden safety precondition on a safe API. Minimal resolution is to prevent all safe calls from reaching the operation, replace it with defined behavior, or expose and document a sufficient compiler-enforced unsafe boundary; any changed artifact needs fresh audit. + +### OBL-DELEGATE-CALL — dependency caller precondition + +For a valid wrapper call, its documented contract gives `value != 0`. Line 17 passes that identical `value` to `duplicate_nonzero`; the submitted dependency contract requires exactly `value != 0`. Hence the local unsafe-call precondition is **PROVED** over all valid inputs and all `C`. The adjacent safety comment accurately records this derivation. + +### OBL-DELEGATE-IMPL — dependency provider correctness + +Soundness additionally requires: for peer-unsafe-dep 3.4.5, for every `c ∈ C` and every nonzero `v: u8`, every permitted execution of `duplicate_nonzero(v)` is UB-free. If its return contract is included, it must also return `v` on normal return. An unsafe caller contract establishes what callers must do; it does not establish that the third-party unsafe implementation fulfills its provider obligations. The exact pin freezes package/version identity only. + +No implementation or recursive audit was supplied, and `TCB.md` expressly rejects trusting it. Consequently no full `delegated_nonzero` case is certified by this packet: the local obligation is covered, but claim-level coverage is the pointwise conjunction with this uncovered provider obligation. The smallest missing proposition is the quantified UB-freedom proposition above (plus return equality for the submitted provider postcondition), established by an audit of the exact implementation/generated artifact or an expressly accepted, equally scoped `UNSAFE-DEP` entry. + +This is **UNPROVED**, not `UNSOUND`: the packet supplies no valid execution, dependency body, or asserted executed behavior from which to prove reachability of a violating event and UB. It is not `CONTRACT-BROKEN`: no UB-free execution falsifying return equality is established. + +## TCB and evidence audit log + +**TCB ID:** submitted `TCB.md`, this snapshot. **Policy:** only verified Rust authority and expressly accepted entries may be consumed; third-party unsafe implementations require recursive audit or accepted `UNSAFE-DEP` trust. + +| ID | Category/disposition | Exact proposition, scope, consumer | Identity/channel; trigger | +|---|---|---|---| +| AXIOM-UU | Rust std authority; accepted after direct verification | Reaching `unreachable_unchecked()` is UB, Rust 1.80.0 over `C`; OBL-FORCE | Exact versioned URL above; re-audit on Rust/support or cited text change | +| UNSAFE-DEP-PEER | Proposed premise; expressly not accepted | `duplicate_nonzero(v)` is UB-free for every nonzero `v` over `C` and fulfills its return contract; OBL-DELEGATE-IMPL | peer-unsafe-dep 3.4.5 exact pin; resolve by exact audit or human-accepted entry | + +There is no tool-derived evidence. The submitted documentation identifies the unsafe dependency contract but cannot substitute for implementation correctness. No implementation, compatibility, tool, deployment, or probabilistic premise is admitted. + +## Closure, residual scope, and triggers + +For OBL-FORCE the witness proof is independent of target/profile, so it covers each `C` fiber and refutes soundness there. For `delegated_nonzero`, `Required = C × {v ∈ u8 | v != 0} × permitted executions`; OBL-DELEGATE-CALL covers `Required`, while OBL-DELEGATE-IMPL has no certified region, so `Required ⊄ Covered` and `PROVED` is unavailable. + +Unaudited residuals are precisely the dependency implementation/generated output and binary/backend correctness (the latter is outside this source-level claim). Re-audit on changes to either function or its documentation, Rust/support predicate, the cited authority, dependency identity/features/contract/implementation, generated output, or TCB disposition. + +**Final result:** `force_unreachable` is **UNSOUND**; `delegated_nonzero` is **UNPROVED**. Every discovered surface, unsafe operation, documented unsafe precondition, dependency postcondition, configuration axis, and trust premise has the disposition above. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/G.md new file mode 100644 index 0000000000..662e3b7f93 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/G.md @@ -0,0 +1,58 @@ +# Focused source-only unsafe Rust review + +## Claim, snapshot, and domain + +This review covers exactly the supplied `lib.rs`, manifest, request, dependency declaration/contract, evidence, and TCB decision. The crate is edition 2021 and resolves `peer-unsafe-dep` exactly at 3.4.5. No dependency implementation, generated output, binary, prior audit, or tool result was supplied or used. + +Let + +`D = { Rust/compiler/stdlib 1.80.0 } × { target t | this exact source and peer-unsafe-dep 3.4.5 resolve on t } × { ordinary debug, ordinary release }`. + +This is exactly the support expression in `REQUEST.md`, retained symbolically: no target enumeration, exclusion, version extrapolation, or policy merge is performed. The only visible source configuration axis is profile, and neither export is profile- or target-conditional. Any dependency-internal configuration remains inaccessible. + +The two exported surfaces are the safe free function `force_unreachable()` and unsafe free function `delegated_nonzero(u8) -> u8`. There are no supplied public fields, constructors, traits/impls, macros, FFI, generated APIs, or invariant-bearing state. Each claim below quantifies independently over all of `D`. + +## TCB and evidence disposition + +**AXIOM-UU (accepted):** the verified Rust 1.80.0 standard-library Safety section for [`std::hint::unreachable_unchecked`](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety) says, “Reaching this function is Undefined Behavior.” The page is explicitly Rust 1.80.0 and states no narrower target/profile qualification. Consumers: F-OBL-1. Re-audit on a Rust/domain or cited-contract change. + +**UNSAFE-DEP-345 (rejected/not admitted):** the proposition that the exact `peer-unsafe-dep` 3.4.5 implementation is UB-free for every documented-valid `duplicate_nonzero` call, and returns its argument, over `D`. The exact pin fixes identity only. `TCB.md` expressly declines implementation trust, and no implementation audit exists. Consumers blocked: D-OBL-2 and D-POST-1. Re-audit if the implementation is supplied/audited or this precise entry is accepted. + +No other premise or tool evidence is admitted. + +## Claim F — `force_unreachable` + +**Theorem:** for every configuration in `D`, every well-typed safe invocation of `force_unreachable()` is free from Rust undefined behavior, with no caller safety precondition. + +**Verdict: UNSOUND over `D`, relative only to AXIOM-UU.** + +UB certificate (F-OBL-1): + +1. `force_unreachable()` is public and safe; therefore `force_unreachable();` is a valid in-scope safe use in every configuration where the crate resolves. +2. Its body has no branch, guard, argument, callback, or prior diverging operation. Calling it necessarily executes `std::hint::unreachable_unchecked()`. +3. That execution makes the callee’s required proposition—its site is not reached—false. +4. AXIOM-UU entails UB when it is reached. Thus this valid use reaches UB. The same source-level derivation is parametric in target and profile, so it covers every member of `D`. + +The adjacent comment, “This site is assumed to be unreachable,” supplies no fact and is contradicted by control flow. This is both an implementation defect and a deficient proof artifact, not merely failure to prove a universal claim. Minimum resolution: remove the unconditional unsafe operation (for example, use a defined panic if that is the intended behavior), then audit the changed artifact. A prose precondition cannot repair this safe API. + +No additional postcondition claim is needed to establish this verdict; any execution used above contains UB and therefore cannot serve as a defined-behavior postcondition refutation. + +## Claim D — `delegated_nonzero` + +**Theorem:** for every configuration in `D` and every `value: u8` with `value != 0`, every invocation satisfying that documented caller obligation is free from Rust UB. + +**Verdict: UNPROVED over all of `D`.** This is not an `UNSOUND` finding. + +Obligation ledger: + +- **D-OBL-1 — dependency call precondition: PROVED.** The submitted `duplicate_nonzero` contract requires `value != 0`. The wrapper’s unsafe contract requires the identical predicate, and the source forwards the unchanged `value`. Hence every valid wrapper call satisfies the dependency’s documented caller-side precondition. This proof is parametric over `D`; the local `SAFETY` comment accurately states this limited bridge. +- **D-OBL-2 — callee implementation behavior: UNPROVED.** Soundness additionally requires that exact dependency implementation to avoid UB for every valid call over `D`. Unsafe-API documentation does not prove its implementation honors the promise. The body is unavailable and UNSAFE-DEP-345 is rejected. This is the smallest missing proposition. +- **D-POST-1 — returned value: UNPROVED if `Returns value` is consumed as the delegated result guarantee.** The wrapper returns the callee expression directly, but proving the callee returns its argument requires the rejected proposition. There is no UB-free falsifying execution in the packet, so `CONTRACT-BROKEN` is not established. The wrapper’s narrower structural statement that it delegates to the peer is visible directly in source. + +Because D-OBL-2 lacks a derivation in every required case, the certified aggregate `Covered` set for Claim D is empty and `D ⊄ Covered`. Conversely, the packet establishes no particular valid call on which the unavailable dependency reaches UB, so none of the reachability/false-proposition/consequence links needed for an `UNSOUND` certificate exists. Absence of trust is not a counterexample. + +Minimum resolution is either a recursive audit of the exact dependency implementation and its configuration closure, or human acceptance of UNSAFE-DEP-345 with the exact soundness and return propositions. Re-review on changes to either source/API contract, Rust or supported domain, dependency identity/features/resolution, the Rust citation, or the TCB disposition. + +## Residual scope and combined result + +Dependency internals and generated artifacts are inaccessible and intentionally not inferred. Builds, tests, execution, macro expansion, binaries, compiler/backend correctness, and broader robustness are outside this source-level review. Claim F is **UNSOUND**; Claim D soundness and the dependency-derived return guarantee are **UNPROVED**. Therefore there is no combined `PROVED` result. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/H.md new file mode 100644 index 0000000000..2a74668e29 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/H.md @@ -0,0 +1,65 @@ +# Focused unsafe-Rust source audit + +## Claims and verdicts + +| Claim | Exact theorem | Verdict | +|---|---|---| +| C1 | For every configuration in `D`, every well-typed safe call to `force_unreachable()` is free of Rust undefined behavior. | **UNSOUND** | +| C2 | For every configuration in `D`, every call to `delegated_nonzero(value)` with `value != 0` is free of Rust undefined behavior. There are no ongoing or terminal caller obligations. | **UNPROVED** | + +These are separate source-level verdicts relative to TCB revision `TCB.md` SHA-256 `86796b85804436595c0f6ffbfa773dac4fce5cbfe28e02223c802a055037d0f4`. The combined soundness result is **UNSOUND** because C1 has a complete UB witness; C2 independently remains **UNPROVED**. + +## Snapshot, scope, and domain + +The audited source is `lib.rs` SHA-256 `778d644359b84bc0e519ed7220bfcadfbba578e2c9fd4c474ce742c4b0021ceb`, with `Cargo.toml` SHA-256 `57b66359b9447d371fa68a2cfdc04f49176b1a3ce815bb96027b2f76d917d0a7`. The manifest uses edition 2021 and exactly pins `peer-unsafe-dep = 3.4.5`; the submitted dependency surface confirms that exact resolution. No lockfile or dependency implementation was supplied. + +Let `R(t)` mean that this exact source and `peer-unsafe-dep` 3.4.5 resolve for target `t`. The controlling request gives, without normalization or exclusion: + +`D = { (Rust/std 1.80.0, edition 2021, target t, profile p) | R(t) and p in {ordinary debug, ordinary release} }`. + +This symbolic predicate preserves “every target” without an unjustified finite inventory. The source has no `cfg`, Cargo features, build script, macro-generated API, profile-dependent assertion, target-specific branch, or generated artifact. Consequently each source argument below is parametric in `t` and `p`; the admitted Rust axiom expressly covers all such targets and profiles. No dynamic support policy makes the 2026-08-01 audit cutoff alter `D`. + +The complete exported surface is the safe free function `force_unreachable` and unsafe free function `delegated_nonzero`. There are no public fields, constructors, types, methods, traits/impls, callbacks, statics, macros, reexports, hidden items, FFI declarations, or representation invariants in the submitted source. The only external unsafe surface is `peer_unsafe_dep::duplicate_nonzero`. + +## Obligation ledger and proofs + +### C1 / O1 — `force_unreachable` (`lib.rs:4-7`) + +Valid use imposes no safety precondition because the API is safe. For any configuration in `D`, the well-typed call `force_unreachable()` enters its body and, with no branch or earlier operation, executes `std::hint::unreachable_unchecked()`. + +The exact Rust 1.80.0 standard-library Safety section says: “Reaching this function is Undefined Behavior.” ([versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). Thus the operation requires that it not be reached. That proposition is false in this execution. The authority applies throughout `D`, so any member of `D` supplies the complete certificate: valid safe use; unconditional reachability; false required proposition; authoritative UB consequence. C1 is therefore **UNSOUND**, not merely unproved. + +The adjacent comment, “This site is assumed to be unreachable,” is circular and false for every invocation; it proves no dominating fact. This is both an implementation defect and a deficient proof artifact. No replacement `SAFETY` comment can repair the current body. Resolution requires removing the reachable operation (for example, using defined behavior) or changing the API boundary and documenting a sufficient compiler-enforced unsafe contract. Either is a new artifact requiring audit. + +For O1, the refutation is parametric over all of `D`; no configuration remainder exists. + +### C2 / O2 — local caller-side obligation (`lib.rs:15-18`) + +Valid use is exactly `value: u8` with `value != 0`. The dependency's submitted unsafe contract has the identical call precondition. The wrapper passes the same `value` directly, so its caller obligation entails the dependency call's caller-side obligation in every configuration in `D`. The adjacent `SAFETY` comment adequately records this local implication. + +### C2 / O3 — unsafe dependency provider obligation + +Local satisfaction of an unsafe callee's precondition does not establish that its implementation is correct. C2 additionally requires: + +> For every `(t,p)` in `D` and every `v: u8` with `v != 0`, every permitted execution of `peer_unsafe_dep::duplicate_nonzero(v)` version 3.4.5 is free of Rust undefined behavior. + +This is the smallest missing soundness proposition. The dependency body, generated output, prior audit, and binary are absent; the packet supplies no implementation assertion; and the human expressly declines an `UNSAFE-DEP` admission. An exact pin establishes identity only. Therefore O3 has no covered configuration, aggregate coverage for C2 is the intersection of O2's `D` with O3's unproved region, and `D ⊆ Covered` is not established. No valid execution exhibiting dependency UB is supplied, so the failure of universal proof does not establish an existential refutation. C2 is **UNPROVED**, not `UNSOUND`. + +The submitted dependency documentation also says `duplicate_nonzero` returns `value`. The wrapper syntactically returns the dependency's result, but whether that result equals the input is likewise **UNPROVED** without the separate provider proposition that every valid call returns `v`. No UB-free counterexample exists in the packet, so `CONTRACT-BROKEN` is not established. `lib.rs` itself does not expressly promise input/output equality beyond delegation. + +Minimum resolution is either a recursive source audit of the exact dependency implementation over all of `D`, or an authorized, precise `UNSAFE-DEP` entry admitting its UB-freedom (and its return-value postcondition if that behavior is claimed). The present trust decision forbids the latter. + +## TCB and evidence audit + +| Entry | Proposition and scope | Disposition | Consumer | +|---|---|---|---| +| AXIOM-UNREACHABLE-1.80 | Reaching `std::hint::unreachable_unchecked` is UB, for Rust 1.80.0 on every target/profile in `D`; exact URL and quotation above. | Accepted after direct citation verification | O1 | +| Proposed unsafe-dependency trust | The exact 3.4.5 implementation honors its unsafe contract for all valid calls in `D`. | Not proposed or accepted; expressly declined | O3 (blocked) | + +There are no other admitted compatibility, implementation, tool, deployment, or dependency propositions. No tests or tool-derived evidence were supplied or used. The accepted axiom's version exactly matches `D`, so no compatibility bridge is needed. + +## Residual scope and review triggers + +The unavailable dependency implementation and any of its generated output remain unaudited. Binary/compiler-backend correctness, nonordinary profiles, other Rust releases, targets outside `R`, and broader safe-API robustness are outside the stated claims. Re-audit is required for source or contract changes; a Rust/domain/profile change; dependency identity, implementation, features, or trust-disposition changes; or material change to the cited Rust documentation. + +All in-scope surfaces and obligations have dispositions. C1's `UNSOUND` certificate is complete across `D`; C2's exact missing implication and absence of an existential certificate are explicit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/I.md new file mode 100644 index 0000000000..33e2535e27 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/I.md @@ -0,0 +1,68 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, domain, and trust boundary + +The audited snapshot is the submitted `lib.rs` and `Cargo.toml` (edition 2021), with the submitted API description for the exactly resolved `peer-unsafe-dep` 3.4.5. No dependency implementation, generated output, prior audit, binary, lockfile, or tool result is available or reused. Scope is source-level Rust undefined behavior in the two exported functions; no binary/backend theorem is claimed. + +Let + +`R = { (Rust 1.80.0, target t, profile p) | this source and peer-unsafe-dep 3.4.5 resolve on t, and p is an ordinary debug or ordinary release profile }`. + +This is the request's controlling expression, retained symbolically rather than replaced by a sampled target list. Rust version and dependency identity are fixed; the varying axes are `t` and `p`. The inspected source has no `cfg`, features, target branches, macros, generated code, build script, concurrency, FFI, allocator, or representation invariant. The proofs below are therefore parametric in `t` and `p`; no configuration was tested. + +TCB `TCB-PACKET-R1` has one accepted entry: + +- **AXIOM-UR-180 (AXIOM, accepted):** Rust 1.80.0's [`unreachable_unchecked` Safety section](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety), independently opened and checked, says: “Reaching this function is Undefined Behavior.” The versioned page and submitted evidence give this proposition for every target/profile in `R`. Consumer: `OBL-FU-1`. Re-audit on Rust version, URL text, support-domain, or call-site change. + +There is expressly no accepted `UNSAFE-DEP` entry. In particular, exact pinning freezes identity but supplies no proposition about the body of `peer_unsafe_dep::duplicate_nonzero`. The human trust decision rejects relying on that unavailable implementation. + +## Verdicts + +| Claim | Exact valid-use theorem over `R` | Verdict | +|---|---|---| +| `CLAIM-FU` | Every well-typed safe call of `force_unreachable()` executes without Rust UB. There is no caller safety precondition. | **UNSOUND** | +| `CLAIM-DN` | For every `value: u8` with `value != 0`, every permitted execution of unsafe `delegated_nonzero(value)` is free of Rust UB. | **UNPROVED** | + +These are separate results; the unknown dependency does not weaken the completed existential certificate for `CLAIM-FU`, and it is not itself evidence of an existential defect for `CLAIM-DN`. + +## Complete certificates and obligation ledger + +### `CLAIM-FU`: UNSOUND + +`OBL-FU-1` is the precondition of `std::hint::unreachable_unchecked()` at `lib.rs:6`: execution must not reach that function. + +The following certificate is parametric over every `c in R`: + +1. **Valid use:** In configuration `c`, a safe caller may execute `force_unreachable()`. Its public safe signature has no inputs or enforced/prose safety obligation. +2. **Reachability:** Function entry proceeds unconditionally to its sole body expression, the call to `unreachable_unchecked`; there is no branch, panic, or earlier exit. +3. **False required proposition:** That execution reaches the site, so the required proposition “the call is not reached” is false. The comment “This site is assumed to be unreachable” supplies no fact and is contradicted by this execution. +4. **UB consequence:** AXIOM-UR-180 entails that reaching the function is UB. +5. **Domain coverage:** The control flow contains no configuration condition, and AXIOM-UR-180 applies throughout `R`; the same witness construction works for every `c in R`. + +Thus a well-typed safe use reaches an operation whose exact safety requirement is false and whose applicable authority entails UB. This is an implementation defect and a deficient/circular safety comment, not merely a missing universal proof. No UB-containing execution is used to claim a postcondition failure. + +Minimum resolution: remove `unreachable_unchecked` from this reachable safe path (for example, use a defined panic if that is intended), or make reachability depend on a locally proved condition. Re-audit the replacement as a new snapshot. + +### `CLAIM-DN`: UNPROVED + +`OBL-DN-LOCAL`, the caller-side obligation for `duplicate_nonzero` at `lib.rs:18`, is **PROVED over all `R`**: the submitted dependency contract requires `value != 0`; the wrapper's unsafe contract imposes exactly that obligation on each valid caller; and the unchanged `u8` parameter is passed directly. The adjacent safety comment accurately proves this local call precondition. + +`OBL-DN-IMPL`, provider correctness, is **UNPROVED over `R`**. The smallest missing proposition is: + +> For the exact implementation of `peer-unsafe-dep` 3.4.5, on every configuration in `R`, every call `duplicate_nonzero(value)` with `value != 0` executes without Rust undefined behavior. + +That proposition requires either a recursive audit of the exact implementation or an accepted, equally scoped `UNSAFE-DEP` entry. Neither exists, and the packet expressly declines the latter. The declaration and safety contract establish what this caller must do; they do not prove that the unavailable provider honors its promise. Therefore aggregate soundness coverage cannot establish `R subset Covered`. + +No valid execution reaching UB can be derived from the supplied material because the dependency body and any assertion about its behavior are absent. Consequently the existential `UNSOUND` certificate does not close; failure of the universal proof yields **UNPROVED**, not `UNSOUND`. + +The wrapper documents no explicit return-equals-input postcondition. The dependency's separate sentence “Returns `value`” is not silently promoted into the wrapper contract and is not consumed by this soundness proof. If result equality is intended as an additional wrapper guarantee, it too is **UNPROVED** absent the same implementation proof/trust; no UB-free counterexample establishes `CONTRACT-BROKEN`. + +Minimum resolution: supply and recursively audit the exact dependency implementation across `R`, replace it with locally provable code, or obtain explicit human acceptance of the precise `UNSAFE-DEP` proposition. The current trust decision permits only the first two. + +## Boundary completeness, residual scope, and triggers + +The complete language-reachable surface in the supplied source is one safe free function (`force_unreachable`) and one unsafe free function (`delegated_nonzero`); the latter crosses the single unsafe dependency call boundary. There are no exported fields, constructors, types, methods, traits/impls, callbacks, statics, reexports, hidden items, macros, or generated APIs, and no named state invariant is needed. Every unsafe site and exported surface has a disposition above. + +Residual scope is exactly the unavailable dependency implementation/generated output and binary/toolchain implementation behavior; no conclusion about them is inferred. Re-audit on source or documentation changes, Rust/support-domain changes, dependency identity/API/implementation or feature-resolution changes, acceptance of a TCB premise, or newly supplied generated/tool evidence. + +Final attestation: every in-scope surface and obligation has a status; the required domain is preserved symbolically; the `UNSOUND` result has every existential link; the `UNPROVED` result states its smallest missing proposition; and no verdict relies on testing or absence of a counterexample. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/J.md new file mode 100644 index 0000000000..045c940eaa --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/Q/reports/J.md @@ -0,0 +1,131 @@ +# Focused source-only unsafe Rust review + +## Claim frame and domain + +Snapshot: the submitted `Cargo.toml`, `lib.rs`, `DEPENDENCY-API.md`, +`EVIDENCE.md`, and `TCB.md`. Scope is the two exported functions and their two +unsafe calls. There are no exported fields, types, traits, implementations, +macros, statics, callbacks, FFI surfaces, conditional items, or generated +artifacts in the packet. No prior audit, dependency implementation, expansion, +binary, or tool result is reused. + +Let `T` be exactly the targets on which this source and the resolved +`peer-unsafe-dep` 3.4.5 compile, and let `P = {ordinary debug, ordinary +release}`. The controlling request and manifest give + +`C = { (Rust 1.80.0, edition 2021, target t, profile p, +peer-unsafe-dep =3.4.5) | t in T, p in P }`. + +This is retained symbolically: no finite target inventory is asserted. +`Required_cfg = C`. There are no source `cfg`s or features to partition. The +manifest's exact version requirement and the submitted resolution statement +establish the dependency version selected; they establish no proposition about +its body. The target predicate and profiles come verbatim from `REQUEST.md`, so +normalization to `C` holds in both directions by definition. The audit cutoff +is 2026-08-01; the supplied policy is static. + +For `force_unreachable`, `Required_F` contains every `c in C` and every +well-typed safe invocation and permitted execution of the function. There is +no caller safety precondition. For `delegated_nonzero`, `Required_D` contains +every `c in C`, every `v: u8` with `v != 0`, and every permitted execution of +an unsafe invocation whose documented obligation is satisfied. No ongoing or +terminal caller obligation is documented. + +## Authority and trust boundary (`TCB-PACKET-1`) + +`AXIOM-UU-180` is accepted exactly as directed by `TCB.md`. The checked Rust +1.80.0 standard-library Safety section says: “Reaching this function is +Undefined Behavior.” It states no target or profile qualification, so the +packet applies it throughout `C`. +[Versioned source](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). + +No `UNSAFE-DEP` proposition for `peer-unsafe-dep` 3.4.5 is accepted; the human +trust decision expressly declines it. No other implementation, compatibility, +tool, environment, or deployment proposition is admitted. The submitted peer +documentation is the caller/provider contract, not evidence that its +unavailable unsafe implementation fulfills that contract. + +## Claim F — `force_unreachable` + +**Soundness verdict: UNSOUND over all of `Required_F`, relative to +`TCB-PACKET-1`.** + +Existential UB certificate (indeed parametric in every `c in C`): + +1. **Valid use.** `force_unreachable` is a public safe function with no + arguments or stated precondition, so a safe call `force_unreachable()` is a + valid in-scope use. +2. **Reachability.** Once invoked, its body has no check or alternative exit; + `lib.rs:6` evaluates `std::hint::unreachable_unchecked()`. +3. **False required safety proposition.** The call site is therefore reached. + The operation requires that it not be reached. +4. **UB consequence.** `AXIOM-UU-180` directly classifies reaching the function + as undefined behavior. + +These facts do not vary with target or profile, and the axiom covers all of +`C`; thus each required configuration has the witness. The line 5 safety +comment merely assumes the proposition disproved by ordinary invocation. It +is not a proof and cannot be repaired with stronger prose: the implementation +must remove the call (for example, use defined panic/divergence) or remove the +safe callable behavior. + +The descriptive sentence at line 3 supplies no separate defined-behavior +postcondition. Because the witness execution contains UB, it cannot establish +`CONTRACT-BROKEN`. + +## Claim D — `delegated_nonzero` + +**Soundness verdict: UNPROVED over `Required_D`, relative to +`TCB-PACKET-1`.** + +The complete local call-site derivation is: + +1. A valid wrapper use supplies `v != 0` by `lib.rs:13`. +2. Line 17 passes that same `u8` value, without a transition, to + `duplicate_nonzero`. +3. The submitted peer safety contract requires exactly `value != 0`. + Therefore the wrapper discharges the peer's caller-side precondition for + every `v` in `1..=255` and every `c in C`. The local safety comment is + correct for that obligation. +4. Soundness additionally requires the exact peer implementation to be free + of UB for every such valid call. Neither the caller precondition nor the + declaration proves provider correctness. + +The smallest missing proposition is: + +`DEP-SOUND`: for every `c in C` and `v: u8` with `v != 0`, every permitted +execution of `peer-unsafe-dep` 3.4.5's exact `duplicate_nonzero(v)` +implementation is free of Rust undefined behavior. + +The dependency body/generated output is absent, no assertion about its +executions is supplied, and `TCB.md` rejects admission of this proposition. +Consequently the implementation obligation's covered domain is not shown to +contain `Required_D`; `Required_D subseteq Covered_D` cannot be certified. +There is also no valid execution showing that `DEP-SOUND` is false, so the +stronger `UNSOUND` certificate is unavailable. + +The peer contract additionally promises to return `value`. That provider +postcondition is likewise unverified for the unavailable implementation. The +wrapper documents delegation but no explicit equality postcondition of its +own. No UB-free postcondition counterexample is supplied, so +`CONTRACT-BROKEN` is not established. + +Minimum resolution: submit and recursively audit the exact dependency +implementation and any generated output over `C`, or obtain human acceptance +of a precise `UNSAFE-DEP` entry covering `DEP-SOUND` (and the return guarantee +if it is consumed). An exact version pin alone is insufficient. + +## Obligation closure + +| ID | Obligation | Status | +|---|---|---| +| F-CALL | `unreachable_unchecked` is not reached | False; complete UB certificate above | +| D-PRE | argument passed to peer is nonzero | Proved for all `Required_D` | +| D-IMPL | valid peer call is UB-free | Unproved: `DEP-SOUND` missing | +| D-RET | peer valid call returns its input | Unproved provider guarantee; not an explicit wrapper postcondition | + +Combined result: `force_unreachable` is **UNSOUND**; `delegated_nonzero` is +**UNPROVED**. There is no tool-derived evidence and no binary/backend theorem. +Re-audit on any source or contract change, support-domain change, Rust or cited +documentation change, dependency identity/body/generated-output change, or +new TCB disposition. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/PACKET.json new file mode 100644 index 0000000000..22b3cdfc6f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/PACKET.json @@ -0,0 +1,26 @@ +{ + "allowlist_sha256": "d99084daff4c4505711f97a93884043a9bbf0d06df4f1d3d8342c98486be4713", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "R", + "raw_score_sha256": { + "s1": "18ace2d3d6ffc4b2ba1aa686a459a387258b03d0e321d46c6f34548af3ba67a9", + "s2": "ad35d444b56e37377ddc62292f8aaae8924127adc72f8f4c970ae2b54526832f" + }, + "report_sha256": { + "A": "7632affdeeafcfccad88b8fdf653218f196aac4cc1362ddf0525f98656a9c7b3", + "B": "9b384e4d25bdffc9aa4778754f57056871249885fb3e9fae08083850432e5644", + "C": "954a95a4d7d7b061201270d9c023a17c93fdff3f3368267f7599f873c3df4d2c", + "D": "504ff4872d456561c79c0295a3314112c456ed899917d9990ea9765f4e98c8cd", + "E": "e292fe32c8a29791f68ce58f1baffa9194c462d69358d73f2ff381e150caa947", + "F": "d14718131a1eb74ccf317bd2f288d4a85da663414929c3e59ad4b8a5be37babf", + "G": "ee9aa27852c22aafafd26a8a54bd0e997998f61f25186209cb1518e5bcfcea3d", + "H": "d64506354d1859a400f27a02b58acdc4c122d6b225fc2f9d0651e3f1017bebc6", + "I": "c8399a0504c893f30a809f39b7426472335f151709ffe5a6960a9cb87f83e9e2", + "J": "74fe59f2a0341cf8fe291f8812d131a22949f51b001324e41aacdefb7cbe67f1" + }, + "rubric_sha256": "af075a1aac36a19d97ec57d1fe8509d12a4b323e43739bd57c1576b071b83faf", + "schema_sha256": "c7720030785e0d87c17d1a1ed44a9ecf260571a459be50b0fd2df15931ffa8e5", + "schema_version": 1, + "source_score_packet_sha256": "f2fd13517d31ee58205668eca898464350b393225742baab9b2dfcdcc5da8ba4", + "target_byte_tree_sha256": "d69df1b286abd8f7f8955ac56d702c1910eb596c0bd105b7998e39d7246ca063" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/RUBRIC.md new file mode 100644 index 0000000000..a2d6562f7e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/RUBRIC.md @@ -0,0 +1,100 @@ +# Mode R Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file to a report agent. + +## Exact result + +Within the scope in `REQUEST.md`, valid safe use includes every downstream safe +implementation of `Slot`, not only `Tail`. An implementation returning 2 and a +safe call `increment::(&mut [0, 0])` reaches +`get_unchecked_mut(2)` on a length-2 slice. Its in-bounds precondition is false, +and Rust 1.82.0 documents an out-of-bounds call as UB. The current safe API is +therefore `UNSOUND`. + +The required behavior needs neither generic index metadata nor an unsafe +abstraction. The preferred design is a nongeneric safe function that updates +`pair[1]` with wrapping addition (or an exactly behavior-equivalent checked +specialization). It eliminates caller implementation/index capability and the +unsafe block. Making `Slot` unsafe, adding safe-trait prose, or preserving the +generic abstraction by default is less parsimonious because downstream generic +use is expressly not required. The proposal does not alter the current verdict +and requires implementation plus fresh audit. + +## Atoms + +- **R1:** Quantify over arbitrary safe `Slot` implementations and explicitly + construct or describe one returning 2 together with its valid safe call. + - `scope_basis`: public safe trait implementation and safe generic calls are + valid-use surfaces of the exact current source. + - `dependencies`: exact Rust 1.82.0 public-visibility, trait-implementation, + ordinary-versus-unsafe-trait, and safe-versus-unsafe-function rules. +- **R2:** Prove reachability of `get_unchecked_mut(2)`, falsity of its in-bounds + precondition for length 2, and the applicable Rust 1.82.0 UB consequence. + - `scope_basis`: necessary certificate for the current-artifact soundness + claim requested in `REQUEST.md`. + - `dependencies`: R1. +- **R3:** Report the current safe API `UNSOUND`, independently of design intent + and proposals. + - `scope_basis`: `REQUEST.md` expressly requires the literal current-artifact + verdict before redesign. + - `dependencies`: R2. +- **R4:** Extract the exact minimum required behavior: wrapping increment of + element 1 for the owned use, with no generic downstream implementation need. + - `scope_basis`: this requirement is stated verbatim in `REQUEST.md`. + - `dependencies`: none. +- **R5:** Propose a nongeneric safe specialization implementing R4 with checked + indexing or an exactly equivalent safe operation, and no caller-controlled + implementation or index capability. + - `scope_basis`: `REQUEST.md` asks for the most parsimonious provable + abstraction satisfying R4. + - `dependencies`: R4. +- **R6:** Explain that removing the unpublished generic trait/API is an + authorized contract delta with no promised downstream migration burden. + - `scope_basis`: `REQUEST.md` expressly permits this contract and + representation change. + - `dependencies`: R4, R5. +- **R7:** Keep the redesign conditional and require implementation plus fresh + audit; do not use it to narrow or alter R3. + - `scope_basis`: `REQUEST.md` requires the current verdict and post-change + audit independently. + - `dependencies`: R3, R5. + +Merely making the trait unsafe does not pass R5 because it preserves an +unneeded caller implementation capability. + +## Hard errors + +- **RH1:** Trust `Tail` as the only safe implementation. +- **RH2:** Treat safe-trait prose as a caller obligation. +- **RH3:** Call the current API sound or merely `UNPROVED` after closing R2. +- **RH4:** Certify an unimplemented redesign. +- **RH5:** Let design intent narrow the current contract. + +## Checked authority + +- Rust 1.82.0 Reference, public visibility: + `https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy` + — public items are accessible from outside their module, subject to the + containing path; every item here is at the public crate root. +- Rust 1.82.0 Reference, trait implementations and coherence: + `https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations` + — a trait implementation may be defined when the implementing type is local, + so a downstream crate may define local `Bad` and implement `Slot` for it. +- Rust 1.82.0 Reference, unsafe traits: + `https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits` + — unsafe traits are explicitly declared with `unsafe`; the supplied `Slot` + declaration is an ordinary safe trait and its implementation requires no + unsafe act. +- Rust 1.82.0 Reference, unsafe functions: + `https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn` + — the caller-side unsafe obligation attaches to an `unsafe fn`; the supplied + public `increment` is an ordinary safe function. +- Rust 1.82.0 slice `get_unchecked_mut`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut` + — the index must be in bounds; an out-of-bounds call is UB even if its result + is unused. +- Rust 1.82.0 `u32::wrapping_add`: + `https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add` + — modular wrapping addition supplies the requested update semantics. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/allowlist.txt new file mode 100644 index 0000000000..6852f5fd70 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/allowlist.txt @@ -0,0 +1,6 @@ +https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy +https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations +https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits +https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut +https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/consistency.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/consistency.schema.json new file mode 100644 index 0000000000..04f2f75ba5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/consistency.schema.json @@ -0,0 +1,72 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-consistency-review-v1", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "mode", + "atom_family_attestations", + "defect_family_attestations", + "challenges", + "ambiguities" + ], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "atom_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["atom_id", "all_ten_reports_compared", "evidence"], + "properties": { + "atom_id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "defect_family_attestations": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["field", "all_ten_reports_compared", "evidence"], + "properties": { + "field": { + "type": "string", + "pattern": "^(hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "all_ten_reports_compared": {"const": true}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "challenges": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": false, + "required": ["label", "field", "recommended_decision", "evidence"], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "field": { + "type": "string", + "pattern": "^(atom:[PBLQR][1-9][0-9]*|hard_error:(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)|proposal_laundering|tcb_authority_defect|visible_scope_defect)$" + }, + "recommended_decision": { + "enum": ["PASS", "FAIL", "PRESENT", "ABSENT"] + }, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/raw-scores/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/raw-scores/s1.json new file mode 100644 index 0000000000..16f75bde5c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/raw-scores/s1.json @@ -0,0 +1,596 @@ +{ + "schema_version": 1, + "mode": "R", + "scorer_id": "s1", + "reports": [ + { + "label": "B", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs downstream `Bad`, a safe `Slot` impl returning 2, and a safe generic call, with exact visibility, coherence, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Tracks 2 into `get_unchecked_mut(2)`, proves it out of bounds for length 2, and cites Rust 1.82 UB even when unused." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Explicitly reports the current safe API `UNSOUND` and keeps the regional Tail proof and redesign independent." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the fixed Tail behavior as wrapping increment of element 1 and states that downstream generic capability is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a nongeneric safe `increment` using `pair[1]` and `wrapping_add`, with no caller-selected implementation or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains removal of `Slot`, `Tail`, and generic calls, the source-breaking migration, and the request's authorization for this unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Calls the redesign a proposal with no artifact verdict and requires implementation followed by a fresh snapshot audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly excluded from the current verdict and is left unaudited pending implementation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Every material Rust premise is tied to an applicable exact Rust 1.82 Reference or standard-library URL." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report evidences only the supplied target and exact allowlisted Rust documentation." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Bad` witness and safe call are explicit, but the material Rust 1.82 safe-versus-unsafe-function rule is asserted without checked authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, bounds falsity, and UB text are stated, but R2's R1 valid-safe-use dependency remains unestablished." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It says `UNSOUND`, but that verdict depends on the incomplete R2 existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Identifies the exact Tail-only wrapping update and expressly notes that generic downstream use need not survive." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a nongeneric safe inherent operation selecting fixed element 1 with checked indexing and no implementer/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Details deletion of the trait/generic API, call-site migration, intentional downstream breakage, and the unreleased-change authorization." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "The sketch is correctly conditional and requires fresh audit, but R7's R3 dependency is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The `UNSOUND` conclusion lacks an authority-complete valid-safe-use link for the ordinary function call." + }, + { + "id": "G11", + "evidence": "The proof necessarily relies on unchecked Rust safe-function caller semantics while claiming only cited version-matched axioms." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented sketch is expressly denied a verdict and does not narrow the stated current-artifact claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "The TCB omits checked Rust 1.82 authority for the ordinary-versus-unsafe-function premise consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report shows no inspection beyond the supplied source and allowlisted documentation." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Gives a downstream `Bad` returning 2 and safe call, supported by exact 1.82 visibility, implementation, unsafe-trait, and unsafe-function rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Shows the call necessarily reaches index 2 on length 2, falsifies bounds, and applies the exact Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Reports current-artifact `UNSOUND` and explicitly excludes the redesign from that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "States the sole required operation is Tail's wrapping update of element 1 and that generic implementations need not remain." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Supplies a nongeneric safe function with fixed checked index 1 and removes all caller-controlled implementation/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains the authorized deletion and migration of the unreleased trait, marker, and generic calls, including downstream compile breakage." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Assigns no verdict to the unimplemented proposal and requires a fresh audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is expressly separated from current-artifact results and left uncertified." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact applicable Rust 1.82 authorities and their consumed propositions are identified." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No report evidence indicates access outside the supplied target and allowlisted sources." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Oob` witness is explicit, but caller safety for the ordinary `increment` function is asserted without the required checked Rust 1.82 function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The mechanical out-of-bounds/UB chain is complete, but its R1 valid-safe-use dependency is authority-incomplete." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The literal `UNSOUND` verdict rests on the incomplete dependent existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the fixed wrapping Tail operation and rejects any need to retain downstream genericity." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a specialized safe function using constant checked index 1 without a trait or caller-selected index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Clearly states the authorized unreleased contract deletion and exact migration away from downstream impls and generic calls." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It conditionally requires fresh audit, but the listed R3 prerequisite is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "Its `UNSOUND` certificate does not authoritatively establish that the ordinary generic call is a valid safe use." + }, + { + "id": "G11", + "evidence": "The TCB necessarily consumes an unchecked safe-versus-unsafe-function proposition absent from its authority inventory." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is labeled unimplemented, receives no verdict, and does not narrow the current claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`AX-ACCESS` is used to infer no caller-side unsafe obligation, but its cited visibility/implementation pages do not verify the required function rule." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Nothing in the report evidences prohibited external or evaluator-material inspection." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "It constructs the exact safe witness and verifies visibility/coherence/unsafe-trait rules, but not the material Rust 1.82 safe-function caller rule." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, false bounds, and applicable UB are shown, but R2 depends on the authority-incomplete R1 valid-use proof." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The report says `UNSOUND`, yet its required R2 certificate remains incomplete." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Precisely identifies Tail's wrapping element-1 update as the required behavior and disclaims required generic polymorphism." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Recommends the exact nongeneric safe fixed-index function with no caller-controlled implementer or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Describes deletion and call migration, intentional loss of downstream generic use, and authorization from unreleased status." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "The proposal is correctly conditional with fresh-audit instructions, but R7's R3 dependency is unsatisfied." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The affirmative `UNSOUND` result lacks a checked-authority basis for one material valid-safe-use link." + }, + { + "id": "G11", + "evidence": "The report necessarily relies on uncited Rust semantics to conclude the ordinary function call carries no safety obligation." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "It expressly calls the redesign a proposal, not a new-artifact verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`TCB-R182` omits checked Rust 1.82 safe-versus-unsafe-function authority consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The text shows review of only the supplied target and allowed versioned documentation." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs `OutOfBounds` returning 2 with a safe call and verifies all four required Rust 1.82 visibility and safety-boundary rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Proves execution at index 2 on length 2, the false `2 < 2` proposition, and the exact documented UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Reports current `UNSOUND` independently of both the Tail regional result and redesign." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "States the exact owned Tail wrapping behavior and that only this non-generic capability is required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Uses one nongeneric safe checked-index function and removes every caller-selected implementation/index surface." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains the authorized breaking deletion of `Slot`/`Tail` and migration from generic calls, with no downstream preservation promise." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Says the design is unimplemented and unaudited, then specifies a fresh post-implementation audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Current results are fixed before the explicitly unimplemented redesign." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report cites exact versioned authorities for visibility, impl legality, unsafe traits/functions, bounds UB, and wrapping." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Naming the supplied unsafe-Rust package is expressly in scope; no prohibited inspection is evidenced." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Provides `Bad`, return value 2, and the safe generic call, with exact Rust 1.82 visibility, impl, unsafe-trait, and unsafe-function support." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Shows the executed call receives out-of-bounds 2 for length 2 and applies the exact versioned UB contract." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Declares the current artifact `UNSOUND` and keeps the Tail result and redesign separate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the Tail-only modular element-1 update and explicitly treats generic downstream capability as removable." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a single nongeneric safe fixed-index function without trait, generic parameter, unsafe block, or caller index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "States the exact breaking migration and that removal is authorized because generic users need not be preserved and the API is unreleased." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Explicitly denies the proposal an artifact verdict and requires a fresh audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented redesign is kept wholly separate from the current-artifact verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "All material language and library premises are matched to exact applicable Rust 1.82 authorities." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No text evidences inspection outside the supplied source and allowed authority." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs `Outside` returning 2 and a safe call, backed by exact 1.82 visibility, impl, unsafe-trait, and unsafe-function rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Establishes reachability of index 2, out-of-bounds falsity for length 2, and the applicable Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Returns the literal current-artifact `UNSOUND` verdict independently of the design proposal." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Defines the minimum as the owned Tail wrapping increment of element 1, with no need for generic implementations or calls." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The safe nongeneric `Tail::increment` uses checked constant indexing and exposes no caller-controlled implementation/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains deletion of the generic trait/function, exact call migration, authorized downstream breakage, and unreleased status." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Labels the design unimplemented with no verdict and demands audit of the exact implemented snapshot." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The current verdict precedes and is declared independent of the explicitly unaudited proposal." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its exact versioned authority inventory covers every material current-artifact premise." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report itself shows no prohibited source or evaluator-material access." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "Although it gives `Bad` returning 2 and the call, it does not verify the required Rust 1.82 ordinary/unsafe trait and function safety-boundary rules." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The out-of-bounds reachability and UB consequence are established, but R2's R1 valid-safe-use dependency is not." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The `UNSOUND` verdict depends on the incomplete existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Accurately isolates the fixed Tail wrapping update and states that downstream generic use is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Replaces the generic unsafe path with a safe nongeneric fixed-index function and no caller-controlled capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Details the intentionally breaking migration and correctly ties authorization to the unreleased, non-preserved generic API." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It conditions the redesign on implementation and fresh audit, but the R3 dependency remains unmet." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The report issues `UNSOUND` without an authority-complete proof that both the impl and ordinary function call are valid safe use." + }, + { + "id": "G11", + "evidence": "Its proof necessarily relies on unchecked Rust trait/function safety-boundary semantics omitted from `TCB-R033`." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly not a verdict and is not used to alter the current claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "The TCB lists visibility/coherence and library contracts but omits checked unsafe-trait and unsafe-function rules consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No prohibited oracle, sibling, condition, prior-report, or evaluator access is evidenced." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Bad` implementation and call are explicit and trait authority is checked, but the safe-versus-unsafe-function premise for the call is not verified." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It proves mechanical reachability, false bounds, and UB, but depends on R1's unsupported safe-call validity premise." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The stated `UNSOUND` verdict lacks a complete R2 certificate under the frozen authority rule." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Identifies only the wrapping update of fixed element 1 as required and treats generic downstream surfaces as removable." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes the exact nongeneric safe checked-index operation with no caller-selected implementation or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains disappearance of trait/generic users, the concrete migration, and authorization from the unreleased contract." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It leaves the sketch unimplemented and requires fresh audit, but R7's prerequisite R3 is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The `UNSOUND` result lacks checked support for the valid-safe-call link in its existential certificate." + }, + { + "id": "G11", + "evidence": "The TCB necessarily relies on an unchecked ordinary-function caller-safety proposition." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is expressly unimplemented, unaudited, and independent of the current verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`TCB-R016-r1` omits the Rust 1.82 safe-function authority needed to establish that calling `increment` accepts no safety obligation." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report evidences no access outside the supplied scope and exact allowed documentation." + }, + "novel_findings": [] + } + ], + "ambiguities": [ + "R1 explicitly depends on the Rust 1.82 safe-versus-unsafe-function rules, but the rubric does not expressly say whether merely calling a syntactically ordinary `fn` safe verifies that rule. Under SCORER.md's material-premise rule, I treated an uncited assertion as insufficient.", + "The atom dependency fields do not explicitly state whether failure propagates mechanically. I treated each listed dependency as a material prerequisite, so an authority-invalid R1 also fails dependent R2, R3, and R7." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/raw-scores/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/raw-scores/s2.json new file mode 100644 index 0000000000..4f062c910c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/raw-scores/s2.json @@ -0,0 +1,595 @@ +{ + "schema_version": 1, + "mode": "R", + "scorer_id": "s2", + "reports": [ + { + "label": "H", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F1 constructs downstream OutOfBounds, a safe Slot impl returning 2, and increment::; it verifies visibility, coherence, unsafe-trait, and unsafe-function rules at Rust 1.82 URLs." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F1 traces the call to get_unchecked_mut(2) on length 2, states 2 < 2 is false, and cites the Rust 1.82 out-of-bounds-call UB rule." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It labels SOUND-CURRENT as UNSOUND over D and explicitly says no proposal below affects that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the required Tail behavior as element-1 wrapping increment and says downstream generic use is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The recommended pub fn increment directly uses pair[1].wrapping_add(1), with no generic parameter, implementer capability, or unsafe block." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Migration deletes Slot and Tail, changes increment:: to increment, and explains that the unreleased API permits downstream generic uses to stop compiling." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the design is not implemented and has no audit verdict, then requires a fresh audit of the exact implemented snapshot." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is expressly unimplemented, is not used in the current UNSOUND verdict, and is conditioned on fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The material Rust premises are tied to applicable, versioned Rust 1.82 Reference and standard-library URLs; no extra TCB assumption is consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines its snapshot to the supplied source/package basis and contains no evidence of prohibited evaluation-material access." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F1 gives Bad, a downstream-local safe Slot impl returning 2, and a safe increment:: call, with versioned visibility, coherence, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F1 proves execution of get_unchecked_mut(2), that element 2 is out of bounds for length 2, and the cited Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "The current-artifact verdict is UNSOUND and is explicitly declared independent of the redesign." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It isolates the crate-owned Tail result [a, b.wrapping_add(1)] and states that the authorized requirement is narrower than generic downstream behavior." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Its preferred nongeneric safe function writes pair[1] with wrapping_add and removes the trait, marker, caller index selection, and unsafe operation." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains deletion of Slot and Tail, the call-site migration, and that breaking downstream implementations/generic calls is authorized for this unreleased abstraction." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the proposal is not implemented and has no artifact verdict, preserves the current verdict, and specifies a fresh post-implementation audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is expressly separated from the current UNSOUND result and left unaudited pending implementation and fresh review." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its witness and Tail proof cite the applicable versioned Rust 1.82 visibility, implementation, unsafe-boundary, slice, and wrapping authorities." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It limits the snapshot to target/lib.rs and disclaims prior results and execution; no prohibited evaluator or sibling material is evidenced." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "W1 supplies downstream Outside, a safe Slot impl returning 2, and increment::, backed by Rust 1.82 visibility, orphan, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "W1 shows the safe call reaches line 16 with index 2, establishes it is out of bounds for length 2, and cites the exact Rust 1.82 UB rule." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "The table reports the current public API UNSOUND and the prose says this verdict is independent of the proposal." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "The redesign section identifies the minimum capability as the fixed Tail operation: wrapping element 1 while leaving element 0 unchanged, without caller-selected indexing." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Tail::increment is nongeneric and safe, uses checked pair[1] indexing, and exposes no caller implementation or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It specifies deletion of Slot and generic increment, the Tail::increment call migration, and the expressly authorized downstream source break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Fresh-audit status calls the redesign unimplemented, assigns it no verdict, and lists the exact obligations to audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report does not certify the sketch and keeps it separate from the current-artifact UNSOUND result." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "All material language and library premises are linked to applicable Rust 1.82 pages, including the unsafe-function boundary." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states that only the supplied 18-line target was audited and shows no inspection of prohibited evaluation material." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F-UB constructs Bad returning 2 and the safe generic call, with exact Rust 1.82 visibility, orphan, unsafe-trait, and unsafe-function/unsafe-block authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F-UB traces index 2 into get_unchecked_mut on the length-two array, states the bounds proposition is false, and links AX-GET's explicit UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It reports every required safe use as refuted by an UNSOUND witness and states the redesign does not participate in that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It extracts the sole required operation as Tail's element-1 modular increment and rejects caller-controlled generic indexing as unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The preferred design is a nongeneric safe increment using pair[1].wrapping_add(1), with no implementer or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Migration deletes Slot, Tail, and genericity, explains the call rewrite, and invokes the request's authorization for the unreleased source break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It assigns no verdict to the unimplemented proposal and requires a fresh audit of exports, indexing, postconditions, and configuration coverage." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report explicitly excludes the redesign from current-artifact verdicts and requires implementation plus fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AX-VIS, AX-IMPL, AX-BOUNDARY, AX-GET, and AX-WRAP are all tied to applicable versioned Rust 1.82 authority." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report describes only the supplied lib.rs and allowed Rust authorities and evidences no prohibited source access." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The OutOfBounds witness and visibility/orphan/unsafe-trait citations are present, but the claim that calling ordinary increment is safe lacks the explicitly required Rust 1.82 safe-versus-unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It correctly states reachability, 2 < 2 falsity, and AX-GET UB, but R2 depends on R1 and the witness's safe-call validity is not fully verified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It says the current API is UNSOUND and proposal-independent, but R3 depends on the incomplete R2 existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It states that only the crate-owned Tail behavior is required: element 1 gets wrapping addition and generic downstream use need not remain." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The proposed safe nongeneric increment fixes index 1 and removes Slot, implementations, genericity, and unsafe code." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains the increment:: to increment migration and says downstream generic uses intentionally disappear under the authorized unreleased-API change." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "The design is expressly not a new verdict, does not alter current UNSOUND, and is conditioned on an exact-snapshot fresh audit." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND while the valid-safe-use link is incomplete: ordinary-function call safety is asserted without the required version-matched Rust authority." + }, + { + "id": "G11", + "evidence": "Its certificate necessarily relies on an unchecked safe-versus-unsafe-function premise omitted from the cited Rust 1.82 authority set." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is labeled a design rather than an artifact verdict and fresh audit is required." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-R182 claims the semantic premises are the cited authorities, but no Rust 1.82 unsafe-function authority supports the material assertion that increment's call carries no unsafe obligation." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines itself to the supplied target and permitted Rust documentation; no prohibited evaluator, sibling, or prior-report access is visible." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F-1 constructs downstream Bad returning 2 and a safe increment:: call, with versioned visibility, orphan, unsafe-trait, and unsafe-function rules in AX-PUBLIC/IMPL and AX-SAFE-BOUNDARY." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F-1 proves get_unchecked_mut(2) is reached on length 2, that index 2 is invalid, and that AX-GET makes the call itself UB." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It reports both safe-API and combined current-artifact results as UNSOUND and keeps the redesign independent." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the only required capability as Tail's wrapping element-1 update and says no generic downstream capability must survive." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The preferred safe function is nongeneric, fixes pair[1], and removes the trait, marker type, unsafe operation, and caller-controlled index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It details removal of Slot/Tail and the call rewrite, explaining that the request authorizes this unreleased contract and representation break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It states the proposal has no artifact verdict and requires a new-snapshot audit without changing the current UNSOUND conclusion." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented redesign is not certified or used to narrow the current obligation, and a fresh audit is required." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The authority set includes applicable Rust 1.82 visibility, coherence, unsafe-trait/function, slice-UB, and wrapping-add rules." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states the artifact is exactly the supplied lib.rs and contains no evidence of prohibited material inspection." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "FIND-1 gives Oob returning 2 and a purported safe call, but the authority inventory never verifies Rust 1.82's safe-versus-unsafe-function rule for calling increment without unsafe." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, equality with len, and AX-GET UB are stated, but R2 depends on R1 and the valid-safe-use premise remains unverified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It reports current UNSOUND independently of the proposal, but R3 depends on the incomplete R2 certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the fixed Tail wrapping update as the stated requirement and says genericity is unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "increment_tail is a safe nongeneric function using pair[1], with no Slot implementation or caller index authority." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "The migration removes Slot, Tail, and generic calls, and explains that this source break is authorized because the API is unreleased." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "The redesign is explicitly not a verdict, leaves current UNSOUND unchanged, and requires a fresh audit after implementation." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND without a fully verified valid-safe-use link because safe ordinary-function calling semantics are unsupported by its authority set." + }, + { + "id": "G11", + "evidence": "The report necessarily relies on the unchecked proposition that the non-unsafe increment declaration is callable without an unsafe obligation." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly unimplemented, unaudited, and independent of the current verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-1 lists visibility, implementation, slice, and wrapping authorities but omits the material Rust 1.82 safe-versus-unsafe-function authority used by FIND-1." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report limits itself to the supplied source and versioned Rust documentation and shows no prohibited evaluation-material access." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F-1 constructs Bad returning 2 and asserts that the impl and increment call are safe, but TCB-R033 cites no Rust 1.82 safe-versus-unsafe-function authority for the call premise." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It establishes reachability, the false 2 < 2 bound, and the slice UB consequence, but dependency R1 fails because safe-call validity is not fully verified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The literal current verdict is UNSOUND and proposal-independent, but its required R2 certificate is incomplete through failed R1." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It extracts only a concrete wrapping increment of element 1 and rejects preserving generic implementations as unneeded." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The proposed pub fn increment uses safe pair[1] indexing and wrapping_add with no generic or caller-controlled capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains removal of Slot/Tail, the generic-to-nongeneric call migration, and the authorization to break this unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the proposal is not a new verdict and requires a fresh audit of the implemented snapshot and migrated callers." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND although one required existential link, valid safe calling of increment, is asserted without the required version-matched authority." + }, + { + "id": "G11", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics absent from TCB-R033." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposed design is not certified and is separated from the current result pending fresh audit." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-R033 includes visibility, trait implementation, slice, and wrapping authorities but omits authority for its material assertion that increment is safely callable." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reviews the exact supplied lib.rs and permitted Rust pages, with no visible access to prohibited materials." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F-UB constructs Bad returning 2 and cites visibility, coherence, and unsafe-trait rules, but its claim that the increment call carries no unsafe obligation lacks Rust 1.82 unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It proves the call reaches get_unchecked_mut(2), falsifies bounds, and cites UB, but R2's R1 dependency is incomplete because safe-call validity is unverified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It expressly reports current UNSOUND independently of redesign, but R3 depends on the incomplete existential certificate in R2." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It states the required effect is [a, b.wrapping_add(1)] and that the requirement needs no genericity." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The safe nongeneric increment fixes pair[1] and removes Slot, Tail, the type parameter, unsafe code, and caller index control." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It details the increment:: call rewrite and explains that removal of downstream implementations/generic calls is authorized for the unreleased abstraction." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It labels the sketch unimplemented with no audit verdict, preserves current UNSOUND, and requires a fresh snapshot audit." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND without fully verifying the valid-safe-use link; the ordinary-function call premise has no applicable cited authority." + }, + { + "id": "G11", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics omitted from TCB-R016-r1." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The report does not certify or rely on the redesign and explicitly requires implementation followed by fresh audit." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "Its TCB names visibility, implementation, unsafe-trait, slice, and wrapping axioms but omits the safe-versus-unsafe-function rule material to calling increment safely." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines the review to supplied lib.rs/REQUEST context and allowed Rust documentation; no prohibited material inspection is visible." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F1 gives downstream Bad returning 2 and cites visibility, orphan, and unsafe-trait rules, but the assertion that the increment call is safe lacks the required Rust 1.82 safe-versus-unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The report states reachability, out-of-bounds falsity, and the exact UB consequence, but R2 depends on R1's unverified safe-call premise." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It reports the current artifact UNSOUND and keeps redesign separate, but R3's required R2 certificate remains incomplete." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the required Tail result as wrapping element 1 while preserving element 0, with generic downstream behavior expressly unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Tail::increment is a safe nongeneric checked specialization with fixed index 1 and no caller implementation or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains removing Slot and generic increment, migrating to Tail::increment, and the authorized break for downstream generic users of the unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It tells the reader not to regard the sketch as audited or PROVED and requires a new exact-snapshot audit after implementation." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND with an incompletely verified valid-safe-use link because safe ordinary-function calling semantics are not sourced." + }, + { + "id": "G11", + "evidence": "The certificate necessarily relies on unchecked safe-versus-unsafe-function authority absent from TCB-0." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is explicitly unaudited and does not alter the current-artifact conclusion." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-0 cites visibility, implementation, unsafe-trait, slice, and wrapping propositions but omits authority for the material safe-function call premise." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports source-only review of the supplied target and allowed authority, without evidence of prohibited evaluation-material access." + }, + "novel_findings": [] + } + ], + "ambiguities": [ + "The rubric does not state whether directly classifying a plain fn from source syntax alone verifies the listed safe-versus-unsafe-function dependency. I treated that material Rust semantic premise as requiring applicable Rust 1.82 authority, consistent with the frozen authority rule." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/A.md new file mode 100644 index 0000000000..defb37885d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/A.md @@ -0,0 +1,62 @@ +# Focused literal audit and redesign + +## Claim, domain, and verdicts + +**Snapshot and scope.** This reviews exactly the supplied `target/lib.rs`: `Slot`, `Tail`, its `Slot` implementation, `increment`, and the one `get_unchecked_mut` call. `Required(c)` is exactly: `c` uses Rust and standard library 1.82.0, is any target on which this exact source and its used 1.82.0 standard-library items exist, and uses any ordinary profile. There are no dependencies, `cfg`s, features, generated artifacts, macros, FFI, concurrency, allocators, or other source-level configuration branches. + +**Soundness theorem.** Every well-typed safe call to the public safe API must be free of Rust undefined behavior, without an undocumented caller or implementer safety condition. + +**Verdict: UNSOUND.** The current public generic `increment` has a valid entirely-safe downstream use that necessarily calls `get_unchecked_mut` out of bounds. This verdict is independent of the redesign below. + +**Required `Tail` behavior: PROVED.** For every `c` in `Required` and every initial `pair`, `increment::` returns with element 0 unchanged and element 1 equal to its old value plus one modulo `2^32`. This user-required behavior is not documentation found in `lib.rs`; it is an explicit review requirement. + +**Trust boundary `TCB-R182`.** No additional TCB assumptions are admitted. The only semantic premises are the exact Rust 1.82.0 Reference and standard-library contracts cited below. No compiler-binary, platform-implementation, test, or tool result is trusted. + +## Boundary and obligation coverage + +The complete relevant surface is: public safe trait `Slot`; its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `impl Slot for Tail`; public safe generic function `increment`; and its private unsafe operation. There are no unsafe declarations, fields, constructors with state, callbacks other than caller-selected `Slot` implementations, hidden items, or generated surfaces. There is no owned invariant: `S::index() < 2` is merely the missing proposition consumed by the unsafe call. + +The [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) say a `pub` item is accessible externally and associated items in a public trait are public by default. Under the [orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), a downstream crate may implement a foreign trait for its own local type. `Slot` does not use `unsafe trait`; the [unsafe-trait rule](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits) reserves the implementer-side unsafe obligation for traits whose declaration begins with `unsafe`. + +### UNSOUND certificate + +A downstream crate can write only safe Rust: + +```rust +use audited_crate::{increment, Slot}; + +struct OutOfBounds; +impl Slot for OutOfBounds { + fn index() -> usize { 2 } +} + +let mut pair = [0u32; 2]; +increment::(&mut pair); +``` + +1. **Valid use:** Both imported items are public; `OutOfBounds` is local, so its safe `Slot` implementation is coherent. Neither the implementation nor `increment` requires an `unsafe` context or documents a safety obligation. +2. **Reachability:** `increment` unconditionally evaluates `S::index()` and passes the result, `2`, to `pair.get_unchecked_mut`. +3. **False required proposition:** `pair` has exactly two elements, so valid element indices are `0` and `1`; `2` is out of bounds. +4. **UB consequence:** Rust 1.82 documents for [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut): “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” UB therefore occurs at the call itself. + +This certificate applies parametrically on every `c` in `Required`: the source has no target/profile selection and the cited 1.82 contract is the same premise for the whole requested target/profile predicate. The UB-containing witness does not establish a separate `CONTRACT-BROKEN` result. + +For `Tail`, `index()` is locally fixed at `1`; `1 < 2`, so the unchecked call returns a mutable reference to element 1. The assignment touches only that element, and Rust 1.82 [`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) specifies modular addition. Thus `Covered_Tail = Required` and `Required ⊆ Covered_Tail`. The same derivation is profile- and target-parametric. + +The unsafe block has no adjacent `SAFETY` proof. A valid local proof can be reconstructed only for `S = Tail`; it cannot prove the universal generic call. Adding a comment or prose requirement to this safe trait would not repair the implementation defect. + +## Preferred design + +Replace the generic abstraction with the exact required capability, using only safe operations: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its safe contract is: for every input, return with element 0 unchanged and element 1 equal to its prior value plus one modulo `2^32`; there are no caller safety preconditions. The array type establishes length two, literal index `1` supplies the bounds fact at the use site, and safe indexing enforces it. There is no representation invariant, unsafe surface, implementer capability, or additional TCB premise. + +This is preferable to sealing or making `Slot` unsafe because no required polymorphism remains. Remove `Slot`, its implementations, and `Tail` if it has no independent nominal purpose; change `increment` to the non-generic signature above. Migrate `increment::(&mut pair)` to `increment(&mut pair)` and delete trait bounds/implementations. Downstream `Slot` implementations and generic calls intentionally cease to be supported, as authorized for this unreleased abstraction. + +This is a design proposal, not a verdict for a new artifact. After implementation, audit the exact new snapshot: enumerate its exported surface and all callers/documentation; confirm the intended removals; prove both-element postconditions for all inputs; confirm no conditional/generated variants; and re-establish `Required ⊆ Covered` for the same Rust/target/profile predicate. Re-audit on any source, contract, Rust version, target/profile-support, or generation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/B.md new file mode 100644 index 0000000000..401f6ef712 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/B.md @@ -0,0 +1,71 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and results + +**Snapshot.** The artifact is exactly the supplied `lib.rs`; there are no other target sources, dependencies, generated artifacts, `cfg` branches, build scripts, macros, FFI, or prior results. Audit cutoff: 2026-08-01. Source-level Rust abstract semantics only. + +Let `E` be the request's exact set of targets “on which this exact source and its used Rust 1.82.0 standard-library items exist,” and `P` its symbolic set of ordinary profiles. `Required` contains every well-typed safe use of every language-reachable safe surface, with every input/state/execution, for `(Rust, target, profile) in {1.82.0} × E × P`. Thus `Required_cfg = {1.82.0} × E × P`. This is an exact restatement, not an enumeration. The source has no selection mechanism, and the proof below is parametric in `E` and `P`: target and profile cannot change the constants `2` and `1`, trait openness, or the specified operations. There are no exclusions. + +- **Safe-API soundness: UNSOUND.** A valid safe downstream implementation can return an out-of-bounds index and make `increment` execute documented undefined behavior. This certificate is independent of the redesign. +- **Requested `Tail` behavior: PROVED.** For every input array and required configuration, `increment::` returns with element 0 unchanged and element 1 equal to its old value plus one modulo `2^32`, without UB. +- **Combined current-artifact result: UNSOUND.** The positive `Tail` result does not repair the universally quantified public safe API. + +No additional robustness or documented unsafe-API postcondition is in scope. + +## Boundary and obligation inventory + +All surfaces are public and safe: `Slot`; its associated function `index`; public unit type/constructor `Tail`; its `Slot` implementation; and generic free function `increment`. The sole unsafe site is `pair.get_unchecked_mut(S::index())`. There are no fields, unsafe declarations/impls, named representation invariants, destructors, callbacks after index selection, or hidden/generated surfaces. `S::index()` may also panic; that exits before the unsafe call and before mutation. + +The Rust 1.82 authority set (TCB `R82-A`, no admitted non-Rust assumptions) is: + +- `AX-PUBLIC/IMPL`: public accessibility and trait-implementation/coherence rules. A downstream crate may name this public trait and implement it for its own local type; the local self type satisfies the orphan rule. [Visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy), [trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations). +- `AX-SAFE-BOUNDARY`: unsafe traits and functions require their respective `unsafe` declarations/obligations. Here `Slot` is not an unsafe trait and `increment` is not an unsafe function, so neither implementation nor call carries a caller safety obligation. [Unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), [unsafe functions](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn). +- `AX-GET`: Rust 1.82 documents for `get_unchecked_mut`: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” [Slice method](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut). +- `AX-WRAP`: `u32::wrapping_add` performs modular addition, wrapping at the type boundary. [Integer method](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add). + +No dependency or tool result is consumed. Re-audit `R82-A` if any cited Rust 1.82 text is corrected materially. + +| ID | Exact obligation | Disposition | +|---|---|---| +| O1 | At every executed `get_unchecked_mut(i)`, `i < 2`. | **False** for the public generic safe API; existential certificate below. | +| O2 | For `Tail`, establish O1 and the requested state transition. | **Proved:** `Tail::index()` unconditionally returns `1`; `1 < 2`; `AX-GET` therefore admits the returned reference to element 1. Assignment touches only that element. `AX-WRAP` gives the exact modulo-`2^32` result, including `u32::MAX -> 0`. | +| O3 | Existing adjacent proof explains the unsafe call. | **Deficient:** there is no `SAFETY` comment, and no sound derivation exists for arbitrary `S`. | + +For O2, the same source and argument cover every input fiber and every `(target, profile) in E × P`; no premise is configuration-specific. Hence the requested `Tail` domain is contained in its covered domain. + +## F-1 — safe generic API reaches UB + +Severity/classification: **UNSOUND implementation defect**, plus missing proof documentation. + +**Valid safe witness:** in a downstream crate, entirely safe Rust may write: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } +let mut pair = [0_u32; 2]; +increment::(&mut pair); +``` + +`Bad` is downstream-local, so `AX-PUBLIC/IMPL` permits the implementation. Neither boundary is unsafe (`AX-SAFE-BOUNDARY`), and the current API documents no precondition; this is therefore a valid in-scope safe use. + +**Reachability and falsity:** monomorphization calls `Bad::index()`, which returns `2`, then executes `get_unchecked_mut(2)` on the two-element receiver. Its valid element indices are `0` and `1`, so `2` is out of bounds. **UB consequence:** `AX-GET` states that the call itself is UB even before the reference is used. This completes every existential link on every required configuration and establishes `UNSOUND`; it is not merely a missing universal proof. The execution cannot separately witness `CONTRACT-BROKEN` because it contains UB. No generic behavioral postcondition was documented. + +Minimum repair of the current generic design would require checking the index before any unchecked access (and defining the failure behavior), or making/sealing an implementer contract and auditing every implementation. Neither complexity serves the stated requirement. + +## Preferred provable abstraction + +Specialize to the only required capability and remove unsafe code, the trait, the marker type, and genericity: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +**Proposed contract:** this is a safe function with no precondition beyond its type. On normal return, `pair[0] == old(pair[0])` and `pair[1] == old(pair[1]).wrapping_add(1)`; it returns `()`. The fixed array type makes index 1 in bounds. Safe indexing enforces its own bounds in any event, and `AX-WRAP` supplies the required arithmetic. There is no unsafe surface, implementer promise, or representation invariant. Retaining `Tail` would add nominal machinery without supplying a required capability. + +**Migration delta:** remove public `Slot` and `Tail`; change `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` impls and generic invocations cease to compile. The request expressly authorizes all of these unreleased contract/representation breaks. The wrapping result and mutation of element 1 are unchanged for the required case. + +**Fresh audit after implementation:** treat it as a new snapshot. Verify the exact exported surface and removal of old implementations/callers; prove both element postconditions for all `u32` values (especially `u32::MAX`); recheck the safe indexing and wrapping contracts against Rust 1.82; repeat the symbolic `E × P` configuration-closure argument; inventory any newly introduced code/generation; and confirm there is no remaining unsafe site. The proposal itself has no artifact verdict. + +Residual scope is exactly what the request excludes: other Rust releases, targets outside `E`, nonordinary configurations, binaries/backend correctness, and behavior of the intentionally removed generic API. Re-audit on source/API changes, support-domain changes, or material changes to the cited Rust 1.82 contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/C.md new file mode 100644 index 0000000000..82fb421517 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/C.md @@ -0,0 +1,72 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and verdicts + +**Snapshot.** The complete supplied `lib.rs` (lines 1–18), with no generated artifacts or third-party dependencies in scope. Audit cutoff: 2026-08-01. + +Let `T` be exactly “every target on which this exact source and its used Rust 1.82.0 standard-library items exist,” and `P` exactly “every ordinary profile.” `Required(case)` is the given source, Rust/compiler/stdlib 1.82.0, target in `T`, profile in `P`, every input/state/type and execution of every well-typed safe use of its public safe surfaces. The separately required behavioral domain is every valid `&mut [u32; 2]` passed to `increment::`. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every required safe use is free of Rust UB | **UNSOUND** | `F-UB` below gives a valid safe use, reaches `get_unchecked_mut`, falsifies its bounds requirement, and the applicable Rust 1.82.0 contract expressly entails UB. | +| For initial `[a,b]`, `increment::` returns with `[a, b.wrapping_add(1)]` | **PROVED** | `P-TAIL` covers every `a,b: u32`, target in `T`, and profile in `P`. | +| Existing local unsafe-proof documentation | **DEFICIENT** | The unsafe block has no adjacent `SAFETY` proof, and its needed universal premise is false. | + +The redesign below does not participate in these current-artifact verdicts. + +## Boundary and obligation inventory + +All language-reachable surfaces are: public safe trait `Slot` and its public safe associated function `index` (3–5); public unit struct and constructor `Tail` (7); its safe `Slot` implementation (9–13); and public safe generic function `increment` (15–18). There are no unsafe declarations, fields, macros, callbacks, FFI, concurrency, allocation, generated code, `cfg`, or configuration-selected paths. The sole unsafe operation is `pair.get_unchecked_mut(S::index())` (16); its result is consumed by wrapping addition and assignment (17). The only proposed invariant—`S::index() < 2` for every `S: Slot`—has no owner or enforcement boundary and is false. + +The source is identical across the symbolic `T × P` domain. Its explicit `wrapping_add` is profile-independent; no target fact, layout, panic strategy, or code-generation premise enters either certificate. Thus the proofs below are parametric over every configuration fiber, not sampled. No build or test evidence was used. + +## Checked Rust 1.82.0 axioms + +TCB `R82-AUTH-1` contains only these exact authoritative Rust 1.82.0 propositions; there are no additional assumptions. + +- `AX-VIS`: a `pub` item is accessible externally, subject to accessible ancestors ([Reference](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). +- `AX-IMPL`: a trait implementation is valid under the orphan rules when the implementing type is local; unsafe traits require `unsafe impl` ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). Rust describes an unsafe trait as one whose implementation may be unsafe and whose impl must use `unsafe` ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). `Slot` is not declared unsafe. +- `AX-BOUNDARY`: extra unchecked safety conditions belong on `unsafe fn`; an unsafe block asserts that all called-operation obligations were discharged ([unsafe functions and blocks](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). `increment` is a safe `fn`. +- `AX-GET`: `get_unchecked_mut` returns the selected mutable element without checking bounds, and: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” ([standard library](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). +- `AX-WRAP`: `u32::wrapping_add` performs modular addition, wrapping at the type boundary ([standard library](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). + +## Proofs and finding + +### F-UB — caller-controlled safe trait breaks the unchecked access + +A downstream crate may write the entirely safe witness: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +Validity: `Slot` and `increment` are public (`AX-VIS`); `Bad` is local to that downstream crate, satisfying the orphan alternative in `AX-IMPL`; neither the impl nor call accepts an unsafe obligation (`AX-IMPL`, `AX-BOUNDARY`). Reachability: `Bad::index()` returns 2, after which line 16 necessarily calls `get_unchecked_mut(2)` on the two-element array viewed as a length-two slice. False proposition: valid indices are below 2, so 2 is out of bounds. Consequence: `AX-GET` directly classifies that executed call as UB, even before line 17 uses the reference. The witness uses only values representable wherever this source exists, so it applies throughout `T × P`. This completes the existential `UNSOUND` certificate. There is no UB-free postcondition counterexample in scope from this witness. + +The smallest current implementation resolution is to stop passing unchecked memory-safety authority through a caller-controlled safe trait. Documentation alone cannot repair the safe API. + +### P-TAIL — required crate-owned behavior + +For arbitrary initial `[a,b]`, the inspected `Tail::index` returns 1. Since `1 < 2`, line 16 satisfies `AX-GET` and obtains the unique mutable reference to element 1. Line 17 computes `b + 1` modulo the `u32` range by `AX-WRAP` and stores it through that reference; element 0 is not accessed or assigned. Hence normal return yields exactly `[a, b.wrapping_add(1)]`. These source facts and axioms are independent of target and ordinary profile, so `Required_tail ⊆ Covered_tail` over all `T × P`. + +## Preferred provable abstraction + +Specialize to the sole required operation and remove both the implementer boundary and unsafe code: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +**Contract.** This safe function has no caller safety precondition beyond a valid exclusive array reference. For every initial `[a,b]`, it returns `[a, b.wrapping_add(1)]`. The fixed array type supplies length two, constant index 1 is in bounds, and the only arithmetic uses the documented modular operation. No representation invariant, unsafe implementer promise, or extra TCB entry remains. + +**Migration delta.** Delete public `Slot`, `Tail`, their impl, and the generic parameter. Change crate-owned calls from `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` impls and generic calls cease to compile; the request expressly authorizes that break because the abstraction is unreleased and only the Tail operation must survive. The observable required mutation is unchanged. + +**Fresh audit after implementation.** Treat the edit as a new snapshot. Re-inventory exports and all call sites; verify the exact implementation and any documentation; prove constant index 1 is in bounds for `[u32; 2]`, the wrapping postcondition, unchanged element 0, and absence of alternate exits for every `T × P` case; rescan conditional/generated surfaces and residual unsafe code. Any source, API contract, Rust version, target/profile policy, or generated/build input change triggers re-audit. No verdict is assigned to the unimplemented proposal. + +## Residual scope + +No broader safe-API behavior, binary/backend correctness, other source, or future version is claimed. Source execution, building, testing, and macro expansion were excluded by instruction and supply no premise. No authoritative-documentation or skill-guidance gap blocked either certificate. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/D.md new file mode 100644 index 0000000000..34ec4b57e7 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/D.md @@ -0,0 +1,76 @@ +# Focused literal audit and redesign + +## Claim, domain, and results + +**Current-artifact soundness: `UNSOUND`.** For the complete supplied `lib.rs`, a well-typed entirely safe downstream use reaches undefined behavior. This verdict is independent of the redesign below. + +**Requested `Tail` behavior: `PROVED`.** For every initial `pair = [a, b]`, `increment::(&mut pair)` returns normally with `[a, b.wrapping_add(1)]`. This is a user-requested robustness result, not a documented current-API postcondition. + +There are no documented postconditions or unsafe public APIs, so no `CONTRACT-BROKEN` claim applies. + +Let `T` be exactly the targets on which this source and its used Rust 1.82.0 standard-library items exist, and `P` every ordinary profile. A required case is + +`Required(source, rust, target, profile, S, pair, execution) := source = supplied lib.rs ∧ rust = 1.82.0 ∧ target ∈ T ∧ profile ∈ P ∧ the call is a well-typed safe use`. + +Thus `Required_cfg = {1.82.0} × T × P`. This is the request's predicate verbatim, not a finite target inventory. The source has no `cfg`, features, dependencies, generators, FFI, assembly, concurrency, allocation, or profile-sensitive operation. The proofs and counterexample below are parametric in `target ∈ T` and `profile ∈ P`; optimization, overflow-check, panic-strategy, and debug-assertion differences do not alter them. Audit cutoff: 2026-08-01. + +## Boundary and obligation inventory + +The complete language-reachable crate-owned surfaces are: public safe trait `Slot` and its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `Slot for Tail` implementation; and public safe generic function `increment`. The sole unsafe operation is `pair.get_unchecked_mut(S::index())`. `wrapping_add` and assignment are safe. There are no fields, constructors beyond the unit-struct expression, macros, hidden items, callbacks, or explicit unsafe declarations. No enforced invariant constrains implementations of `Slot` or their returned index. + +| ID | Obligation | Disposition | +|---|---|---| +| O1 | Every safe call to `increment` must pass an in-bounds index to `get_unchecked_mut`. | **Refuted; F1.** | +| O2 | For `Tail`, the selected index is in bounds for `[u32; 2]`. | `Tail::index()` is source-constant `1`; valid indices are `0,1`. **Proved** for all required configurations. | +| O3 | The requested normal result for `Tail` is `[a, b+1 mod 2^32]`. | O2 makes the returned reference designate element 1; assignment changes that element only; `wrapping_add(1)` supplies the modular value. **Proved**. | +| O4 | Every required configuration reaches the reviewed source and the same material semantics. | Exact source only, with no selectors or generated stages; O1–O3 are target/profile-parametric. **Proved**. | + +## F1 — safe trait implementation causes out-of-bounds unchecked access + +Severity/classification: **UNSOUND implementation defect; missing local proof artifact.** The unsafe block has no adjacent `SAFETY` proof, but documentation alone cannot repair the false premise. + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +Certificate: + +1. **Valid in-scope use.** `Slot` and `increment` are public at crate root. `Slot` is a safe trait and states no behavioral contract. The Rust 1.82 orphan rule permits this implementation because `Bad` is local to the downstream crate; its relevant clause is “At least one of the types `T0..=Tn` must be a local type.” There are no uncovered type parameters. The call is to a safe function and uses no unsafe operation at the call site. ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy), [trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), [unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)) +2. **Reachability.** `Bad::index()` returns `2`; `increment` unconditionally calls `get_unchecked_mut(2)` on the borrowed `[u32; 2]`. +3. **False safety proposition.** Index `2` is outside the two-element array's index set `{0,1}`. +4. **UB consequence.** Rust 1.82 documents: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)) + +This witness works for every `target ∈ T` and ordinary profile. One valid required execution suffices to refute universal safe-API soundness. No UB-free postcondition refutation is needed or claimed. + +## Authority and trust + +TCB revision `TCB-0` contains only the exact Rust 1.82 Reference/std propositions cited above and the `u32` contract: “Wrapping (modular) addition. Computes `self + rhs`, wrapping around at the boundary of the type.” ([`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)) These are version-matched Rust axioms, not additional assumptions. There are no dependencies, tool results, prior audits, external specifications, implementation claims, or deployment assumptions. Review was source-only; nothing was built, executed, tested, or expanded. + +## Preferred design + +Remove `Slot` and the generic free function. Retain the crate-owned name as one safe inherent operation: + +```rust +pub struct Tail; + +impl Tail { + pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); + } +} +``` + +Proposed contract: for every `[a,b]`, `Tail::increment` has no caller safety precondition, returns normally, leaves element 0 equal to `a`, and sets element 1 to `b + 1 mod 2^32`. The fixed array type makes index `1` locally in bounds; ordinary checked indexing removes all unsafe code, implementer promises, invariants, and additional TCB premises. + +Migration is intentionally source-breaking but authorized for this unreleased abstraction: replace `increment::(&mut x)` with `Tail::increment(&mut x)`; remove downstream `Slot` implementations and generic calls, which the requirement expressly does not preserve. The required `Tail` behavior is unchanged. Do not regard this sketch as audited or `PROVED`. + +After implementation, audit the new snapshot afresh: verify the actual visibility/reexports and absence of generated or conditional alternatives; inventory every remaining safe/unsafe surface; prove index `1` is in bounds from `[u32;2]`; prove normal return, element-0 preservation, and wrapping element-1 update for every input, target in `T`, and ordinary profile; reconcile the final documentation with that contract; and repeat the configuration/TCB closure if source, support policy, dependencies, or Rust version changes. + +Residual scope: binary/backend correctness, nonordinary profiles, other Rust releases, unavailable targets/items, performance, and APIs other than the supplied source are excluded by the request. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/E.md new file mode 100644 index 0000000000..cdd419fac4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/E.md @@ -0,0 +1,76 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +**Snapshot.** Exactly the supplied 18-line `target/lib.rs`, audited as source under Rust and standard-library 1.82.0 abstract semantics. No generated source, dependencies, build machinery, features, `cfg`, FFI, assembly, allocator choice, concurrency, or prior audit appears in the supplied artifact. Nothing was executed or expanded. + +Let `E` be exactly the targets named by the request: targets on which this source and its used Rust 1.82.0 standard-library items exist. Let `P` be every ordinary profile. Then + +`Required_cfg = {Rust 1.82.0} × E × P`. + +For soundness, `Required` additionally quantifies over every well-typed safe call, every valid `&mut [u32; 2]`, every caller-provided `S: Slot`, and every permitted execution. For the requested behavior, `Required_Tail` is every call with `S = Tail` and every initial array. The source has no configuration selector, and neither proof below consumes target- or profile-specific facts; both are parametric over `E × P`. Thus no finite target/profile inventory is asserted or needed. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every valid safe use of the current public API is UB-free | **UNSOUND** | Witness `W1` below is valid, reaches the unsafe operation, falsifies its exact precondition, and the Rust 1.82 contract says the call is UB. | +| `increment::` increments element 1 modulo `2^32` and leaves element 0 unchanged | **PROVED** | `TAIL-PROOF` below covers all `Required_Tail`. | + +The current-artifact soundness verdict is independent of the proposal. + +## Boundary and obligation inventory + +The complete language-reachable surface in this source is: public safe trait `Slot` and its required safe associated function `index` (lines 3–5); constructible public unit struct `Tail` (line 7); safe `Slot for Tail` implementation returning `1` (lines 9–13); and public safe generic function `increment` (lines 15–18). There are no fields, inherent methods, macros, hidden items, callbacks, unsafe declarations/traits/impls, or destructors in the artifact. + +The sole unsafe operation is `pair.get_unchecked_mut(S::index())` (line 16). Its obligation is `S::index() < pair.len() = 2` at the call. There is no enforced invariant or check supplying that fact. The subsequent operation (line 17) must write the referenced element's old value plus one with wrapping arithmetic. The unsafe block has no adjacent `SAFETY` proof; that proof artifact is missing independently of implementation correctness. + +### `W1`: existential UB certificate + +Downstream safe code can write: + +```rust +struct Outside; +impl Slot for Outside { fn index() -> usize { 2 } } +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +1. `Slot` and `increment` are `pub`; Rust 1.82 says a `pub` item is accessible outside, and associated items of a public trait are public by default ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). +2. `Outside` is local to the downstream crate, so this implementation satisfies the orphan-rule alternative requiring a local implementing type. It defines the sole required item ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). `Slot` is not `unsafe`; only an unsafe trait establishes compiler-recognized extra implementation safety conditions and requires `unsafe impl` ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), [unsafe keyword](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). The source documents no behavioral restriction. Therefore returning `2` is a valid safe implementation and the entire witness contains no caller-side `unsafe`. +3. The safe generic call reaches line 16; `S::index()` returns `2`. A two-element array has length `2`, so `2` is out of bounds. +4. Rust 1.82 states: “Calling this method with an out-of-bounds index is undefined behavior” even if the reference is unused ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). + +This same source-level witness applies for each `E × P`; one witness suffices to refute the universal claim. A comment cannot repair it. The minimum current-shape repairs would enforce the bound, seal/control every implementation, or create an honest unsafe implementer boundary. The requested specialization makes all three unnecessary. + +### `TAIL-PROOF`: requested current behavior + +For `Tail`, the inspected implementation returns `1`. Since `1 < 2`, line 16 satisfies the only stated safety condition and returns a mutable reference to element 1. Line 17 reads and writes only through that reference, so element 0 is unchanged. Rust 1.82 defines `wrapping_add(1)` as modular addition that wraps at the type boundary ([`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Therefore element 1 becomes `(old element 1 + 1) mod 2^32` for every input. There are no alternative source paths. This reconstruction proves the `Tail` implementation obligation but does not cure the missing local proof or generic unsoundness. + +## Trust and evidence + +**TCB-R182/revision 1.** No additional assumption is admitted. The only consumed semantic premises are the exact Rust 1.82 authoritative propositions linked above: public accessibility, trait-implementation/orphan and unsafe-boundary rules, out-of-bounds `get_unchecked_mut` UB, and wrapping addition. Their scope is exactly Rust/std 1.82.0 and `E × P`; consumers are `W1` and `TAIL-PROOF`. All other premises are inspected local syntax or arithmetic. No dependency, tool result, external specification, implementation/backend assumption, deployment restriction, or probabilistic premise is consumed. Re-audit on any source/public-contract change, Rust/std version change, scope expansion, or material change to a cited proposition. + +## Preferred redesign + +The minimum required capability is one fixed operation, not caller-selected indexing. Retain nominal `Tail` only if that name is desired, remove `Slot`, remove genericity, and use safe indexing: + +```rust +pub struct Tail; + +impl Tail { + pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); + } +} +``` + +**Proposed contract.** For every valid `&mut [u32; 2]`, `Tail::increment` has no caller safety precondition, returns normally, leaves element 0 unchanged, and replaces element 1 by its old value plus one modulo `2^32`. It exposes no representation invariant and contains no unsafe operation or implementer obligation. + +**Why preferred.** It directly supplies the only required consumer proposition. A checked generic function would preserve unneeded variability; sealing would retain an unneeded trait; making `Slot` unsafe would export an unnecessary obligation. The proposal removes the false bound premise, unsafe block, generic consumer, and implementer surface rather than relocating their proofs. + +**Migration/contract delta.** Delete public `Slot`, its `Tail` impl, and `increment`. Change crate-owned calls from `increment::(&mut pair)` to `Tail::increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile, as expressly authorized; the abstraction is unreleased. The required `Tail` result is unchanged. + +**Fresh-audit status.** This is an unimplemented design, not a verdict on a new snapshot. After implementation, audit the exact source anew: enumerate its public surfaces; verify safe indexing selects element 1 and cannot panic for `[u32; 2]`; reprove wrapping arithmetic and nonmutation of element 0 on every exit; confirm no generated/configuration-dependent alternative; and re-establish parametric coverage of Rust 1.82.0 over `E × P`. No unsafe-code TCB entry or safety comment should remain. + +## Residual scope + +Repository history, manifests, packaging, downstream code, compiler/backend correctness, binaries, and any source other than the two supplied target files were neither provided nor part of this exact source-level claim. No whole-crate or later-snapshot verdict is implied. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/F.md new file mode 100644 index 0000000000..288ee57e72 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/F.md @@ -0,0 +1,70 @@ +# Focused unsafe-Rust audit and redesign + +## Claims and verdicts + +**Snapshot.** Exact supplied `lib.rs` (18 lines), reviewed without execution or expansion. Scope is Rust 1.82.0 and + +`Required = { (target, profile, use) | target admits this source and the used Rust 1.82.0 standard-library items; profile is ordinary; use is well-typed safe use of a language-reachable safe surface }`. + +There are no `cfg`s, macros, dependencies, generated artifacts, FFI, concurrency, allocator choices, or target-dependent operations in the supplied snapshot. The source contains no support-policy transformation: the request supplies the symbolic target set directly. Audit cutoff 2026-08-01 does not extend the fixed Rust release. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every safe use of the current public API is free of Rust UB over `Required`. | **UNSOUND** | F-1 gives a valid entirely-safe use, reaches `get_unchecked_mut(2)` on a length-2 slice, proves its bounds precondition false, and links that event to Rust 1.82.0's explicit UB consequence. The witness is target/profile-parametric. | +| For every initial `[a, b]`, `increment::` terminates with `[a, b.wrapping_add(1)]` without UB. | **PROVED** | P-TAIL below covers every `u32` pair and every required target/profile. | + +There is no documented unsafe public API postcondition. The request's `Tail` behavior is the only additional behavior claim. No `CONTRACT-BROKEN` verdict applies: F-1's execution contains UB, while the independently reviewed `Tail` behavior holds. + +## Boundary, invariants, and obligation ledger + +The complete relevant language-reachable surface is: public safe trait `Slot` and safe associated function `Slot::index` (`lib.rs:3-5`); public unit struct and constructor `Tail` (`:7`); its safe trait implementation (`:9-13`); and safe generic function `increment` (`:15-18`). There are no fields, derives, reexports, hidden items, exported macros, or other manual implementations. Compiler-supplied auto-trait/drop behavior carries no state and is not consumed by the unsafe block. + +The unsafe operation needs `BOUND(S): S::index() < 2`. No type, check, privacy boundary, trait contract, or invariant establishes `BOUND` for arbitrary `S`. `Slot` is public and safe. Rust 1.82.0's [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) make the root `pub` surfaces externally reachable, and its [trait-implementation/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) permit another crate to implement this trait for its own local type. + +| ID | Obligation | Status | +|---|---|---| +| O-BOUND | At `:16`, the `usize` index must be in `0..2`. | **False** for a valid implementation returning 2; proved for `Tail` because `Tail::index()` is exactly 1. | +| O-SAFE | Safe `increment` must discharge O-BOUND for every safe `S: Slot`. | **Refuted** by F-1. | +| O-TAIL | The in-bounds mutable reference denotes element 1; the write preserves element 0 and stores modular `b + 1`. | **Proved** by P-TAIL. | +| O-CONFIG | Cover all requested targets/profiles. | Control flow, array length, constants, and the exact Rust 1.82.0 contracts are invariant across the symbolic availability set; thus P-TAIL covers it, and F-1 works in every member. | + +### P-TAIL + +For `S = Tail`, source fixes `S::index()` to 1. An array `[u32; 2]` has length 2, so 1 is in bounds. Rust 1.82.0 documents that [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) returns a mutable reference to the selected element without checking bounds and states: “Calling this method with an out-of-bounds index is undefined behavior.” Here that forbidden condition is false. The exclusive array borrow supplies the access for the returned reference, and no intervening call occurs. Rust 1.82.0 documents [`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) as computing addition “wrapping around at the boundary of the type.” Therefore the sole write changes element 1 from `b` to modular `b + 1`; element 0 remains `a`. + +## F-1 — safe implementer selects an out-of-bounds slot + +**Implementation: UNSOUND. Proof artifact: missing and not repairable under the current safe contract.** A downstream crate can write, with `audited_crate` denoting this crate: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +This contains no unsafe operation or unmet caller obligation. The ordinary impl is legal for the downstream-local `Bad`; `Slot` imposes no safety condition. `increment` is also safe. Its call to `Bad::index()` returns 2, so line 16 executes `pair.get_unchecked_mut(2)` after array-to-slice method resolution with length 2. Thus the exact required proposition `2 < 2` is false. The linked Rust 1.82.0 standard-library contract says the call itself is UB even if its resulting reference is never used. This completes the existential certificate; it is not merely a missing universal proof. + +The absent adjacent `SAFETY` comment is independently deficient. No truthful comment can derive O-BOUND for arbitrary safe implementations. Minimum repair is to enforce the bound or remove this generic unsafe path; changing prose alone cannot add a hidden precondition to safe callers or implementers. + +## TCB and evidence + +`TCB-R033` contains only the exact Rust 1.82.0 Reference/std axioms linked above: public reachability and legal local-type trait implementation, `get_unchecked_mut`'s return/bounds contract, and `wrapping_add`'s modular result. They are the controlling authorities selected by the request, not additional assumptions. No dependency, tool result, implementation behavior, compatibility premise, test, or deployment restriction is consumed. + +## Preferred redesign + +Delete `Slot`, its impl, the marker `Tail`, the type parameter, and the unsafe operation. The stated behavior needs only a concrete safe function: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract is: no caller safety preconditions; on normal return, initial `[a, b]` becomes `[a, b.wrapping_add(1)]`. The fixed array type and constant index make the access locally checkable, while safe indexing removes the unsafe contract entirely. Keeping `Tail` as an associated-function namespace is possible but adds surface without supplying required capability. + +This intentionally breaks source compatibility: `increment::(&mut pair)` migrates to `increment(&mut pair)`; `Slot` implementations and other generic instantiations disappear. The request authorizes that delta because the abstraction is unreleased and those uses need not survive. + +The proposal is not a new verdict. After implementation, freshly audit the exact new snapshot: public surface and migrated in-scope callers, the fixed index/array-length argument, the wrapping postcondition for every `u32`, absence of unsafe or callback-selected indexing, and Rust-1.82 target/profile closure. Re-audit on source/API changes, reintroduced generic dispatch or unsafe code, new configurations/generated code, or a change to the consumed Rust contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/G.md new file mode 100644 index 0000000000..361bf9ba55 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/G.md @@ -0,0 +1,87 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +**Snapshot.** Exactly the supplied `lib.rs`; no expansion or generated artifact. Scope is Rust and standard library 1.82.0, every target on which this source and the used items exist, and every ordinary profile. Audit cutoff: 2026-08-01. There are no dependencies, features, `cfg`s, build scripts, FFI, assembly, concurrency, allocators, or additional TCB assumptions. + +**Current safe-API soundness: UNSOUND.** A well-typed safe downstream implementation of `Slot` can return `2`; `increment` then executes `get_unchecked_mut(2)` on a two-element array. Rust 1.82 documents that an out-of-bounds call is undefined behavior even if the reference is unused. + +**Required `Tail` behavior: PROVED.** For every initial `[a, b]`, `increment::` returns with `[a, b.wrapping_add(1)]`, and this execution is free of undefined behavior. This regional result does not alter the whole safe-API verdict. + +**Combined current-artifact result: UNSOUND.** The source documents no other postcondition. The `Tail` behavior is included because `REQUEST.md` expressly requires it. + +## Exact domain and configuration closure + +Let a case be `(t, p, S, pair, execution)`. `Required` means: this exact source; Rust/std 1.82.0; `t` is any target on which the source and used items exist; `p` is any ordinary profile; `S` is any type satisfying the public safe bound `Slot`; `pair` is any valid `&mut [u32; 2]`; and the call is well-typed safe Rust. `Required_cfg(t,p)` is its Rust/target/profile projection. This is an equality-preserving transcription of the request, not a sampled inventory or inferred support promise. + +The source has one unconditional path and no generation or selection stage. Target/profile facts do not control the index, length, call, or library contracts used below. The counterexample is therefore parametric over every member of `Required_cfg`; one required case is already sufficient for `UNSOUND`. The `Tail` proof is likewise parametric over the full configuration projection and all `pair` values. No version-bridging premise is used. + +## Boundary, surfaces, and invariants + +- `Slot` and its safe associated function `index` are public; associated items in a public trait are public by default, and root-public items are externally accessible. [Rust 1.82 visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) +- A downstream crate can define local `Oob` and write `impl Slot for Oob`: the implementation supplies the sole required item, and the local implementing type satisfies the orphan rule. Only unsafe traits require `unsafe impl`; `Slot` is not declared unsafe. [Rust 1.82 trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) +- `Tail` is a public unit struct (including its constructor) with the crate-owned `Slot` implementation. `increment` is a public safe generic free function. Its unsafe block is the only unsafe operation. +- There are no fields, methods, other trait items/impls, callbacks, macros, hidden APIs, reexports, or invariant-bearing state. No abstraction invariant constrains caller implementations of `Slot`. + +## Authority/TCB log `TCB-1` + +There are no admitted non-authoritative premises. These checked Rust 1.82 axioms are the entire authority inventory: + +- **AX-ACCESS:** the visibility and implementation propositions stated above; consumers: witness validity and safe-surface inventory. +- **AX-GET:** `get_unchecked_mut` “returns a mutable reference to an element or subslice” without bounds checking, and calling it with an out-of-bounds index is UB even if unused. The page specifically identifies `len` as UB. Consumer: the unsafe-call obligation and `Tail` result. [Rust 1.82 slice contract](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) +- **AX-WRAP:** `wrapping_add` computes modular addition, wrapping at the type boundary. Consumer: the required value postcondition. [Rust 1.82 `u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) + +All apply exactly to Rust/std 1.82.0; changing that identity or any cited contract triggers review. + +## Obligation ledger and proofs + +**O1 — safe generic boundary.** Every safe call must establish `S::index() < 2` before the unsafe operation. Neither `S: Slot` nor any check establishes it. **Refuted; FIND-1.** + +**O2 — unsafe call for `Tail`.** `Tail::index()` returns literal `1`; `[u32; 2]` has length `2`; hence `1 < 2`. AX-GET then supplies a mutable reference to element 1. **PROVED** for all `Tail` cases. + +**O3 — update/postcondition for `Tail`.** The sole store is through that element-1 reference. AX-WRAP makes the stored value old element 1 plus one modulo the `u32` range; element 0 is not written. There is no alternative source path. **PROVED** for all initial arrays and configurations. + +**O4 — local proof artifact.** The unsafe block has no adjacent `SAFETY` proof. The reconstruction in O2 proves only `Tail`, not arbitrary `S`, so no truthful generic safety comment can repair the current implementation. **Deficient and implementation-unsound.** + +Aggregate positive coverage for the required `Tail` claim is `O2-covered ∩ O3-covered = Required_Tail`, establishing `Required_Tail ⊆ Covered_Tail`. Aggregate coverage for universal safe-API soundness fails at O1 and is existentially refuted below. + +## FIND-1 — safe implementer selects an out-of-bounds index + +**Status: UNSOUND; proof artifact missing.** Consider downstream safe code: + +```rust +struct Oob; +impl Slot for Oob { fn index() -> usize { 2 } } +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +**Valid use.** AX-ACCESS plus the source’s public, non-unsafe declarations make the implementation and call available without any caller-side unsafe obligation. The implementation defines the only required associated item and is coherent because `Oob` is local. + +**Reachability.** Monomorphization does not change the written control flow: `S::index()` returns `2`, which is passed directly to the executed `get_unchecked_mut` call before the store. + +**False safety proposition.** The array length is `2`, so the supplied index equals `len` and is out of bounds. + +**UB consequence.** AX-GET expressly makes that call UB even if its result is never used. Thus the whole execution witnesses soundness failure; it cannot witness a defined postcondition failure. No separate required postcondition is refuted. + +Minimum repair is to stop relying on an unenforced safe-implementer promise: validate the index, make and fully document an unsafe trait, effectively seal it, or remove the genericity. The stated requirements make removal preferable. + +## Preferred redesign (not a verdict on new code) + +Replace `Slot`, `Tail`, and generic `increment` with the specialized safe operation: + +```rust +pub fn increment_tail(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract has no safety precondition: for every valid input `[a,b]`, normal return produces `[a, b + 1 mod 2^32]`. The fixed array type and safe indexing enforce the only memory-selection fact; AX-WRAP supplies the arithmetic postcondition. It exposes no unsafe caller/implementer surface, owns no invariant, and needs no additional TCB premise. This is more parsimonious than sealing a trait whose only required implementation is fixed. + +**Migration/contract delta.** Remove the public `Slot` implementer contract, `Slot::index`, the nominal `Tail` constructor/implementation, and generic calls. Change the required internal call from `increment::(&mut pair)` to `increment_tail(&mut pair)`. Downstream implementations and generic calls intentionally cease to compile; the request authorizes that break and states the API is unreleased. The required observable behavior is unchanged. + +**Fresh audit after implementation.** Treat it as a new snapshot: re-inventory its actual visibility and all call sites; verify the safe element-selection semantics and AX-WRAP applicability on every requested target/profile; prove both elements’ post-state and all exits; confirm no conditional/generated alternative; and redo `Required ⊆ Covered`. This proposal itself is **not implemented and has no audit verdict**. + +## Evidence, residual scope, and triggers + +No target was built, run, tested, expanded, or tool-verified; none of those facts supports a conclusion. This is a source-level Rust-semantics audit, not a compiler-backend, binary, platform-implementation, performance, panic-freedom-beyond-the-required-case, or maximal-safe-subset claim. Re-audit on source/API/contract changes, Rust/std or support-domain changes, addition of configuration/generation/dependencies, or implementation of the redesign. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/H.md new file mode 100644 index 0000000000..43ad25268d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/H.md @@ -0,0 +1,73 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and verdicts + +**Snapshot.** Exact supplied `lib.rs`, lines 1–18; no generated artifacts, dependencies, conditional compilation, or build inputs are present in the supplied scope. Review was static only. Skill basis: supplied unsafe-Rust package. + +Let `D` be exactly: Rust compiler and standard library 1.82.0; every target on which this source and the used 1.82.0 standard-library items exist; every ordinary profile. This preserves the requester’s symbolic target predicate rather than inventing a finite target list. + +**SOUND-CURRENT — UNSOUND over `D`.** Claim: every well-typed safe use of the public surfaces `Slot`, `Tail`, and `increment` is free of Rust undefined behavior. Finding F1 gives a valid safe-use UB witness. It is target-, edition-, optimization-, overflow-check-, and panic-strategy-independent, so it refutes the claim in every case in `D`. No proposal below affects this verdict. + +**REQ-TAIL — PROVED over `D`.** For every initial `[a, b]: [u32; 2]`, `increment::` returns normally with `[a, b.wrapping_add(1)]` and no UB. This is the requester’s required crate-owned behavior, not an inferred documented guarantee of the otherwise undocumented current API. + +There are no documented unsafe-API postconditions: the crate declares no unsafe API. The requested Tail behavior is assessed separately above. + +## Boundary and obligation inventory + +All items are at crate root. `Slot` is a public **safe** trait; its required associated function `index` is public by default. `Tail` is a public unit struct, with a safe `Slot` implementation returning `1`. `increment` is a public safe generic function accepting every safe implementation satisfying the type bound. Its sole unsafe operation is `pair.get_unchecked_mut(S::index())`; the returned exclusive reference is then read via `wrapping_add(1)` and written. + +There is no representation invariant. The only needed local proposition is `S::index() < 2` at line 16. No type, validation, privacy boundary, or trait contract establishes it. The `unsafe` block has no adjacent safety proof. + +| ID | Obligation | Status | +|---|---|---| +| O1 | Every safe `Slot` implementation used with `increment` returns an index below 2. | False; F1 | +| O2 | At line 16, the unchecked index is in bounds. | False for F1; true for `Tail` | +| O3 | For `Tail`, only element 1 changes, to modular old-value-plus-one. | Proved below | +| O4 | `Required = D` is covered. | F1 and the Tail proof are parametric over all of `D` | + +## F1 — safe implementer controls an unchecked index + +**Implementation classification:** UNSOUND. **Proof artifact:** missing, and no correct proof exists for the current generic contract. + +A downstream crate can write entirely safe code equivalent to: + +```rust +struct OutOfBounds; +impl Slot for OutOfBounds { + fn index() -> usize { 2 } +} + +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +This is a valid in-scope use. Rust 1.82 says a `pub` item is externally accessible when its ancestor modules are accessible, and associated items in a public trait are public by default ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). The downstream implementing type is local there, satisfying the orphan rule’s local-type alternative ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). `Slot` is not an unsafe trait; Rust reserves `unsafe trait`/`unsafe impl` for extra implementer safety conditions ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). Thus neither defining the implementation nor calling `increment` requires an unsafe act or an undocumented obligation from this caller. + +The call reaches line 16 with a slice of length 2 and index 2. Rust 1.82 specifies that calling `get_unchecked_mut` with an out-of-bounds index is undefined behavior even if the resulting reference is unused ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). The false required proposition is `2 < 2`. The UB occurs at the call itself. Rust also states that an unsafe block asserts its operations’ extra safety conditions have been discharged; it does not impose them on callers of a containing safe function ([unsafe functions/blocks](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). This closes valid use → reachability → false safety condition → documented UB. + +No UB-free postcondition counterexample is needed or claimed. Minimum repair is to stop relying on an unenforced safe-implementer property: check the index, make and document an unsafe trait, effectively seal it, or remove the genericity. The last is preferred because only `Tail` is required. + +## Proof of REQ-TAIL + +`Tail::index()` is exactly `1`; `[u32; 2]` has length 2, hence `1 < 2`, satisfying the unchecked call’s complete stated bounds condition. The input `&mut` borrow supplies exclusive mutable access for the returned reference. Line 17 touches only that reference. Rust 1.82 defines `u32::wrapping_add` as modular addition wrapping at the type boundary ([`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Therefore element 0 remains `a`, element 1 becomes `b + 1 mod 2^32`, and no arithmetic profile branch arises. These facts and cited contracts apply uniformly to `D`, so `D ⊆ Covered`. + +## TCB log + +**TCB-R182-1:** only the five Rust 1.82 Reference/std propositions cited above are consumed as authoritative AXIOM entries; each was checked at its exact versioned allowlisted URL. There are no SAFE-DEP, UNSAFE-DEP, external, implementation, tool, deployment, compatibility, or probabilistic assumptions. Consumers: F1 and REQ-TAIL. Re-audit on source/API change, support-domain change, or material change to any cited Rust 1.82 contract. No tool-derived evidence or prior audit was used. + +## Recommended abstraction + +Replace `Slot`, `Tail`, and generic `increment` with the single safe operation the requirement needs: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + let tail = &mut pair[1]; + *tail = tail.wrapping_add(1); +} +``` + +Its proposed contract is: for every `[a, b]`, return `[a, b + 1 mod 2^32]`; it has no caller safety precondition. The fixed array type and constant index make the selected element locally checkable, safe indexing performs the bounds enforcement, and all unsafe code, implementer obligations, invariants, and generic proof fan-out disappear. A sealed marker would preserve unnecessary machinery; an unsafe trait would export an unnecessary unsafe obligation. + +**Migration delta.** Delete the public `Slot` trait and `Tail` type; change calls from `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile, expressly permitted because the abstraction is unreleased and they need not be preserved. The required observable Tail behavior is unchanged. + +This design is not implemented and has no audit verdict. After implementation, freshly audit the exact new snapshot: enumerate its resulting public surface and all call sites/reexports; prove constant index 1 is in bounds for `[u32; 2]`; prove the modular postcondition and that element 0 is unchanged; confirm no generated/configuration-specific alternate implementation; and re-establish `D ⊆ Covered`. Re-audit any change to the signature, array length, chosen index, arithmetic, visibility, support predicate, or cited contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/I.md new file mode 100644 index 0000000000..805e5fe938 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/I.md @@ -0,0 +1,55 @@ +# Focused literal audit and redesign + +## Claim, snapshot, and verdict + +The snapshot is exactly `target/lib.rs` as supplied. `Required` is Rust 1.82.0, every target on which this source and the used 1.82.0 standard-library items exist, every ordinary profile, and every well-typed safe use of the public API. There are no `cfg`s, features, dependencies, generated artifacts, macros, FFI, concurrency, allocator choices, or profile-sensitive arithmetic in the source. Thus the source, API, and proof obligations are identical throughout that symbolic target/profile domain; no finite target inventory is assumed. + +**Current-artifact soundness: UNSOUND.** A valid downstream safe implementation can supply an out-of-bounds index to the executed `get_unchecked_mut` call. The complete witness is below. This result is independent of the redesign. + +**Crate-owned Tail behavior: PROVED.** For every initial `pair == [a, b]` in `Required`, `increment::(&mut pair)` changes it to `[a, b.wrapping_add(1)]`. This is the separately requested behavioral subclaim, not a repair of the universal safe-API verdict. The source documents no API postcondition, so there is no additional documented-postcondition verdict. + +TCB `TCB-R003` contains only the exact Rust 1.82.0 Reference/std axioms cited below; there are no additional assumptions, dependencies, prior results, or tool-derived evidence. No source was built, executed, tested, or expanded. + +## Boundary, invariant, and obligation coverage + +The complete relevant surface is: public safe trait `Slot`; its public safe associated function `index`; public unit struct `Tail`; crate-owned safe `impl Slot for Tail`; public safe generic function `increment`; and its internal unsafe call at line 16. Public-trait associated items are public by default, and public items are externally accessible through accessible ancestors ([visibility authority](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy): “Associated items in a `pub` Trait are public by default”). A downstream crate may implement this trait for its own nominal type: the orphan rule permits an implementation when a participating type is local and the earlier uncovered-parameter restriction is met, vacuously here ([implementation authority](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). + +The needed generic invariant is `S::index() < 2` at line 16. Nothing owns or enforces it: `Slot` is neither private/sealed nor `unsafe`, `index` has no checked range type, and `increment` performs no check. Unsafe traits are the mechanism whose implementations accept extra safety conditions; they and their implementations require `unsafe` ([unsafe-trait authority](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). Here both implementation and call are ordinary safe Rust; `increment` exposes no caller safety contract. Rust 1.82 describes unsafe functions as the functions carrying compiler-unchecked caller conditions and requires the `unsafe` prefix ([unsafe-function authority](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). + +| ID | Exact obligation | Status | +|---|---|---| +| O1 | Every safe `increment::` call must give `get_unchecked_mut` an in-bounds index. | **Refuted; UNSOUND witness F1.** | +| O2 | For `Tail`, the index is in bounds. | **Proved:** the inspected impl returns literal `1`, and `[u32; 2]` has indices 0 and 1. | +| O3 | The Tail call increments exactly element 1 with wrapping arithmetic. | **Proved:** the unsafe API returns a mutable reference to the selected element when its precondition holds; assignment targets that element, while element 0 is untouched. `wrapping_add(1)` computes modular addition ([wrapping authority](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add): “Wrapping (modular) addition ... wrapping around at the boundary of the type”). | +| O4 | Configuration closure. | **Proved for O2–O3:** the derivation is parametric over every requested target/profile. O1 is refuted throughout that same domain, so a positive aggregate closure certificate is neither claimed nor needed. | + +## F1 — safe implementer causes undefined behavior + +```rust +struct Bad; +impl Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +This is a valid in-scope safe use: `Bad` is local downstream, its ordinary trait implementation satisfies coherence, and `increment` is safe. The call reaches line 16 with `S::index() == 2`; a two-element array has no element 2. Rust 1.82 states: “Calling this method with an out-of-bounds index is undefined behavior,” even if the reference is unused ([`get_unchecked_mut` contract](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). Therefore the executed operation's exact safety proposition is false and authoritative semantics supplies the UB consequence. This completes the existential `UNSOUND` certificate for every requested target/profile. Because the witness contains UB, it is not used as a postcondition refutation. + +The unsafe block has no `SAFETY` proof, but documentation alone cannot repair O1: there is no true derivation to document. The minimum generic repair would enforce bounds with safe checked indexing. Given the narrower authorized requirement, the design below is smaller. + +## Preferred provable design + +Replace the trait, marker type, generic parameter, and unsafe operation with one safe specialized function: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract is: for every initial `[a, b]`, normal return leaves `[a, b.wrapping_add(1)]`; it has no caller-side safety precondition. It has no invariant-bearing representation, implementer boundary, or unsafe/TCB premise. The array type fixes the length, literal index 1 supplies the needed projection locally, and `wrapping_add` supplies the required overflow behavior. + +Migration deletes `Slot` and `Tail`; `increment::(&mut pair)` becomes `increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile. Those are deliberate contract/API removals authorized because the abstraction is unreleased and only Tail behavior must remain. + +This proposal is not implemented and has no artifact verdict. After implementation, freshly audit the exact new snapshot: enumerate its public surfaces and any newly introduced configuration/generated code; verify safe indexing is in bounds for `[u32; 2]`; prove the exact element-0 preservation and modular element-1 postcondition; confirm removal/migration of every old trait/generic consumer; and re-establish target/profile closure. Re-audit on any source, signature, behavioral contract, Rust version, supported-target/profile, or standard-library-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/J.md new file mode 100644 index 0000000000..a2cb2e7bae --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency-packets/R/reports/J.md @@ -0,0 +1,82 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +Snapshot: the supplied `lib.rs` exactly as inspected; scope is its complete surface (`Slot`, `Tail`, their associated items/impl, and `increment`). `REQUEST.md` supplies the only behavioral requirement. No generated artifacts, dependencies, prior audit, build tooling, or tests are used. This is a source-level Rust-abstract-semantics review. + +`DOMAIN-R` is + +`rustc = std = 1.82.0 ∧ target supports this exact source and the used 1.82.0 items ∧ profile is ordinary`. + +The proof is parametric over every such target, profile, and Rust-1.82-supported edition in which the source compiles. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the current public surface is UB-free | **UNSOUND** throughout `DOMAIN-R` | `F-UB` below gives a valid safe witness in every case. | +| `increment::` changes `[a,b]` to `[a,b.wrapping_add(1)]` | **PROVED** throughout `DOMAIN-R` | `P-TAIL`; `Covered = DOMAIN-R`, hence `Required ⊆ Covered`. | +| Source-documented postconditions | none | No `CONTRACT-BROKEN` verdict applies. The requested Tail behavior is proved separately above. | + +The redesign authorization does not narrow the current artifact's safe public contract, so the proposal below does not affect **UNSOUND**. + +## Boundary, invariants, and obligations + +Safe surfaces are the public safe trait `Slot`, its safe associated function `index`, downstream implementations, public unit type/constructor `Tail`, its implementation, and public safe generic function `increment`. The only unsafe site is `pair.get_unchecked_mut(S::index())`. There are no fields, unsafe traits/impls, macros, hidden items, callbacks, FFI, concurrency, custom allocation, or destruction behavior relevant to that site. + +There is no enforced invariant. The needed proposition `S::index() < 2` cannot be an invariant of every `S: Slot`: `Slot` is public, safe, and unsealed, and neither its type system nor a check constrains the return value. + +| ID | Exact obligation | Status | +|---|---|---| +| O-BOUNDS | At the unsafe call, `S::index()` indexes the two-element slice in bounds. | **Refuted** for the generic safe surface by `F-UB`; proved for `S=Tail`. | +| O-TAIL | On normal return for `Tail`, mutate only element 1 to its old value plus one modulo `2^32`. | **PROVED** by `P-TAIL`. | +| O-DOC | Adjacent proof must derive O-BOUNDS from enforceable facts. | **Missing**, and no truthful generic derivation exists. | + +### F-UB — complete existential certificate + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } + +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +`Slot` and `increment` are externally reachable public items under the Rust 1.82 [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy). Because `Bad` is downstream-local, this implementation satisfies the [trait-implementation coherence/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations). `Slot` is not an [unsafe trait](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), so neither implementation nor call accepts a safety obligation. + +The call reaches `get_unchecked_mut(2)` on a slice of length 2. Its exact 1.82.0 contract says: “Calling this method with an out-of-bounds index is undefined behavior” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)); it expressly applies even when the result is unused. Thus the executed unsafe operation's required proposition is false and Rust's contract entails UB. No earlier operation in the witness is unsafe. `2` and `[u32; 2]` exist in every `DOMAIN-R` case, and cfg/profile/optimization does not alter this path. + +### P-TAIL — reconstructed local proof + +`Tail::index()` is definitionally `1`; `[u32; 2]` has length 2, so `1 < 2`. The unsafe method therefore returns a mutable reference to element 1. There is no intervening call or escaped alias. Rust 1.82 documents `wrapping_add` as “Wrapping (modular) addition” ([`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Assigning that result through the reference changes element 1 to `(old + 1) mod 2^32`; element 0 is untouched. This material derivation is absent from the source, but it proves only the Tail case and cannot repair the generic contract. + +## Configuration closure and TCB + +The controlling expression is exactly `DOMAIN-R`; no normalization or exclusion was added. Actual axes are target, ordinary profile, and compiling Rust-1.82 edition. There is one handwritten, unconditional path. Fixed array length, index values, the UB witness, and modular arithmetic are independent of those axes, giving parametric coverage. There are no sampled configurations or tool-derived claims. + +TCB log `TCB-R016-r1` has no additional assumptions. Its accepted authoritative axioms are: `AX-GET`, the quoted Rust-1.82 `get_unchecked_mut` contract (consumer O-BOUNDS); `AX-WRAP`, the quoted Rust-1.82 modular-addition contract (O-TAIL); and `AX-TRAIT`, the linked Rust-1.82 visibility, implementation, and unsafe-trait rules (F-UB). Exact identities are the linked versioned pages; scope is `DOMAIN-R`. Re-audit on source/API changes, Rust or support-domain changes, or material changes to those pages. + +## Finding and required resolution + +`F-UB` is an implementation defect in the current safe generic API; severity critical. The proof artifact is also missing: there is no `SAFETY` comment. Adding prose such as “implementers return an in-bounds index” would leave a hidden safety precondition on a safe trait and would not fix the defect. A generic design would need enforcement (for example, checked indexing) or an unsafe/sealed implementer boundary. The stated requirement needs no genericity, making those larger contracts unnecessary. + +## Preferred redesign + +Remove `Slot`, `Tail`, the type parameter, and all unsafe code: + +```rust +/// Replaces `[a, b]` with `[a, b.wrapping_add(1)]`. +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Contract: every well-typed safe call has no safety precondition beyond the parameter type; on return element 0 equals its old value and element 1 equals its old value plus one modulo `2^32`. The array type makes index 1 in bounds, safe indexing enforces bounds regardless, and `wrapping_add` supplies the exact arithmetic. There is no invariant, unsafe boundary, implementer obligation, or additional TCB premise. + +Migration: `increment::(&mut pair)` becomes `increment(&mut pair)`. The `Slot` implementation surface, generic calls, and nominal `Tail` type disappear; the request expressly authorizes those breaking changes and says the abstraction is unreleased. Tail's observable required effect is unchanged. + +This sketch is **not implemented and has no audit verdict**. After implementation, freeze a new snapshot and freshly audit every remaining/reexported safe surface; verify removal of the trait, impls, and unsafe site; prove index 1 in bounds, element 0 unchanged, and the wrapping postcondition; redo `DOMAIN-R` configuration closure; and review the final documentation and migrated consumers. + +## Residual scope + +Binary/backend correctness, non-ordinary configurations, other Rust releases, and any source not supplied are excluded. No target was built, tested, executed, or macro-expanded. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/B.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/B.json new file mode 100644 index 0000000000..423ec44438 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/B.json @@ -0,0 +1,1132 @@ +{ + "schema_version": 1, + "mode": "B", + "atom_family_attestations": [ + { + "atom_id": "B1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states Rust/Cargo 1.85.1, all three targets, both feature/allocator/debug states, every profile and u8, with only wasm32/arena excluded; treatment is uniformly PASS." + }, + { + "atom_id": "B2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: B, D, and E verify the Result/VarError and pattern exhaustiveness needed for the six raw classes; A, C, F, G, H, I, and J assert the partition while omitting at least one material semantic leaf." + }, + { + "atom_id": "B3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone verifies arm selection, source order, successful println line effect, and implicit normal return for both system paths; each other report omits at least one of those material clauses." + }, + { + "atom_id": "B4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone verifies the complete arena-success trace through completed output and implicit return; A–D and F–J leave at least one path-selection, output, or return premise unverified." + }, + { + "atom_id": "B5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E completely establish arena-stop arm selection, completed R/arena lines, later panic, and no current library; the other eight omit a material pattern or successful-output premise." + }, + { + "atom_id": "B6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E completely prove both pre-allocator rejection arms, completed R prefix, no allocator attempt, panic, and no library; the other eight omit a material pattern and/or completed-output premise." + }, + { + "atom_id": "B7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: C, D, E, F, and J verify order plus successful- and failed-println effects for every write site; A, B, G, H, and I lack authority for the prior completed R line and H also lacks block order." + }, + { + "atom_id": "B8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone closes successful local return, exact accepted Cargo mapping, and Rust cfg source selection; every other report consumes at least one unverified selector-success or cfg premise." + }, + { + "atom_id": "B9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E fully establish the conditioned prior R-before-arena trace, arena-stop rerun paths, staleness, and no reuse; A–C and F–J lack a material local trace premise." + }, + { + "atom_id": "B10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone combines a complete current arena mapping with verified key/value, all, cfg-removal, and compile_error semantics; the other nine have an incomplete mapping and/or cfg derivation." + }, + { + "atom_id": "B11", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone proves both directions of the exact Q/not-Q body partition from a complete build mapping and verified all/not/cfg rules; every other report leaves a required mapping or cfg leaf unverified." + }, + { + "atom_id": "B12", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: all reports state safe zero use, false nonzero, zero UB, and UNSOUND, but only E verifies the full current-library-to-unchecked-body reachability chain; the other nine certificates are incomplete." + }, + { + "atom_id": "B13", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report gives the intended maximal-region formula, but only E proves both containments with a complete build/body/control-flow basis; the other nine silently consume missing material premises." + }, + { + "atom_id": "B14", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states the not-Q zero-panic region, but only E completely verifies Required-to-checked-body coverage and equality/if/panic control flow across all fibers." + }, + { + "atom_id": "B15", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states UNPROVED rather than CONTRACT-BROKEN/PROVED, but only E also supplies the complete B12 UB certificate and B14 regional theorem required by this conjunctive atom." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:BH1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH1; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH2; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH3; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH4; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH5; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH6; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J issue UNSOUND with an unverified current-library/source reachability link, so BH7 is present there; E verifies all four certificate links, so BH7 is absent for E." + }, + { + "field": "hard_error:BH8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH8; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH9; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH10; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G1 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G2 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G3 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G4 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J issue UNSOUND without a fully verified reachability link, so G5 is present there; E alone verifies valid use, reachability, falsity, and the applicable UB consequence." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G6 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G7 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G8 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G9 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G10 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J necessarily rely on one or more unchecked material Rust premises for affirmative build/source/UNSOUND results; E verifies the complete material authority chain." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G12 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every remediation is expressly prospective and requires implementation/re-audit; no report uses it to certify or narrow the current artifact." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E keeps BUILD-MAP-ORDERED bounded and verifies every material Rust leaf; A–D and F–J also bound the TCB but make affirmative results while leaving different material Rust premises unchecked." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report text establishes inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material; supplied snapshot and authority references remain in scope." + } + ], + "challenges": [ + { + "label": "A", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result Ok/Err exhaustiveness or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "A", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "A", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "A", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "A", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "A", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "A", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output/normal-return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "A", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior R/arena prefix and arena-stop path rest on unverified successful-output and pattern premises; the requested local trace prerequisite is incomplete." + }, + { + "label": "A", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; effective current-build rejection is not completely derived." + }, + { + "label": "A", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "A", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output/normal-return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "A", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output/normal-return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "A", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output/normal-return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "A", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output/normal-return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "B", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "B", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "B", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output needed for the completed R and allocator prefixes; the complete ordered-prefix derivation is not verified." + }, + { + "label": "B", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output needed for the completed R and allocator prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "B", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "B", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "B", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior successful RERUN/arena prefix lacks verified successful-output semantics; the requested local trace prerequisite is incomplete." + }, + { + "label": "B", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; effective current-build rejection is not completely derived." + }, + { + "label": "B", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; both directions of current supported source selection are not completely proved." + }, + { + "label": "B", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "B", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "B", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "B", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "C", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "C", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "C", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "C", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; the complete ordered-prefix derivation is not verified." + }, + { + "label": "C", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "C", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful arm selection/return and all/not cfg semantics are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "C", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection and the successful arena return are not fully verified; the requested local trace prerequisite is incomplete." + }, + { + "label": "C", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "C", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "C", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful arm selection/return and all/not cfg semantics are unverified; the authoritative reachability link is missing." + }, + { + "label": "C", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful arm selection/return and all/not cfg semantics are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "C", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful arm selection/return and all/not cfg semantics are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "C", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful arm selection/return and all/not cfg semantics are unverified; this conjunctive atom therefore fails." + }, + { + "label": "D", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "D", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "D", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but normal main return is an unverified material edge; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "D", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping still depends on the unverified normal-return edge; effective current-build rejection is not completely derived." + }, + { + "label": "D", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping still depends on the unverified normal-return edge; both directions of current supported source selection are not completely proved." + }, + { + "label": "D", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but normal main return is an unverified material edge; the authoritative reachability link is missing." + }, + { + "label": "D", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but normal main return is an unverified material edge; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "D", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but normal main return is an unverified material edge; the Required-to-selected-body reachability chain is incomplete at normal main return; Required-to-checked-body coverage is incomplete." + }, + { + "label": "D", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because normal main return is an unverified material edge; this conjunctive atom therefore fails." + }, + { + "label": "F", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but delegates the Rust-semantic raw partition to BUILD.md and does not verify Result/VarError or exact pattern behavior; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "F", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "F", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "F", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; the complete ordered-prefix derivation is not verified." + }, + { + "label": "F", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "F", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but raw-path selection/normal return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "F", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection is delegated to unchecked source claims; the requested local trace prerequisite is incomplete." + }, + { + "label": "F", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not and false-cfg selection are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "F", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not and false-cfg selection are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "F", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but raw-path selection/normal return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "F", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but raw-path selection/normal return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "F", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but raw-path selection/normal return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "F", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because raw-path selection/normal return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "G", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "G", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "G", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "G", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "G", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "G", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "G", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "G", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior complete R/arena prefix lacks verified println-success and normal-return premises; the requested local trace prerequisite is incomplete." + }, + { + "label": "G", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete despite otherwise checked cfg rules; effective current-build rejection is not completely derived." + }, + { + "label": "G", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete despite otherwise checked cfg rules; both directions of current supported source selection are not completely proved." + }, + { + "label": "G", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "G", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "G", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "G", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "H", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "H", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "H", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "H", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "H", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "H", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify block sequencing or successful println output for the prior completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "H", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but block/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "H", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but R-before-arena order, complete-line success, and arena-stop selection are not fully verified; the requested local trace prerequisite is incomplete." + }, + { + "label": "H", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "H", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "H", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but block/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "H", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but block/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "H", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but block/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "H", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because block/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "I", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "I", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "I", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "I", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; the complete ordered-prefix derivation is not verified." + }, + { + "label": "I", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "I", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed RERUN line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "I", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but pattern/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "I", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but pattern selection, complete-line success, and normal return are unverified; the requested local trace prerequisite is incomplete." + }, + { + "label": "I", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key/value cfg semantics are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "I", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key/value cfg semantics are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "I", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but pattern/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "I", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but pattern/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "I", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but pattern/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "I", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because pattern/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "J", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify match-arm choice or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "J", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "J", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "J", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; the complete ordered-prefix derivation is not verified." + }, + { + "label": "J", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "J", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but match-arm selection and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "J", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but match-arm selection for arena and arena-stop is unverified; the requested local trace prerequisite is incomplete." + }, + { + "label": "J", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg rules are checked; effective current-build rejection is not completely derived." + }, + { + "label": "J", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg rules are checked; both directions of current supported source selection are not completely proved." + }, + { + "label": "J", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but match-arm selection and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "J", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but match-arm selection and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "J", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but match-arm selection and implicit-return premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "J", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because match-arm selection and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "A", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output/normal-return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "A", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output/normal-return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "A", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "A", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "B", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "B", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "B", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked successful-println and implicit-main-return premises; this is the exact G11 authority defect." + }, + { + "label": "B", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material successful-println and implicit-main-return premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "C", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful arm selection/return and all/not cfg semantics are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "C", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful arm selection/return and all/not cfg semantics are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "C", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "C", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "D", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although normal main return is an unverified material edge; one of the four required existential certificate links is not validly established." + }, + { + "label": "D", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because normal main return is an unverified material edge; BH7 applies independently of the atom failure." + }, + { + "label": "D", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked implicit-main-return semantics; this is the exact G11 authority defect." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material implicit-main-return semantics remain unverified while supporting affirmative verdicts." + }, + { + "label": "F", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although raw-path selection/normal return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "F", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because raw-path selection/normal return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "F", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, exact-pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, exact-pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "G", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "G", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "G", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, and implicit-return premises; this is the exact G11 authority defect." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, and implicit-return premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "H", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although block/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "H", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because block/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "H", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "H", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "I", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although pattern/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "I", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because pattern/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "I", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises; this is the exact G11 authority defect." + }, + { + "label": "I", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "J", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although match-arm selection and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "J", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because match-arm selection and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "J", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked match/tuple-pattern, implicit-return, and if/equality premises; this is the exact G11 authority defect." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material match/tuple-pattern, implicit-return, and if/equality premises remain unverified while supporting affirmative verdicts." + } + ], + "ambiguities": [ + "The frozen rules say a URL grants page identity rather than a proposition, but do not quantify how much verbatim quotation is required when a report gives an accurate nearby paraphrase. The comparisons credit explicit proposition-level paraphrases and do not credit a bare page or a citation proving only a different clause.", + "The atom dependency lists do not say that failure propagates mechanically. Later-atom challenges above are based only on the later proof actually consuming the same missing material premise, not merely on an earlier atom label being FAIL." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/L.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/L.json new file mode 100644 index 0000000000..592c4a88c9 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/L.json @@ -0,0 +1,207 @@ +{ + "schema_version": 1, + "mode": "L", + "atom_family_attestations": [ + { + "atom_id": "L1", + "all_ten_reports_compared": true, + "evidence": "A-J all identify the executed usize get_unchecked call's in-bounds obligation, state the out-of-bounds UB consequence, and target index < bytes.len(); no unequal L1 treatment remains." + }, + { + "atom_id": "L2", + "all_ten_reports_compared": true, + "evidence": "A-J all assert that the unsafe-containing else path has is_empty() == false and contrapose the zero-length contract. A/C/H quote true-arm exclusion as well as false-arm selection; B/D/F/G/I quote only false=>else, E gestures to unquoted same-paragraph rules, and J quotes true=>consequent plus false=>else without true=>skip-else. The cross-atom consequence of those extraction gaps is recorded as ambiguity." + }, + { + "atom_id": "L3", + "all_ten_reports_compared": true, + "evidence": "A-D and H-J check both len's usize type and the unsigned/nonnegative domain. E omits both; F states the return type but derives nonnegativity from element-count-as-natural rather than a checked usize-domain entry; G checks the usize domain but misclassifies the len-to-usize link as a local source/type fact. The F split is recorded as an equivalence ambiguity rather than challenged." + }, + { + "atom_id": "L4", + "all_ten_reports_compared": true, + "evidence": "A-D and G-J check built-in subtraction plus overflow boundaries and apply n > 0 across profiles. E/F assert representability and profile independence without those Rust authorities; both raw scorers consistently fail L4 there." + }, + { + "atom_id": "L5", + "all_ten_reports_compared": true, + "evidence": "Every report A-J substitutes index = bytes.len() - 1 and explicitly derives the strict upper bound index < bytes.len(); both scorers uniformly pass L5." + }, + { + "atom_id": "L6", + "all_ten_reports_compared": true, + "evidence": "All ten reports claim implementation PROVED and connect the branch/arithmetic chain to get_unchecked. E/F lack checked numeric leaves, B's formal Required drops valid uses/executions, and B/D/G/I/J expose the branch-extraction overlap recorded below; B's contraction is challenged under G1 rather than silently collapsed into this atom." + }, + { + "atom_id": "L7", + "all_ten_reports_compared": true, + "evidence": "A-J all separately call the existing lifetime-only SAFETY comment deficient for omitting the in-bounds obligation and its material derivation, while keeping that artifact verdict distinct from implementation soundness." + }, + { + "atom_id": "L8", + "all_ten_reports_compared": true, + "evidence": "All ten supply adjacent replacement text. A-D and G-J can refer back to checked premises for the full chain; E/F assert representable subtraction despite having no checked usize/subtraction/overflow entries, and F's text also does not name get_unchecked. The s1 PASS decisions for E/F are challenged." + }, + { + "atom_id": "L9", + "all_ten_reports_compared": true, + "evidence": "A-D and H-J inventory if selection, is_empty, len/type, usize domain, subtraction, overflow, and get_unchecked while separating source facts and mathematics. E/F omit the numeric Rust leaves; G omits len's return-type premise and misclassifies inferred index typing as local." + }, + { + "atom_id": "L10", + "all_ten_reports_compared": true, + "evidence": "A/C/H provide narrow 1.82.0 entries whose extracted text supports every consumed proposition. B/D/I omit true-arm exclusion from AX-IF, E/F additionally omit numeric entries, G additionally omits len's usize return, and J's two AX-IF fragments still omit the true=>skip-else clause consumed by O1. J's s1 PASS is challenged." + }, + { + "atom_id": "L11", + "all_ten_reports_compared": true, + "evidence": "A/C/H reconcile complete checked inventories. E/F/G have omitted or misclassified numeric/type leaves; B/D/I/J claim exact reconciliation although their extracted AX-IF prose does not establish true-arm exclusion. J's s1 PASS is challenged consistently with the other incomplete AX-IF reports." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:LH1", + "all_ten_reports_compared": true, + "evidence": "A-J all report implementation PROVED, reconstruct L1-L5, and treat comment deficiency separately; none issues UNSOUND or UNPROVED solely because of the comment." + }, + { + "field": "hard_error:LH2", + "all_ten_reports_compared": true, + "evidence": "Every report explicitly calls the existing comment deficient; none calls it adequate." + }, + { + "field": "hard_error:LH3", + "all_ten_reports_compared": true, + "evidence": "A-J each state every factual link from false is_empty through nonzero length, predecessor arithmetic, and index < len to the callee obligation. Authority defects are kept in LH4/G11 rather than converted into an omitted-link LH3." + }, + { + "field": "hard_error:LH4", + "all_ten_reports_compared": true, + "evidence": "E/F affirm complete reconciliation while wholly omitting consumed usize/subtraction/overflow authorities. B/D/G/I/J state the relevant propositions but incompletely extract or classify their support; whether that lesser evidence gap alone meets LH4's exact hard-error threshold is recorded as ambiguity." + }, + { + "field": "hard_error:LH5", + "all_ten_reports_compared": true, + "evidence": "All ten disclaim build, test, execution, lint, or dynamic evidence and none uses such success as universal proof." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "B alone formally defines Required as source x Rust/std x target x profile while omitting valid calls/inputs and executions, then certifies Covered = Required; the other reports include the valid-use/theorem domain. B's absent s2 decision is challenged." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Every report gives an explicit Required subset-of Covered or Covered = Required closure statement; B's contracted Required is handled independently as G1." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "No report invents policy precedence or relabels a conservative audit domain as the project's promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "No report uses CI, endpoints, sparse documentation, a cutoff, or a stability badge as interval coverage; all arguments are symbolic in target/profile." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "No report issues UNSOUND, so the missing-four-link UNSOUND trigger is absent across A-J." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "No report issues UNPROVED after establishing an existential UB certificate; all issue PROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "No report issues CONTRACT-BROKEN or relies on a UB-containing execution for such a verdict." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "No report claims an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "The target has no third-party unsafe dependency or caller-controlled safe callback, and none of A-J silently trusts one." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "A-J offer comment replacements only after separately judging the unchanged implementation; none certifies an unimplemented design or narrows current obligations with it." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "E/F necessarily rely on wholly unchecked numeric Rust premises and both scorers record G11. B/D/G/I/J instead cite the correct authority pages and state the propositions but incompletely extract or classify them; whether those gaps alone force G11 is recorded as ambiguity." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "No report evidences inspection of an oracle, sibling, condition map, prior report, evaluator material, or another prohibited source." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "All ten replacement comments are proposed artifact repairs and none is used as if already implemented to establish soundness or narrow obligations; both raw scorers uniformly record ABSENT." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "A/C/H have complete proposition-matched authority. E/F omit numeric premises, G misclassifies len's return type, and B/D/I/J incompletely extract AX-IF's exclusivity. Both scorers mark the defect for every such report except s1 on J; that J decision is challenged." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "A-J discuss only the supplied target/request and allowlisted Rust authorities; neither raw scorer finds report-visible evidence of prohibited source-scope departure." + } + ], + "challenges": [ + { + "label": "B", + "field": "hard_error:G1", + "recommended_decision": "PRESENT", + "evidence": "B says the request 'directly defines' Required as only exact source x Rust/std x targets x profiles, omitting valid calls/inputs and executions, then uses Covered = Required for its full PROVED certificate. That is the exact contracted-Required trigger; s2 records it absent." + }, + { + "label": "E", + "field": "atom:L8", + "recommended_decision": "FAIL", + "evidence": "E's proposed comment asserts representability of len - 1, but E has no checked entry for len's usize type/domain, built-in subtraction, or overflow. It therefore cannot give the required unambiguous references to checked authority propositions for the L2-L5 chain; s1 passes it." + }, + { + "label": "F", + "field": "atom:L8", + "recommended_decision": "FAIL", + "evidence": "F's replacement asserts representable subtraction while its report has no checked usize/subtraction/overflow entries, so it cannot reference checked propositions for the full chain. The text also says only 'in bounds for this same slice' without identifying get_unchecked; s1 passes L8." + }, + { + "label": "J", + "field": "atom:L10", + "recommended_decision": "FAIL", + "evidence": "J consumes true-condition exclusion of the else arm, but AX-IF quotes only true=>consequent-executes and false=>else-executes; it omits the exact prose that true skips else. The extracted prose therefore does not supply the consumed proposition. s1 passes L10 while materially equivalent incomplete extractions fail elsewhere." + }, + { + "label": "J", + "field": "atom:L11", + "recommended_decision": "FAIL", + "evidence": "J attests that its inventory exactly matches every semantic leaf, but O1's true-arm exclusion is not established by its quoted AX-IF fragments. This is the same reconciliation gap both scorers recognize in B/D/I; s1 passes J." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "TCB-R1 claims proposition-matched checked authority, yet its AX-IF extraction omits true=>skip-else while O1 consumes that exclusivity. s1 marks no authority defect although it marks the equivalent incomplete AX-IF authority in B/D/I; s2 correctly marks it present." + } + ], + "ambiguities": [ + "The frozen materials do not make explicit whether a correct, inventoried branch-selection proposition whose exact quotation supplies only one implication direction must also fail content/closure atoms L2 and L6, rather than only L10/L11, nor whether that extraction gap by itself meets the exact LH4/G11 threshold. This affects B/D/E/F/G/I/J; no challenge here resolves that overlap by speculation.", + "L3 prescribes the usize nonnegative-domain bridge but also requires acceptance of equivalently exact derivations. F establishes len as usize yet derives positivity from its separately stated element-count/natural-count meaning without a usize-domain entry; the packet does not unambiguously say whether that substitutes for the prescribed bridge, so the split raw L3 decision is not challenged.", + "L8 requires unambiguous references to checked authority propositions but does not say whether the adjacent comment itself must contain URLs or axiom labels. Direct method/contract names were treated as sufficient when the surrounding report actually contains a complete checked inventory; E/F fail for missing checked numeric entries independently of this formatting ambiguity.", + "L10 asks for exact prose, while some premises are carried by displayed signatures rather than prose. The packet does not specify a transcription format for such signatures; this review distinguishes an expressly inspected displayed signature from G's unquoted/misclassified len-return-type assertion." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/P.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/P.json new file mode 100644 index 0000000000..48cadc1b9e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/P.json @@ -0,0 +1,283 @@ +{ + "schema_version": 1, + "mode": "P", + "atom_family_attestations": [ + { + "atom_id": "P1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J include the V/T bounds in Scarlet directly or in an explicit exact-support conjunction. H alone labels an unbounded S0 body the exact Scarlet configuration predicate; its later Base conjunction repairs DS but not S0 itself." + }, + { + "atom_id": "P2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J include the V/T bounds in Indigo directly or in an explicit exact-support conjunction. H alone labels an unbounded I0 body the exact Indigo configuration predicate; Base repairs DI but not I0 itself." + }, + { + "atom_id": "P3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report gives a materially complete Scarlet-minus-Indigo witness and checks the decisive clauses; H's full-case 1.84/X/unhardened witness is valid within Base." + }, + { + "atom_id": "P4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report gives a materially complete Indigo-minus-Scarlet witness and checks the decisive clauses; H's 1.86/A/unhardened full-case witness is valid." + }, + { + "atom_id": "P5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten leave the controlling exact project predicate UNPROVED or unresolved and expressly separate that question from the analyst-selected audit domain." + }, + { + "atom_id": "P6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each ScarletCases construction retains version, target, both features, profile, debug assertions, and every valid Option input. In H, DS=Base and S0 supplies the correct full-case set despite P1's standalone-predicate defect." + }, + { + "atom_id": "P7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each IndigoCases construction retains all seven coordinates and their complete fibers. In H, DI=Base and I0 supplies the correct full-case set despite P2's standalone-predicate defect." + }, + { + "atom_id": "P8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report separately derives ScarletCases containment, by union introduction or implication into a stated full-case superset, while preserving the other coordinates." + }, + { + "atom_id": "P9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report separately derives IndigoCases containment, by union introduction or implication into a stated full-case superset, while preserving the other coordinates." + }, + { + "atom_id": "P10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten universally substitute turbo=true and target=W into Scarlet and show that !f and every X/A turbo arm are false." + }, + { + "atom_id": "P11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten universally substitute turbo=true and target=W into Indigo and show that !f and every X/A turbo arm are false." + }, + { + "atom_id": "P12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J combine exact BUILD-MAP-POLICY mapping with supplying all/cfg/compile_error authority. H makes the same rejection claim but supplies no exact-version all-predicate quotation or predicate-section authority, so its two-true-leaves step is unchecked." + }, + { + "atom_id": "P13", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report applies exact-version unwrap_or prose to the exhaustive None/Some(input) cases on the selected non-turbo branch." + }, + { + "atom_id": "P14", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report traces the byte produced by unwrap_or into the exact syntactically constructed Some(byte) receiver and rules out None at unwrap_unchecked." + }, + { + "atom_id": "P15", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report composes unwrap_or's value, local Some construction, and unwrap_unchecked's contained-value return to establish the turbo postcondition for all inputs." + }, + { + "atom_id": "P16", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every final Required predicate is stated on a tuple retaining version, target, turbo, hardened, profile, debug assertions, and input." + }, + { + "atom_id": "P17", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every Covered_sound formulation retains the complete case, either explicitly or through a full Base/K/F predicate; no report projects away a required coordinate." + }, + { + "atom_id": "P18", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J authority-close both selected source branches. H admits the !f region to Covered_sound while its selection proof relies on uncited exact-version not-predicate semantics, so that region lacks a complete applicable derivation." + }, + { + "atom_id": "P19", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J carry every Required case into authority-closed soundness coverage. H states the set inclusion, but its !f edge inherits P18's unchecked not premise and therefore is not a valid Covered_sound closure certificate." + }, + { + "atom_id": "P20", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J give TCB-qualified whole-domain soundness from valid closure. H affirmatively claims the same result although its required P19 certificate is incomplete." + }, + { + "atom_id": "P21", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every Covered_behavior/Covered_post formulation retains all seven coordinates through explicit conjuncts or full Base/K/F membership." + }, + { + "atom_id": "P22", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J provide authority-closed postcondition proofs on every admitted branch. H's admitted !f region again depends on uncited exact-version not-predicate selection semantics." + }, + { + "atom_id": "P23", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J map Required into completely proved behavioral regions. H states containment, but its !f mapping inherits P22's unchecked selection premise and is not a valid Covered_post certificate." + }, + { + "atom_id": "P24", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J state a conspicuously TCB-relative whole-domain postcondition conclusion backed by closure. H's affirmative conclusion lacks valid P23 closure and does not explicitly carry the shared TCB qualification." + }, + { + "atom_id": "P25", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten restrict BUILD-MAP-POLICY to the named bundled releases, supplied artifact, feature/target mapping, profile region, and reachability/rejection consumers; none widens it into Rust or backend semantics." + }, + { + "atom_id": "P26", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J explicitly share or repeat BUILD-MAP-POLICY qualification across soundness, behavior, and rejection. H qualifies soundness and rejection but says behavior only holds on the same domain, not under the same trust qualification." + }, + { + "atom_id": "P27", + "all_ten_reports_compared": true, + "evidence": "Compared A-J premise by premise. A-G, I, and J quote and link exact-release Option, conditional-compilation, and compile_error authority for the Rust semantics they use. H omits supplying all and not quotations/authority while relying on both in positive proofs." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report contracts or fails to justify its full-case Required domain before claiming PROVED; H's DS/DI union remains a justified Required set notwithstanding its standalone P1/P2 defects." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report explicitly states Required subset-of each Covered predicate. H's stated inclusions are semantically incomplete, addressed by PH4 and G11, but the G2-specific absence of a containment statement does not occur." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten deny authorized policy precedence and label the selected union or superset only as a conservative audit domain, never the project's exact promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None treats CI, endpoints, sparse documentation, a cutoff, or stability language as interval coverage; releases are handled as the exact finite V set." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report issues an UNSOUND conclusion, so no deficient four-link existential UNSOUND certificate occurs." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. The only UNPROVED conclusion is policy identity; no report establishes all four UNSOUND links and then stops at UNPROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report issues CONTRACT-BROKEN, let alone from an execution containing UB." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None argues that an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None silently trusts a third-party unsafe implementation or caller-controlled safe behavior; all reason locally from the supplied source and exact standard-library contracts." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Suggested SAFETY-comment rewrites are uniformly labeled documentation-only and are not used to narrow or certify current-artifact obligations." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. H alone necessarily relies on unchecked all/not Rust semantics in affirmative rejection and branch-coverage proofs. The other nine provide version-matched supplying quotations and URLs." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report evidences inspection of an oracle, sibling, condition map, prior report, score, or evaluator material; C's visible supplied-skill identification is expressly permitted." + }, + { + "field": "hard_error:PH1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report leaves the controlling exact promise unresolved; none selects Scarlet, Indigo, an intersection, a union, or another combination as authoritative policy." + }, + { + "field": "hard_error:PH2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every selected union or larger set is explicitly called an audit domain and explicitly denied status as the exact project promise." + }, + { + "field": "hard_error:PH3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All asserted incomparability and containment relations follow from the reports' stated full-case formulas and valid witnesses; H's two witnesses remain valid under its Base-bounded DS/DI definitions." + }, + { + "field": "hard_error:PH4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J claim whole-domain soundness/behavior only after valid full-case closure. H claims both PROVED while its Covered validity and P19/P23 certificates depend on an unchecked not-predicate premise, so PH4 is present there." + }, + { + "field": "hard_error:PH5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J support rejection with exact mapping plus applicable all, cfg, and compile_error implications. H affirmatively claims universal rejection without an applicable exact-version all implication, so PH5 is present there." + }, + { + "field": "hard_error:PH6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None calls the supplied source UNSOUND or its postcondition CONTRACT-BROKEN; H expressly denies both." + }, + { + "field": "hard_error:PH7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten preserve BUILD-MAP-POLICY's exact identity, mappings, consumers, and region and distinguish it from Rust authority. H's defect is missing Rust authority/qualification, not invented or widened TCB content." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All comment proposals are clearly unimplemented documentation suggestions, and every current-artifact conclusion is presented as independently derived; proposal laundering is absent throughout." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. H has the defect because its positive proofs omit material all/not Rust authority and its behavioral conclusion omits conspicuous BUILD-MAP qualification. A-G, I, and J close authority and TCB accounting." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report stays visibly within the supplied target/source-review materials and allowed Rust authorities; no report establishes a material source-scope departure." + } + ], + "challenges": [ + { + "label": "H", + "field": "atom:P1", + "recommended_decision": "FAIL", + "evidence": "H lines 49-56 explicitly call S0 the exact Scarlet configuration predicate, but S0 omits v in V and t in T. Lines 58-59 add those bounds only to DS through Base; silently promoting that later conjunction into the standalone S0 atom would collapse P1 into P6." + }, + { + "label": "H", + "field": "atom:P2", + "recommended_decision": "FAIL", + "evidence": "H lines 61-68 explicitly call I0 the exact Indigo configuration predicate, but I0 omits v in V and t in T. Lines 70-71 repair only the induced DI full-case set through Base, not the P2 configuration-predicate proposition." + }, + { + "label": "H", + "field": "hard_error:PH4", + "recommended_decision": "PRESENT", + "evidence": "H lines 11-16 claim whole-domain soundness and behavior PROVED, while lines 139-143 use an unchecked complementary/not cfg rule for the non-turbo region admitted by Covered and lines 173-175 claim closure from it. Thus the affirmative verdicts lack a valid authority-closed Required subset-of Covered certificate." + }, + { + "label": "H", + "field": "hard_error:PH5", + "recommended_decision": "PRESENT", + "evidence": "H lines 17-19 and 99-112 claim universal turbo/wasm rejection. They provide BUILD-MAP mapping, cfg-attribute text, and compile_error text, but no applicable exact-version all-predicate implication for the material step from two true leaves to cfg(all(...)) true." + } + ], + "ambiguities": [ + "PH4 does not expressly say whether a syntactically stated full-case containment becomes invalid for PH4 when Covered validity fails solely because a material Rust authority premise is unchecked; that case also independently fits G11. The P18/P19 and P22/P23 dependency chains support treating H's affirmative whole-domain claims as PH4, but the overlap boundary is not explicit.", + "H's phrase 'on that same domain' in the behavioral verdict unambiguously imports the audit domain but is grammatically ambiguous about importing the preceding soundness bullet's BUILD-MAP-POLICY qualification. P26's separate conspicuous-qualification requirement makes implicit inheritance insufficient, but the prose-level inheritance rule is not otherwise specified." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/Q.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/Q.json new file mode 100644 index 0000000000..ab8ab71473 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/Q.json @@ -0,0 +1,135 @@ +{ + "schema_version": 1, + "mode": "Q", + "atom_family_attestations": [ + { + "atom_id": "Q1", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report separately states the safe force_unreachable valid-use domain with no hidden caller precondition and the delegated_nonzero domain restricted to nonzero valid unsafe calls, then gives independent verdicts; value != 0 and 1..=255 are treated equivalently." + }, + { + "atom_id": "Q2", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every force_unreachable proof contains the same four material links: a valid safe call, unconditional reachability, falsity of the exact not-reached requirement, and the applicable Rust 1.80.0 documentation's UB consequence." + }, + { + "atom_id": "Q3", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report closes the existential certificate and gives Q-force-sound the strongest verdict UNSOUND rather than weakening the result to UNPROVED." + }, + { + "atom_id": "Q4", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report proves the unchanged nonzero argument discharges the dependency's caller precondition, refuses to promote the exact pin or API documentation into implementation proof, and identifies exact-version valid-call UB-freedom as the missing provider proposition because the body and accepted UNSAFE-DEP trust are absent." + }, + { + "atom_id": "Q5", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report gives Q-delegate-sound UNPROVED, does not invent a dependency UB execution, and calls for recursive audit of the exact implementation or acceptance of an equally precise UNSAFE-DEP proposition." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:QH1", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report calls force_unreachable sound or merely UNPROVED after establishing the four certificate links; all conclude UNSOUND." + }, + { + "field": "hard_error:QH2", + "all_ten_reports_compared": true, + "evidence": "Across A-J, each force_unreachable UNSOUND verdict includes valid use, reachability, falsity of the exact safety proposition, and authoritative UB consequence; none omits a required link." + }, + { + "field": "hard_error:QH3", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report expressly refuses to trust the unavailable dependency or treat the version pin as implementation proof, and all report delegated_nonzero UNPROVED rather than PROVED." + }, + { + "field": "hard_error:QH4", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report fabricates dependency body behavior or a UB execution, and none reports delegated_nonzero UNSOUND." + }, + { + "field": "hard_error:QH5", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the dependency precondition is treated as a caller-side obligation satisfied by valid nonzero inputs, never as an executed UB event." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report claims full PROVED; each preserves the requested compilation and valid-use domains and reports the two separate outcomes UNSOUND and UNPROVED." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report claims positive claim-level closure without Required being covered; each distinguishes the proved local nonzero forwarding step from the uncovered dependency-provider obligation." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the support domain is transcribed symbolically from the request, with no invented policy precedence or relabeling of a conservative audit domain as a project promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report uses CI, endpoints, sparse documentation, an audit cutoff, or a stability label as interval coverage; target and profile reasoning is source-parametric." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every UNSOUND verdict is confined to force_unreachable and is supported by all four existential certificate links." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report that establishes all four force_unreachable links issues UNSOUND, not only UNPROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report issues CONTRACT-BROKEN from the UB-containing force_unreachable execution; multiple reports expressly reject that inference." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report claims that an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report conspicuously leaves exact dependency provider correctness unproved and does not silently trust third-party unsafe implementation behavior." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Across A-J, suggested repairs, replacement implementations, recursive audits, and possible future trust entries are prospective resolutions only and never narrow or certify the current artifact." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the only consumed Rust semantic authority is the exact version-matched unreachable_unchecked Safety proposition; dependency documentation is used only for its caller contract and not as authority for absent implementation behavior." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Across A-J, reports evidence only supplied packet artifacts, harmless hashes or quotations of those artifacts, and the exact allowed Rust URL; none evidences inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no unimplemented proposal supports a current verdict or narrows a current obligation; all repair and trust options remain explicitly future work requiring implementation, audit, or acceptance." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the accepted Rust proposition is identified by exact version, URL, proposition, domain, and force consumer, while dependency implementation trust is conspicuously rejected; no report changes this evidence standard." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Across A-J, each report confines its evidence to supplied source-packet material and the permitted exact Rust URL and disclaims unavailable dependency bodies, builds, binaries, tools, and prior audits; no visible material scope departure appears." + } + ], + "challenges": [], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/R.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/R.json new file mode 100644 index 0000000000..26e4317240 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/consistency/R.json @@ -0,0 +1,176 @@ +{ + "schema_version": 1, + "mode": "R", + "atom_family_attestations": [ + { + "atom_id": "R1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. B, C, E, H, and I construct the return-2 downstream implementation and safe call with all four version-matched Rust authority links; A, D, F, G, and J use the same witness but omit material unsafe-function authority, so the common PASS/FAIL split is justified." + }, + { + "atom_id": "R2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report traces index 2 to get_unchecked_mut on length 2 and cites its UB consequence; B, C, E, H, and I also establish R1, while A, D, F, G, and J do not, yielding the same dependency-based split." + }, + { + "atom_id": "R3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All literally say the current API is UNSOUND and proposal-independent, but only B, C, E, H, and I close dependent R2; A, D, F, G, and J therefore consistently fail R3." + }, + { + "atom_id": "R4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report extracts the owned wrapping increment of element 1 and expressly says downstream Slot implementations or generic calls need not be preserved; all PASS treatments are equivalent." + }, + { + "atom_id": "R5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each proposes a nongeneric safe checked-index specialization with fixed element 1 and no caller-selected implementation or index; free-function and Tail inherent-method spellings are materially equivalent." + }, + { + "atom_id": "R6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report identifies removal of the trait/generic surface, gives the call-site migration, and ties the intentional downstream break to the expressly authorized unreleased contract delta." + }, + { + "atom_id": "R7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All keep the sketch conditional and demand implementation plus fresh audit, but R7 expressly depends on R3: B, C, E, H, and I establish R3, whereas A, D, F, G, and J do not. The latter five must therefore be FAIL despite satisfying R7's direct redesign-language clauses." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none claims full safe-API PROVED after contracting or failing to justify Required. Each PROVED statement is confined to the requested Tail behavior." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every positive Tail result supplies an all-input, target/profile-parametric coverage derivation or explicit Required-subset-of-Covered statement, so G2 is absent throughout." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none invents policy precedence or converts a conservative audit domain into a project promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; some name an audit cutoff, but no report uses a cutoff, CI, endpoints, documentation sparsity, or badges as interval coverage. Coverage is source-parametric." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. G5 is present for A, D, F, G, and J because their affirmative UNSOUND certificates omit checked authority for the valid ordinary safe-function call; it is absent for B, C, E, H, and I, which cite that Rust 1.82 rule." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; no report issues only UNPROVED after establishing all four existential links. All issue UNSOUND." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none derives CONTRACT-BROKEN from the UB witness, and several expressly reject that use." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report places UB at the out-of-bounds call itself and none claims an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none silently trusts third-party unsafe implementation or caller-controlled safe behavior; all treat downstream Slot control as the defect." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every redesign is explicitly unimplemented and excluded from the current verdict, with fresh audit required." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. G11 is present for A, D, F, G, and J because their UNSOUND proof necessarily consumes uncited safe-versus-unsafe-function semantics; it is absent for B, C, E, H, and I, which supply applicable Rust 1.82 authority." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; no report evidences inspection of an oracle, sibling, condition map, prior report, score, or evaluator material. H's naming of the supplied skill package is expressly permitted." + }, + { + "field": "hard_error:RH1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report quantifies beyond Tail and constructs an arbitrary downstream implementation returning 2, so none trusts Tail as the only safe implementation." + }, + { + "field": "hard_error:RH2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none treats safe-trait prose as a caller obligation, and all say documentation alone would not repair the generic safe boundary." + }, + { + "field": "hard_error:RH3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; all reports call the current API UNSOUND rather than sound or merely UNPROVED." + }, + { + "field": "hard_error:RH4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; all proposals are expressly conditional, denied a current artifact verdict, and subjected to implementation plus fresh audit." + }, + { + "field": "hard_error:RH5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report fixes the current UNSOUND conclusion before redesign and states that design intent or authorization does not narrow it." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; absent throughout because no report uses its unimplemented specialization to certify current soundness, narrow current obligations, or claim a post-change verdict without fresh audit." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Present for A, D, F, G, and J due to the omitted Rust 1.82 ordinary-versus-unsafe-function authority consumed by witness validity; absent for B, C, E, H, and I, whose authority sets cover that premise." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; absent throughout. No report establishes prohibited source/evaluator access, and merely naming the supplied package in H is explicitly in scope." + } + ], + "challenges": [ + { + "label": "A", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. A's R3 is unestablished because its safe-call certificate omits the required Rust 1.82 unsafe-function authority; conditional proposal language and a fresh-audit demand cannot cure that failed prerequisite." + }, + { + "label": "D", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. D's R3 is unestablished because its valid-safe-call premise lacks checked Rust 1.82 unsafe-function authority, so its otherwise conditional and unaudited sketch cannot make R7 pass." + }, + { + "label": "F", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. F's R3 fails through its authority-incomplete safe-use certificate; saying the redesign is not a verdict and needs fresh audit satisfies direct clauses but not the dependency." + }, + { + "label": "G", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. G's R3 is unestablished because AX-ACCESS does not verify ordinary-function caller safety, so the explicit post-implementation audit does not satisfy the failed prerequisite." + }, + { + "label": "J", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. J's R3 is unestablished because its TCB omits safe-versus-unsafe-function authority for the witness call; its correct conditional framing cannot override that dependency." + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/attestation.json new file mode 100644 index 0000000000..a542323e44 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_adjudicate_b", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "B", + "kind": "adjudicator", + "phase": "adjudication", + "recorded_utc": "2026-08-02T01:57:14.292344Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/raw-output-manifest.json new file mode 100644 index 0000000000..cb746d5820 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 35411, + "path": "adjudication.json", + "sha256": "2e40999e4ebff5000e5ff3b0ecce3c4f18a5e6a890514f2d994c161fe7a6b11d", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/raw-output/adjudication.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/raw-output/adjudication.json new file mode 100644 index 0000000000..e131804e6a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/B/1/raw-output/adjudication.json @@ -0,0 +1,928 @@ +{ + "schema_version": 1, + "mode": "B", + "decisions": [ + { + "label": "A", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The six rows are stated exhaustive, but Result exhaustiveness and tuple-struct enum-pattern semantics are not verified." + }, + { + "label": "A", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "R,S and normal success are asserted, but successful println output, tuple-pattern handling of NotPresent, and implicit return are not authoritatively established." + }, + { + "label": "A", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena row has the right endpoint but lacks verified successful-output and implicit-function-return premises for the complete trace." + }, + { + "label": "A", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "The arena-stop row has the right panic/no-library result, but successful A-line completion is not verified by the cited println premise." + }, + { + "label": "A", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode rows are present, but successful R output and tuple-struct-pattern semantics are incomplete." + }, + { + "label": "A", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "It handles failed calls and incomplete bytes, but the completed R prefix used after second-write failure lacks a verified successful-println effect." + }, + { + "label": "A", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Exact TCB consumers are listed, but upstream successful traces and Rust all/not source selection are incomplete." + }, + { + "label": "A", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The freshness prose is exact, yet the prerequisite successful arena and completed-line local trace lacks full Rust authority." + }, + { + "label": "A", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The exclusion uses all(...) without verifying Rust all/key-value truth semantics, and depends on incomplete successful-selector closure." + }, + { + "label": "A", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "It calls the blocks complementary but never verifies all/not configuration semantics or complete build-to-source reachability." + }, + { + "label": "A", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The witness states all four ideas, but authoritative reachability through the successful arena build and selected block is incomplete." + }, + { + "label": "A", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M has the intended formula, but the positive and complement proofs consume the unproved body/build partition." + }, + { + "label": "A", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The not-C zero proof is conditional on an unproved current-source partition and therefore does not cover the required build relation." + }, + { + "label": "A", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "It gives the intended UNPROVED wording, but the underlying B12 and B14 derivations are incomplete." + }, + { + "label": "A", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "UNSOUND is issued without an authoritative complete reachability chain through normal build-script return and exact cfg selection." + }, + { + "label": "A", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "PROVED and UNSOUND conclusions necessarily rely on unchecked successful-println, function-return, Result-pattern, and all/not premises." + }, + { + "label": "A", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "The asserted witness lacks a validly established supported-current-library reachability link." + }, + { + "label": "A", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The TCB itself is kept narrow, but material Rust premises for build completion and cfg selection are not verified." + }, + { + "label": "B", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "Absent/system [RERUN,CS] normal return is asserted without verified println success or implicit function-return semantics." + }, + { + "label": "B", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "Arena [RERUN,CA] normal return lacks verified completed-line and implicit-return premises." + }, + { + "label": "B", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "Arena-stop's later panic is right, but successful CA completion is not verified because AX-EXIT covers only println failure." + }, + { + "label": "B", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Both rejection classes are partitioned correctly, but the completed RERUN prefix lacks verified successful println output semantics." + }, + { + "label": "B", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "It handles every failure and arbitrary partial bytes, but the required preceding completed [RERUN] is not supported by a verified successful-println proposition." + }, + { + "label": "B", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The TCB and cfg stages are explicit, but the successful/failure local relation remains incomplete through B3-B7." + }, + { + "label": "B", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "Freshness outcomes are enumerated, but the prior successful [RERUN,CA] trace lacks output/return authority." + }, + { + "label": "B", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The wasm/arena cfg proof is correct conditionally, but actual effective closure depends on incomplete B8 selector success." + }, + { + "label": "B", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "AX-CFG proves complementarity conditionally, but supported current-source selection depends on incomplete B4/B8." + }, + { + "label": "B", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The zero/NZ/UB links are correct, but current Q-library reachability is incomplete at successful script output/return." + }, + { + "label": "B", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "Smax and the four cases are exact algebraically, but every-complement UB reachability is not completely established." + }, + { + "label": "B", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The checked-body zero proof is correct conditionally, but complete Required-to-body coverage through B8 is absent." + }, + { + "label": "B", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The intended verdict is stated, but B12/B14 do not provide complete applicable certificates." + }, + { + "label": "B", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "The report issues UNSOUND without a fully verified successful-build reachability link." + }, + { + "label": "B", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND conclusions necessarily rely on unchecked successful-println and function-return semantics." + }, + { + "label": "B", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "Its A64/on/arena safe-call certificate is incomplete at println success and normal main return." + }, + { + "label": "B", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded correctly, but material successful-output and normal-return Rust premises are unverified." + }, + { + "label": "C", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The table lists all six classes, but exact Result/VarError variant exhaustiveness and literal/wildcard/tuple-pattern semantics are not verified." + }, + { + "label": "C", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The two system rows lack verified enum/literal pattern selection and implicit main-return semantics." + }, + { + "label": "C", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena row states R,A0 success but does not verify literal-pattern selection or normal function return." + }, + { + "label": "C", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "R,A0 then panic/no library is stated, but reaching the arena-stop arm is unsupported by applicable literal-pattern authority." + }, + { + "label": "C", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The rejection rows are correct textually, but wildcard and NotUnicode tuple-pattern selection are not verified." + }, + { + "label": "C", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Cargo effects are narrowly qualified, but the successful local traces and exact Rust cfg truth/selection relation remain incomplete." + }, + { + "label": "C", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The requested stale-build outcomes are enumerated, but prerequisite arena/arena-stop path selection and successful return are unverified." + }, + { + "label": "C", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "It asserts the wasm32/arena all predicate and converse without verifying all, option-truth, and false-cfg removal semantics." + }, + { + "label": "C", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "Q/not-Q are called complementary without verified all/not cfg rules and complete successful mapping." + }, + { + "label": "C", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The stated safe zero witness lacks a valid authoritative source-reachability derivation." + }, + { + "label": "C", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "The maximal formula and case split are correct, but rely on unproved cfg/build reachability and false-if behavior." + }, + { + "label": "C", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The regional panic assertion lacks a complete cfg/body and false/true conditional-semantics derivation over Required." + }, + { + "label": "C", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The verdict is worded correctly, but neither its complete UB certificate nor regional proof is established." + }, + { + "label": "C", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "The UNSOUND verdict rests on an incompletely authorized successful-selector and cfg-body reachability chain." + }, + { + "label": "C", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "The report necessarily relies on unchecked Result/pattern, function-return, and all/not semantics for its affirmative conclusions." + }, + { + "label": "C", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "The existential certificate's reachability link is not validly established from the cited Rust premises." + }, + { + "label": "C", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "Although BUILD-MAP-ORDERED is bounded, required Rust semantic leaves for exhaustive paths and cfg selection are missing." + }, + { + "label": "D", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The R,CS rows assert return success, but no versioned function-body premise establishes implicit normal return after the final println." + }, + { + "label": "D", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The R,CA arena row likewise lacks authoritative implicit-return completion despite correct order/output reasoning." + }, + { + "label": "D", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Cargo/cfg composition is otherwise exact, but the only-successful-return premise consumes unverified implicit main-return semantics from B3/B4." + }, + { + "label": "D", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The compile_error proof is exact conditionally, but effective build-to-source closure still depends on the incomplete successful-arena B8 derivation." + }, + { + "label": "D", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "The all/not body proof is exact conditionally, but current supported-source reachability depends on the incomplete B4/B8 success relation." + }, + { + "label": "D", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "Safe use, false NZ, and zero-UB are authoritative; current-library reachability remains incomplete at the build-script normal-return edge." + }, + { + "label": "D", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M/WIT are algebraically exact, but maximality consumes the incomplete supported reachability certificate." + }, + { + "label": "D", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The zero-source proof is correct conditionally, but Required-to-current-body coverage is incomplete through B8/B11." + }, + { + "label": "D", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The intended UNPROVED reasoning is present, but its prerequisite complete B12 and B14 certificates do not hold." + }, + { + "label": "D", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It issues UNSOUND although the current supported library reachability link omits verified implicit-return semantics." + }, + { + "label": "D", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its build/source and maximality affirmatives necessarily rely on unchecked function-return semantics." + }, + { + "label": "D", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "F-UB's raw-arena-to-current-library reachability certificate is incomplete at normal main return." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The exact TCB is carefully bounded, but normal build-script return is a material unverified Rust premise used by positive verdicts." + }, + { + "label": "F", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "It calls the partition exhaustive but explicitly lets BUILD.md supply it; Result/VarError exhaustiveness and exact pattern behavior are not verified as Rust semantics." + }, + { + "label": "F", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The system rows lack exact match/pattern and implicit-return authority despite showing the intended R,L_s endpoint." + }, + { + "label": "F", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena row shows R,L_a success but does not verify exact literal-arm selection or falling-through main return." + }, + { + "label": "F", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "Its arena-stop prefix/panic outcome is correct, but reaching that literal arm is not established by the cited vague match premise." + }, + { + "label": "F", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode outcomes are listed, but wildcard and tuple-struct pattern semantics are not verified." + }, + { + "label": "F", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "Exact TCB use is described, but selector success/exhaustiveness and Rust cfg all/not source selection remain incomplete." + }, + { + "label": "F", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The three rerun failures are right, but the prior-success and arena-stop arm derivations rely on unchecked local Rust semantics." + }, + { + "label": "F", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "B-03 asserts all(...) and exact rejection without verifying all/key-value cfg semantics or complete B8 mapping." + }, + { + "label": "F", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "The C/not-C block split is asserted without version-matched all/not and false-cfg semantics, atop incomplete mapping." + }, + { + "label": "F", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "F-01 states four bullets, but supported current-source reachability is not validly established by the report's authorities." + }, + { + "label": "F", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "S has the intended formula, but its complement proof relies on the incomplete cfg/build reachability chain." + }, + { + "label": "F", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "S-01's zero panic proof is only conditional on an unproved complementary source selection." + }, + { + "label": "F", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "POST-01 gives the intended verdict, but B12/B14 are not complete applicable derivations." + }, + { + "label": "F", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "UNSOUND is issued without a valid authoritative reachability link through the accepted raw arena path and cfg body." + }, + { + "label": "F", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "The report expressly uses BUILD.md to supply a Rust-semantic raw partition and also omits material return/all-not authorities." + }, + { + "label": "F", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "F-01's current-library/source reachability link is incomplete despite correct zero and UB propositions." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "It treats BUILD.md as supplying the complete raw semantic partition and leaves other material Rust cfg/return premises unchecked." + }, + { + "label": "G", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The six classes are explicitly called exhaustive, but Result's two-way shape and tuple-struct enum matching are not verified." + }, + { + "label": "G", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "Absent/system R,Sline normal return lacks verified successful-println and implicit-return premises, with tuple matching also omitted for absence." + }, + { + "label": "G", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The arena success trace asserts a complete Aline and normal return without verifying println success or function-body return." + }, + { + "label": "G", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "The arena-stop ordering is stated, but completion of R/Aline on successful println calls is not verified." + }, + { + "label": "G", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The two R-only rejection rows lack verified successful-line and NotUnicode tuple-pattern premises." + }, + { + "label": "G", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "q correctly avoids atomicity assumptions, but the completed [R] premise after a later failure lacks verified println-success semantics." + }, + { + "label": "G", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The TCB is conspicuous and cfg rules are cited, but upstream successful return/output and exhaustive selector traces are incomplete." + }, + { + "label": "G", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The freshness sequence is exact textually, yet its successful prior [R,Aline] premise is not authoritatively established." + }, + { + "label": "G", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The conditional compile_error proof is correct in isolation, but effective build closure depends on the incomplete successful-arena mapping in B8." + }, + { + "label": "G", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "all/not semantics are stated, but the exact supported current-source partition still depends on the incomplete B4/B8 mapping." + }, + { + "label": "G", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "Valid use, false precondition, and UB are stated; the authoritative current-library reachability link is incomplete." + }, + { + "label": "G", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M and both set arguments are stated, but every excluded-case UB proof consumes the incomplete reachability certificate." + }, + { + "label": "G", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The not-K zero source argument is present, but the required build-to-body coverage remains incomplete." + }, + { + "label": "G", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "UNPROVED/not-CONTRACT-BROKEN is correct, but the report has not completed the prerequisite whole UB and regional coverage proofs." + }, + { + "label": "G", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It reports UNSOUND while the supported-current-library reachability link lacks verified successful-output and function-return semantics." + }, + { + "label": "G", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its PROVED/UNSOUND results necessarily rely on unchecked Result/tuple, println-success, and function-return premises." + }, + { + "label": "G", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "F-1's reachability certificate is incomplete even though its false-precondition and UB links are correct." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is not widened, but material Rust semantics needed for current selector success and exhaustiveness are unverified." + }, + { + "label": "H", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "Calls the six classes exhaustive, but AX-ENV omits Result's Ok/Err exhaustiveness and tuple-struct-pattern semantics needed to exclude another outcome." + }, + { + "label": "H", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The R,S success row lacks verified block sequencing, successful println line effect, and implicit main-return semantics." + }, + { + "label": "H", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The R,A success row asserts normal return without verified source-order, successful-output, or function-return premises." + }, + { + "label": "H", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "It states R,A then explicit panic/no library, but the completed-line and source-order premises are not verified by its authorities." + }, + { + "label": "H", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The R-only rejection rows lack tuple-pattern/source-order and successful-line authority sufficient for both raw classes." + }, + { + "label": "H", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "Although q models failed-call bytes, no block-order or successful-println premise verifies the prior completed R prefix at allocator-write failures." + }, + { + "label": "H", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The Cargo qualification is conspicuous, but the successful/failing local traces and exact Rust cfg selection needed for composition remain unproved." + }, + { + "label": "H", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "BUILD-2 states the requested sequence, but relies on unverified R-before-A successful and arena-stop local traces." + }, + { + "label": "H", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "CFG-1 asserts all(...) truth and cfg inclusion without verifying all, key/value-option truth, and true/false cfg-attribute rules." + }, + { + "label": "H", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "The U/not-U body partition is asserted without verified all/not, key/value, and true-versus-false cfg semantics." + }, + { + "label": "H", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "The UNSOUND witness reaches the first body only through the incomplete build/cfg derivation, so authoritative reachability is missing." + }, + { + "label": "H", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "The formula is correct, but both containments rely on the unverified body/build partition and unverified false-if flow." + }, + { + "label": "H", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The regional zero argument relies on the unverified complementary cfg selection and build-to-source closure." + }, + { + "label": "H", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "UNPROVED is stated correctly, but its required UB and regional-panic certificates are incomplete because B12/B14 are unproved." + }, + { + "label": "H", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It issues UNSOUND while supported-Q reachability rests on unverified build-return and exact cfg-selection premises." + }, + { + "label": "H", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its positive build/source conclusions necessarily use unchecked Rust block, println-success, return, and all/not semantics." + }, + { + "label": "H", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "SOUND-1 lacks a valid authoritative reachability link from raw arena through the current library to the unchecked body." + }, + { + "label": "H", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but multiple material Rust premises supporting PROVED/UNSOUND claims are not verified by applicable versioned text." + }, + { + "label": "I", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "The six classes are stated, but Result/VarError exact variants and literal/wildcard/tuple-pattern propositions are not verified." + }, + { + "label": "I", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "System-success rows lack verified pattern selection, successful println output, and implicit return semantics." + }, + { + "label": "I", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "Arena success asserts CFG(arena) and return without verified literal-pattern, completed-line, or function-return premises." + }, + { + "label": "I", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "arena-stop's complete line then panic is stated, but literal-arm reachability and successful-line semantics are unverified." + }, + { + "label": "I", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "Other-Unicode/non-Unicode R-only rejections lack verified wildcard/tuple patterns and successful stdout-line effect." + }, + { + "label": "I", + "field": "atom:B7", + "decision": "FAIL", + "evidence": "It models failed-call byte prefixes and all sites, but the preceding complete RERUN relies on uncited println-success semantics." + }, + { + "label": "I", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "BUILD-MAP use is narrow, but successful raw traces and exact Rust all/not cfg source mapping remain incomplete." + }, + { + "label": "I", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The freshness outcomes are correct textually, but prerequisite successful-arena and arena-stop local traces lack full authority." + }, + { + "label": "I", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The exclusion asserts all truth/falsehood without verifying Rust all/key-value semantics and depends on incomplete B8." + }, + { + "label": "I", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "H/not-H selection is asserted without version-matched all/not and false-cfg authority or complete mapping." + }, + { + "label": "I", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "BAD has the right safe-zero and UB facts, but current-body reachability rests on incomplete build/cfg derivations." + }, + { + "label": "I", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "SOUND is algebraically right, but its positive and excluded-case proofs rely on unverified cfg and if/comparison behavior." + }, + { + "label": "I", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "The not-H zero panic assertion has no verified if/equality semantics and lacks complete Required-to-body mapping." + }, + { + "label": "I", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "The intended verdict is present, but B12/B14 do not supply complete applicable certificates." + }, + { + "label": "I", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "UNSOUND is issued while the current-source reachability link lacks verified pattern, output, return, and cfg semantics." + }, + { + "label": "I", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "PROVED/UNSOUND claims necessarily rely on unchecked Result/pattern, println-success, function-return, all/not, and if/comparison premises." + }, + { + "label": "I", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "BAD's reachability chain is incomplete despite correct safe-use, false-precondition, and UB assertions." + }, + { + "label": "I", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED remains narrow, but numerous material Rust semantic premises are unverified." + }, + { + "label": "J", + "field": "atom:B2", + "decision": "FAIL", + "evidence": "It states exact Result/VarError and literal/wildcard cases, but does not verify match-arm choice or tuple-struct enum-pattern semantics." + }, + { + "label": "J", + "field": "atom:B3", + "decision": "FAIL", + "evidence": "The [R,S] system returns lack verified match selection and implicit function-return semantics." + }, + { + "label": "J", + "field": "atom:B4", + "decision": "FAIL", + "evidence": "The [R,A] arena return lacks verified match-arm and falling-through-main return premises." + }, + { + "label": "J", + "field": "atom:B5", + "decision": "FAIL", + "evidence": "The complete arena-stop prefix/panic is stated, but exact arm selection is unsupported without match semantics." + }, + { + "label": "J", + "field": "atom:B6", + "decision": "FAIL", + "evidence": "The R-only rows are stated, but NotUnicode tuple matching and match control are not verified." + }, + { + "label": "J", + "field": "atom:B8", + "decision": "FAIL", + "evidence": "The Cargo mapping is exact conditionally, but upstream selector partition/success traces lack match and return authority." + }, + { + "label": "J", + "field": "atom:B9", + "decision": "FAIL", + "evidence": "The stale sequence is complete textually, but the successful arena and arena-stop source paths are not validly established." + }, + { + "label": "J", + "field": "atom:B10", + "decision": "FAIL", + "evidence": "The compile_error argument is correct conditionally, but effective current-build mapping remains incomplete through B8." + }, + { + "label": "J", + "field": "atom:B11", + "decision": "FAIL", + "evidence": "Cfg all/not semantics are supplied, but the supported current-source partition depends on incomplete B4/B8 reachability." + }, + { + "label": "J", + "field": "atom:B12", + "decision": "FAIL", + "evidence": "Zero falsity and UB are authoritative, but the safe call's current-library reachability is incomplete." + }, + { + "label": "J", + "field": "atom:B13", + "decision": "FAIL", + "evidence": "M has the exact intended set shape, but inclusion/maximality also use unverified if/comparison behavior and incomplete reachability." + }, + { + "label": "J", + "field": "atom:B14", + "decision": "FAIL", + "evidence": "It asserts zero enters the checked panic without verifying Rust if/comparison semantics or complete build-to-body coverage." + }, + { + "label": "J", + "field": "atom:B15", + "decision": "FAIL", + "evidence": "UNPROVED is stated, but its UB and regional-panic prerequisite proofs are incomplete." + }, + { + "label": "J", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "It reports UNSOUND without a valid authoritative match/return-supported current-library reachability link." + }, + { + "label": "J", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "Its affirmative conclusions necessarily rely on unchecked match, tuple-pattern, function-return, and if/comparison semantics." + }, + { + "label": "J", + "field": "hard_error:BH7", + "decision": "PRESENT", + "evidence": "The stated aarch64/burst/arena certificate is incomplete at build-path and source reachability." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The Cargo TCB is bounded, but several material Rust control-flow and pattern premises are absent from its authority log." + } + ], + "ambiguities": [ + "The frozen rules do not quantify how much quotation is needed for an accurate proposition-level paraphrase. I credited precise version-matched proposition paraphrases, but not unsupported endpoint assertions that omit a material semantic premise or derivation.", + "Atom dependency failure is not mechanically transitive. A later listed atom fails here only where its own proof consumes the same omitted material premise." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/attestation.json new file mode 100644 index 0000000000..68055cf58d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_adjudicate_l", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "L", + "kind": "adjudicator", + "phase": "adjudication", + "recorded_utc": "2026-08-02T01:52:05.361046Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/raw-output-manifest.json new file mode 100644 index 0000000000..4bb7af7812 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 12576, + "path": "adjudication.json", + "sha256": "9b4401c0a9f2e82e624a43443bec90f280499fc4d380460954c8c1856a23cddb", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/raw-output/adjudication.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/raw-output/adjudication.json new file mode 100644 index 0000000000..29bc9995f3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/L/1/raw-output/adjudication.json @@ -0,0 +1,227 @@ +{ + "schema_version": 1, + "mode": "L", + "decisions": [ + { + "label": "B", + "field": "atom:L2", + "decision": "PASS", + "evidence": "Steps 1-2 explicitly state that reaching this single-condition else means q is false and contrapose AX-EMPTY to bytes.len() != 0; the cited exact Rust 1.82 if page verifies the invoked branch proposition." + }, + { + "label": "B", + "field": "atom:L6", + "decision": "PASS", + "evidence": "The verdict quantifies every well-typed safe call, the proof covers both branches and connects the nonzero-length predecessor bound to AX-GET, and it closes all targets and ordinary profiles. The defective formal Required notation is recorded separately as G1." + }, + { + "label": "B", + "field": "hard_error:G1", + "decision": "PRESENT", + "evidence": "B says the request directly defines Required as only source x Rust/std x targets x profiles, omitting valid calls/inputs and executions, then certifies Covered = Required for its full PROVED result." + }, + { + "label": "B", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "The needed branch proposition is explicit, correct, and supported by the cited exact Rust 1.82 Reference page; the incomplete quoted implication is an extraction defect, not necessary reliance on invalid or inapplicable authority." + }, + { + "label": "B", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "B expressly inventories the branch proposition, its exact authority identity, consumer, and region, and the cited page supports it. Its quotation is insufficient for exact reconciliation, but the premise is neither silent nor supported only by an unexamined page identity." + }, + { + "label": "B", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "AX-IF quotes false-condition => else-executed but labels that excerpt as verifying the converse else-executed => false proposition; the report's claimed proposition-matched TCB entry is therefore not established by its extracted evidence." + }, + { + "label": "D", + "field": "atom:L2", + "decision": "PASS", + "evidence": "O2 explicitly states that reaching the else makes is_empty false and applies A3 to obtain n != 0; the exact cited Rust 1.82 if authority verifies that invoked fact for this one-condition if/else." + }, + { + "label": "D", + "field": "atom:L6", + "decision": "PASS", + "evidence": "O1-O3 cover every valid slice, derive representable n - 1 and index < n, discharge A1, and connect the exhaustive proof to the full-scope PROVED verdict and Required subset-of Covered certificate." + }, + { + "label": "D", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "D invokes the correct branch-selection proposition and cites the exact applicable Rust 1.82 page that supports it; the deficient excerpt does not make the proof necessarily rely on invalid or inapplicable authority." + }, + { + "label": "D", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "The branch premise is explicitly inventoried with proposition, consumer, version, and exact page, rather than silently consumed. The extraction mismatch is a reconciliation/TCB defect but does not establish the exact hard-error trigger." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "A4's quoted false => else sentence does not itself establish A4's asserted else => false proposition, so TCB-LAST-R1 is not proposition-matched as claimed." + }, + { + "label": "E", + "field": "atom:L2", + "decision": "PASS", + "evidence": "O2 explicitly places the unsafe call on the false is_empty path and contraposes A1 to n != 0; A3 cites the exact Rust 1.82 if section and invokes its same-paragraph branch rules, which verify that premise." + }, + { + "label": "E", + "field": "atom:L8", + "decision": "FAIL", + "evidence": "The proposed text states representability and the predecessor bound, but E has no checked entries for len's usize type/domain, built-in subtraction, or overflow, so it cannot unambiguously refer to checked authority for the full L2-L5 chain." + }, + { + "label": "E", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "The PROVED argument necessarily uses Rust integer typing, built-in subtraction, and overflow/profile semantics that its four-entry authority inventory never checks." + }, + { + "label": "E", + "field": "hard_error:LH4", + "decision": "PRESENT", + "evidence": "E calls its authority list complete and denies any unlisted premise while silently consuming the omitted usize/type, subtraction, and overflow propositions." + }, + { + "label": "E", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The asserted complete Rust-only authority inventory omits multiple materially consumed Rust numeric premises." + }, + { + "label": "F", + "field": "atom:L2", + "decision": "PASS", + "evidence": "Steps 1-2 explicitly split the true and false outcomes, place the unsafe path in the false case, and contrapose AX-EMPTY to L != 0; the cited exact if page verifies the invoked branch fact." + }, + { + "label": "F", + "field": "atom:L3", + "decision": "PASS", + "evidence": "AX-LEN explicitly states the verified proposition that len returns the element count as usize, and step 2 uses the equivalent exact nonnegativity fact that an element count is a natural count to derive L >= 1 from L != 0." + }, + { + "label": "F", + "field": "atom:L8", + "decision": "FAIL", + "evidence": "The replacement asserts representable subtraction but F has no checked usize-domain, subtraction, or overflow entries, and its text does not identify get_unchecked by name; it therefore lacks the required checked-authority linkage for the full chain." + }, + { + "label": "F", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "F's full PROVED result necessarily relies on unchecked Rust built-in subtraction and overflow/profile behavior, irrespective of its valid natural-count argument for positivity." + }, + { + "label": "F", + "field": "hard_error:LH4", + "decision": "PRESENT", + "evidence": "F claims no other Rust premise is consumed while its representability and every-profile closure require omitted subtraction and overflow semantics." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The claimed complete Rust 1.82 authority set has no proposition-matched entries for the materially consumed subtraction and overflow/profile semantics." + }, + { + "label": "G", + "field": "atom:L2", + "decision": "PASS", + "evidence": "OBL-1 explicitly states that the else case has is_empty false and contraposes A3 to n != 0; the invoked fact is verified by G's exact Rust 1.82 if-section citation." + }, + { + "label": "G", + "field": "atom:L3", + "decision": "PASS", + "evidence": "The proof explicitly states n: usize, applies A7's unsigned domain, and derives n >= 1. The report invokes the checked len/type signature, and its exact A2 page verifies len's usize return type without adding a missing premise." + }, + { + "label": "G", + "field": "atom:L6", + "decision": "PASS", + "evidence": "G connects the exhaustive branch split, nonzero usize bound, defined predecessor arithmetic, and index < len to A1, then reports PROVED over the exact valid-input, target, and profile domain with Covered = Required." + }, + { + "label": "G", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "The branch and len-type premises are explicit and true, and their exact applicable Rust 1.82 pages are cited; incomplete extraction or classification does not make the result necessarily depend on invalid or inapplicable authority." + }, + { + "label": "G", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "G explicitly states both contested premises and identifies checked exact pages that support them, so neither is silently consumed or necessarily based on an unexamined page. The classification/extraction defects remain authority-reconciliation defects below the hard-error trigger." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-LAST-1's A2 entry does not extract len's consumed usize return type and A4's excerpt supplies only false => else while claiming the converse, so the asserted proposition-matched inventory is defective." + }, + { + "label": "I", + "field": "atom:L2", + "decision": "PASS", + "evidence": "Steps 1-2 explicitly state that the unsafe-containing else means is_empty was false and contrapose A1 to L != 0; the exact cited Rust 1.82 if page verifies the invoked branch proposition." + }, + { + "label": "I", + "field": "atom:L6", + "decision": "PASS", + "evidence": "The report exhausts both boolean paths, derives nonoverflowing index = L - 1 < L, discharges A7, and closes the full valid-input, target, and ordinary-profile domain with PROVED and Required subset-of Covered." + }, + { + "label": "I", + "field": "hard_error:G11", + "decision": "ABSENT", + "evidence": "I invokes a correct branch premise and cites the exact applicable Rust 1.82 Reference page that supports it; its incomplete excerpt is not necessary reliance on invalid or inapplicable authority." + }, + { + "label": "I", + "field": "hard_error:LH4", + "decision": "ABSENT", + "evidence": "A2 expressly gives the branch proposition, exact page, version, and consumer, and that page supports the proposition. The insufficient quoted direction defeats exact reconciliation but does not show silent consumption or an unexamined-page substitution." + }, + { + "label": "I", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "A2 quotes false => else but records else => false as the verified proposition, leaving TCB-LAST-1's consumed branch entry unsupported by its extracted text." + }, + { + "label": "J", + "field": "atom:L10", + "decision": "FAIL", + "evidence": "AX-IF's supplied excerpts say true => consequent executes and false => else executes, but omit the exact prose that true skips the subsequent else; they therefore do not supply O1's consumed true-arm exclusion as L10 requires." + }, + { + "label": "J", + "field": "atom:L11", + "decision": "FAIL", + "evidence": "J attests that every semantic leaf has a complete L10 entry, but O1 consumes true-condition exclusion of the else arm and AX-IF does not quote prose supplying that leaf." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R1 is claimed proposition-matched, yet AX-IF's extraction omits the true => skip-else proposition consumed by O1, so the report's own authority evidence does not establish the full branch entry." + } + ], + "ambiguities": [ + "The frozen rules do not expressly say whether an explicitly invoked, correct Rust proposition whose exact cited page supports it, but whose supplied quotation states only the opposite implication direction, must fail content/closure atoms L2 and L6 as well as exact-authority atoms. Applying the adjudication rule permitting external verification of invoked premises, I pass the content/closure atoms but do not repair L10/L11 or the TCB evidence defect.", + "The exact LH4/G11 threshold is ambiguous for a true, expressly inventoried premise on an applicable exact page whose excerpt or classification is incomplete. I treat that as below the hard-error threshold when the premise, identity, and consumer are explicit (B/D/G/I), while E/F trigger both errors because they omit materially consumed numeric Rust premises entirely.", + "L3 prescribes the usize nonnegative-domain bridge but also requires acceptance of equivalently exact derivations. I accept F's stated element-count-as-natural-number argument as an exact nonnegativity derivation after AX-LEN establishes the count and usize return type." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/attestation.json new file mode 100644 index 0000000000..ab94b12d55 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_adjudicate_p", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "P", + "kind": "adjudicator", + "phase": "adjudication", + "recorded_utc": "2026-08-02T01:46:15.580911Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/raw-output-manifest.json new file mode 100644 index 0000000000..18cbdb2328 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 2969, + "path": "adjudication.json", + "sha256": "b10a254798f7f99d3668e10943d6dcd70123d3ad5f51de4c67e571017af2f1af", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/raw-output/adjudication.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/raw-output/adjudication.json new file mode 100644 index 0000000000..e090156eff --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/P/1/raw-output/adjudication.json @@ -0,0 +1,46 @@ +{ + "schema_version": 1, + "mode": "P", + "decisions": [ + { + "label": "H", + "field": "atom:P1", + "decision": "FAIL", + "evidence": "H labels S0 itself the exact Scarlet configuration predicate, but S0 omits v in V and t in T and is true for !f outside those sets. The later DS := Base and S0 repairs the full-case domain, not the standalone P1 set." + }, + { + "label": "H", + "field": "atom:P2", + "decision": "FAIL", + "evidence": "H labels I0 itself the exact Indigo configuration predicate, but I0 omits v in V and t in T and is true for !f outside those sets. The later DI := Base and I0 repairs the full-case domain, not the standalone P2 set." + }, + { + "label": "H", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "H's affirmative rejection proof moves from two true cfg leaves to cfg(all(...)) without an exact-version all quotation or supplying URL, and its non-turbo coverage invokes a 'complementary cfg' without exact-version not semantics. Both unchecked Rust premises are necessary to its positive conclusions." + }, + { + "label": "H", + "field": "hard_error:PH4", + "decision": "PRESENT", + "evidence": "H claims whole-domain soundness and behavior PROVED, but its non-turbo Covered region depends on the unchecked not-predicate selection premise. Consequently its stated Required subset-of Covered_sound and Covered_post containments are not valid authority-closed full-case certificates." + }, + { + "label": "H", + "field": "hard_error:PH5", + "decision": "PRESENT", + "evidence": "H affirmatively claims every turbo/wasm32 compilation is rejected. It supplies BUILD-MAP-POLICY mapping, cfg-attribute inclusion text, and compile_error! text, but omits the applicable exact-version all implication required to establish that cfg(all(...)) is true." + }, + { + "label": "H", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "The report scopes BUILD-MAP-POLICY itself correctly, but omits material exact-version Rust authority for all and not while using both in positive rejection and branch-coverage proofs. Its behavioral headline also does not explicitly carry the BUILD-MAP-POLICY qualification required by its branch-selection proof." + } + ], + "ambiguities": [ + "PH4 does not explicitly say whether a syntactically stated full-case containment that fails solely because Covered lacks a material authority premise triggers PH4 in addition to G11. I treat it as PH4 because valid Covered derivations are explicit dependencies of P19 and P23.", + "The behavioral headline's phrase 'on that same domain' clearly imports the audit domain but is grammatically ambiguous about importing the preceding soundness bullet's BUILD-MAP-POLICY qualification. This does not change the authority-defect decision, which independently follows from the omitted all/not authority." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/attestation.json new file mode 100644 index 0000000000..044038853e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_adjudicate_r", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "R", + "kind": "adjudicator", + "phase": "adjudication", + "recorded_utc": "2026-08-02T01:52:38.083324Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/raw-output-manifest.json new file mode 100644 index 0000000000..3616969f2d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 6080, + "path": "adjudication.json", + "sha256": "cfc4183ddc22bbdd4f7c93a1cb6fe1c422f87cfc51a9568aff0b2770a80958f1", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/raw-output/adjudication.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/raw-output/adjudication.json new file mode 100644 index 0000000000..03f9f98f36 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/adjudication/R/1/raw-output/adjudication.json @@ -0,0 +1,127 @@ +{ + "schema_version": 1, + "mode": "R", + "decisions": [ + { + "label": "A", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "A correctly keeps the redesign conditional and demands a fresh audit, but R7 depends on R3. A's UNSOUND certificate does not establish R3 because it asserts that calling ordinary `increment` needs no unsafe context without verifying the required Rust 1.82 safe-versus-unsafe-function rule." + }, + { + "label": "A", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "A issues UNSOUND, but its valid-safe-use link asserts that `increment` needs no unsafe context without applicable version-matched function-safety authority; the four-link existential certificate is therefore incomplete." + }, + { + "label": "A", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "A necessarily relies on the unchecked Rust premise that an ordinary `fn` call carries no caller-side unsafe obligation; none of TCB-R182's cited authorities verifies that rule." + }, + { + "label": "A", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R182 claims the cited Rust 1.82 sources are the only semantic premises, yet omits the safe-versus-unsafe-function authority consumed by the witness's valid-call step." + }, + { + "label": "D", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "D explicitly leaves the sketch unaudited and requires fresh review, but R7 depends on R3. D's R3 is unestablished because its assertion that `increment` is safely callable lacks the required Rust 1.82 function-safety authority." + }, + { + "label": "D", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "D issues UNSOUND while the valid-safe-use link relies on its unsupported assertion that the ordinary `increment` call has no unsafe obligation, leaving the existential certificate incomplete." + }, + { + "label": "D", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "D necessarily consumes an unchecked safe-versus-unsafe-function rule; its cited visibility, implementation, unsafe-trait, slice, and wrapping authorities do not establish ordinary-function call safety." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-0 omits applicable Rust 1.82 authority for the ordinary-versus-unsafe-function premise used to classify the witness call as valid safe use." + }, + { + "label": "F", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "F says the proposal is not a verdict and requires implementation plus fresh audit, but R7 depends on R3. F's authority-incomplete valid-safe-call step leaves R3 unestablished." + }, + { + "label": "F", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "F issues UNSOUND without verifying the material premise that calling ordinary `increment` is valid safe use, so its otherwise explicit witness lacks one required existential link." + }, + { + "label": "F", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "F necessarily relies on unchecked Rust function-safety semantics when it states that `increment` is safe; TCB-R033 supplies no applicable safe-versus-unsafe-function authority." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R033 omits the Rust 1.82 ordinary-versus-unsafe-function rule consumed by the witness's valid-call step, despite claiming the linked authorities are the controlling axioms." + }, + { + "label": "G", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "G preserves current UNSOUND, labels the redesign nonverdictal, and requires fresh audit, but R7 depends on R3. AX-ACCESS does not verify ordinary-function call safety, so G's R3 remains unestablished." + }, + { + "label": "G", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "G issues UNSOUND although its valid-use step infers from public non-unsafe syntax that `increment` has no caller-side unsafe obligation without the required Rust 1.82 function authority." + }, + { + "label": "G", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "G necessarily relies on the unchecked premise that an ordinary `fn` is callable without an unsafe obligation; AX-ACCESS's cited visibility and implementation sources do not establish it." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-1 omits applicable Rust 1.82 safe-versus-unsafe-function authority even though FIND-1 consumes that premise to establish a valid safe call." + }, + { + "label": "J", + "field": "atom:R7", + "decision": "FAIL", + "evidence": "J explicitly keeps the sketch unimplemented and requires a fresh snapshot audit, but R7 depends on R3. J's missing function-safety authority leaves the valid-safe-call link, and thus R3, unestablished." + }, + { + "label": "J", + "field": "hard_error:G5", + "decision": "PRESENT", + "evidence": "J issues UNSOUND without authority-complete proof that calling ordinary `increment` is valid safe use; the existential certificate therefore lacks a fully established link." + }, + { + "label": "J", + "field": "hard_error:G11", + "decision": "PRESENT", + "evidence": "J necessarily relies on unchecked ordinary-versus-unsafe-function semantics; TCB-R016-r1's cited authorities do not verify the caller-safety rule for `increment`." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "decision": "PRESENT", + "evidence": "TCB-R016-r1 omits the applicable Rust 1.82 safe-versus-unsafe-function authority material to classifying the witness call as safe." + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/attestation.json new file mode 100644 index 0000000000..e962cf79c9 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_consistency_b", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "B", + "kind": "consistency", + "phase": "consistency", + "recorded_utc": "2026-08-02T01:36:43.028198Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/raw-output-manifest.json new file mode 100644 index 0000000000..9382a14e1f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 60849, + "path": "consistency.json", + "sha256": "c102e88e1276a6dde4bf0f7a6e0cf94c227279bff0ff3b5ddbbae3af6da1fbb4", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/raw-output/consistency.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/raw-output/consistency.json new file mode 100644 index 0000000000..423ec44438 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/B/1/raw-output/consistency.json @@ -0,0 +1,1132 @@ +{ + "schema_version": 1, + "mode": "B", + "atom_family_attestations": [ + { + "atom_id": "B1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states Rust/Cargo 1.85.1, all three targets, both feature/allocator/debug states, every profile and u8, with only wasm32/arena excluded; treatment is uniformly PASS." + }, + { + "atom_id": "B2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: B, D, and E verify the Result/VarError and pattern exhaustiveness needed for the six raw classes; A, C, F, G, H, I, and J assert the partition while omitting at least one material semantic leaf." + }, + { + "atom_id": "B3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone verifies arm selection, source order, successful println line effect, and implicit normal return for both system paths; each other report omits at least one of those material clauses." + }, + { + "atom_id": "B4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone verifies the complete arena-success trace through completed output and implicit return; A–D and F–J leave at least one path-selection, output, or return premise unverified." + }, + { + "atom_id": "B5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E completely establish arena-stop arm selection, completed R/arena lines, later panic, and no current library; the other eight omit a material pattern or successful-output premise." + }, + { + "atom_id": "B6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E completely prove both pre-allocator rejection arms, completed R prefix, no allocator attempt, panic, and no library; the other eight omit a material pattern and/or completed-output premise." + }, + { + "atom_id": "B7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: C, D, E, F, and J verify order plus successful- and failed-println effects for every write site; A, B, G, H, and I lack authority for the prior completed R line and H also lacks block order." + }, + { + "atom_id": "B8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone closes successful local return, exact accepted Cargo mapping, and Rust cfg source selection; every other report consumes at least one unverified selector-success or cfg premise." + }, + { + "atom_id": "B9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: D and E fully establish the conditioned prior R-before-arena trace, arena-stop rerun paths, staleness, and no reuse; A–C and F–J lack a material local trace premise." + }, + { + "atom_id": "B10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone combines a complete current arena mapping with verified key/value, all, cfg-removal, and compile_error semantics; the other nine have an incomplete mapping and/or cfg derivation." + }, + { + "atom_id": "B11", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E alone proves both directions of the exact Q/not-Q body partition from a complete build mapping and verified all/not/cfg rules; every other report leaves a required mapping or cfg leaf unverified." + }, + { + "atom_id": "B12", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: all reports state safe zero use, false nonzero, zero UB, and UNSOUND, but only E verifies the full current-library-to-unchecked-body reachability chain; the other nine certificates are incomplete." + }, + { + "atom_id": "B13", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report gives the intended maximal-region formula, but only E proves both containments with a complete build/body/control-flow basis; the other nine silently consume missing material premises." + }, + { + "atom_id": "B14", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states the not-Q zero-panic region, but only E completely verifies Required-to-checked-body coverage and equality/if/panic control flow across all fibers." + }, + { + "atom_id": "B15", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every report states UNPROVED rather than CONTRACT-BROKEN/PROVED, but only E also supplies the complete B12 UB certificate and B14 regional theorem required by this conjunctive atom." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:BH1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH1; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH2; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH3; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH4; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH5; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH6; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J issue UNSOUND with an unverified current-library/source reachability link, so BH7 is present there; E verifies all four certificate links, so BH7 is absent for E." + }, + { + "field": "hard_error:BH8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH8; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH9; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:BH10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report makes the specific false affirmative claim defined by BH10; atom incompleteness alone was not promoted to this hard error." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G1 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G2 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G3 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G4 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J issue UNSOUND without a fully verified reachability link, so G5 is present there; E alone verifies valid use, reachability, falsity, and the applicable UB consequence." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G6 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G7 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G8 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G9 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G10 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: A–D and F–J necessarily rely on one or more unchecked material Rust premises for affirmative build/source/UNSOUND results; E verifies the complete material authority chain." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report triggers the exact G12 global-hard-error proposition; missing atom proof alone was not treated as a substitute for that listed claim." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: every remediation is expressly prospective and requires implementation/re-audit; no report uses it to certify or narrow the current artifact." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: E keeps BUILD-MAP-ORDERED bounded and verifies every material Rust leaf; A–D and F–J also bound the TCB but make affirmative results while leaving different material Rust premises unchecked." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A–J: no report text establishes inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material; supplied snapshot and authority references remain in scope." + } + ], + "challenges": [ + { + "label": "A", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result Ok/Err exhaustiveness or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "A", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "A", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "A", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "A", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and its non-Unicode arm lacks tuple-struct-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "A", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "A", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output/normal-return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "A", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior R/arena prefix and arena-stop path rest on unverified successful-output and pattern premises; the requested local trace prerequisite is incomplete." + }, + { + "label": "A", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; effective current-build rejection is not completely derived." + }, + { + "label": "A", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key-value cfg truth is unverified atop an incomplete successful-selector mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "A", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output/normal-return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "A", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output/normal-return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "A", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output/normal-return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "A", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output/normal-return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "B", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "B", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "B", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output needed for the completed R and allocator prefixes; the complete ordered-prefix derivation is not verified." + }, + { + "label": "B", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output needed for the completed R and allocator prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "B", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "B", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "B", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior successful RERUN/arena prefix lacks verified successful-output semantics; the requested local trace prerequisite is incomplete." + }, + { + "label": "B", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; effective current-build rejection is not completely derived." + }, + { + "label": "B", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg Boolean rules are checked; both directions of current supported source selection are not completely proved." + }, + { + "label": "B", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "B", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "B", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "B", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "C", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "C", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "C", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "C", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; the complete ordered-prefix derivation is not verified." + }, + { + "label": "C", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify the literal, wildcard, and tuple-pattern selection used by the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "C", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful arm selection/return and all/not cfg semantics are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "C", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection and the successful arena return are not fully verified; the requested local trace prerequisite is incomplete." + }, + { + "label": "C", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "C", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and false-cfg removal are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "C", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful arm selection/return and all/not cfg semantics are unverified; the authoritative reachability link is missing." + }, + { + "label": "C", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful arm selection/return and all/not cfg semantics are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "C", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful arm selection/return and all/not cfg semantics are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "C", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful arm selection/return and all/not cfg semantics are unverified; this conjunctive atom therefore fails." + }, + { + "label": "D", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "D", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "D", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but normal main return is an unverified material edge; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "D", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping still depends on the unverified normal-return edge; effective current-build rejection is not completely derived." + }, + { + "label": "D", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping still depends on the unverified normal-return edge; both directions of current supported source selection are not completely proved." + }, + { + "label": "D", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but normal main return is an unverified material edge; the authoritative reachability link is missing." + }, + { + "label": "D", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but normal main return is an unverified material edge; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "D", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but normal main return is an unverified material edge; the Required-to-selected-body reachability chain is incomplete at normal main return; Required-to-checked-body coverage is incomplete." + }, + { + "label": "D", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because normal main return is an unverified material edge; this conjunctive atom therefore fails." + }, + { + "label": "F", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but delegates the Rust-semantic raw partition to BUILD.md and does not verify Result/VarError or exact pattern behavior; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "F", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "F", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify literal/tuple-pattern selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "F", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; the complete ordered-prefix derivation is not verified." + }, + { + "label": "F", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify literal, wildcard, and tuple-pattern selection for the rejection arms; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "F", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but raw-path selection/normal return and all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "F", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but arena and arena-stop arm selection is delegated to unchecked source claims; the requested local trace prerequisite is incomplete." + }, + { + "label": "F", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not and false-cfg selection are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "F", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not and false-cfg selection are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "F", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but raw-path selection/normal return and all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "F", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but raw-path selection/normal return and all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "F", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but raw-path selection/normal return and all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "F", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because raw-path selection/normal return and all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "G", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "G", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "G", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify successful println output or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "G", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "G", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify successful println output, and the NotUnicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "G", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "G", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but successful-output and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "G", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but the prior complete R/arena prefix lacks verified println-success and normal-return premises; the requested local trace prerequisite is incomplete." + }, + { + "label": "G", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete despite otherwise checked cfg rules; effective current-build rejection is not completely derived." + }, + { + "label": "G", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete despite otherwise checked cfg rules; both directions of current supported source selection are not completely proved." + }, + { + "label": "G", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but successful-output and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "G", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but successful-output and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "G", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but successful-output and implicit-return premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "G", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because successful-output and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "H", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result's two variants or tuple-struct pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "H", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "H", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify block sequencing, successful println output, tuple matching, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "H", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; the complete ordered-prefix derivation is not verified." + }, + { + "label": "H", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify block order/successful output, and the non-Unicode arm lacks tuple-pattern authority; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "H", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify block sequencing or successful println output for the prior completed R line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "H", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but block/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "H", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but R-before-arena order, complete-line success, and arena-stop selection are not fully verified; the requested local trace prerequisite is incomplete." + }, + { + "label": "H", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "H", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not, key/value truth, and true/false cfg-attribute rules are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "H", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but block/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "H", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but block/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "H", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but block/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body reachability chain is incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "H", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because block/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "I", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify Result/VarError exhaustiveness or literal, wildcard, and tuple-pattern semantics; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "I", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "I", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify exact pattern selection, successful println output, or implicit normal return; a material RETURN/output clause is unproved." + }, + { + "label": "I", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; the complete ordered-prefix derivation is not verified." + }, + { + "label": "I", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify rejection-arm patterns or the successful println effect for completed prefixes; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "I", + "field": "atom:B7", + "recommended_decision": "FAIL", + "evidence": "The write-failure cases are listed, but does not verify the successful println effect needed for the preceding completed RERUN line; the required completed prefix after a later failed write is not verified." + }, + { + "label": "I", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but pattern/output/return and exact all/not cfg premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "I", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but pattern selection, complete-line success, and normal return are unverified; the requested local trace prerequisite is incomplete." + }, + { + "label": "I", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but all/not key/value cfg semantics are unverified atop incomplete mapping; effective current-build rejection is not completely derived." + }, + { + "label": "I", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but all/not key/value cfg semantics are unverified atop incomplete mapping; both directions of current supported source selection are not completely proved." + }, + { + "label": "I", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but pattern/output/return and exact all/not cfg premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "I", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but pattern/output/return and exact all/not cfg premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "I", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but pattern/output/return and exact all/not cfg premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "I", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because pattern/output/return and exact all/not cfg premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "J", + "field": "atom:B2", + "recommended_decision": "FAIL", + "evidence": "Calls the six raw classes exhaustive but does not verify match-arm choice or tuple-struct enum matching; the frozen authority rule forbids promoting that assertion to a complete proof." + }, + { + "label": "J", + "field": "atom:B3", + "recommended_decision": "FAIL", + "evidence": "The system-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "J", + "field": "atom:B4", + "recommended_decision": "FAIL", + "evidence": "The arena-success trace asserts completed output and normal success but does not verify match-arm selection or implicit normal return from main; a material RETURN/output clause is unproved." + }, + { + "label": "J", + "field": "atom:B5", + "recommended_decision": "FAIL", + "evidence": "The arena-stop prefix/panic result is textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; the complete ordered-prefix derivation is not verified." + }, + { + "label": "J", + "field": "atom:B6", + "recommended_decision": "FAIL", + "evidence": "The two pre-allocator rejection outcomes are textually right, but does not verify match selection, including the NotUnicode tuple-struct arm; both raw-arm and completed-prefix clauses are not completely proved." + }, + { + "label": "J", + "field": "atom:B8", + "recommended_decision": "FAIL", + "evidence": "The report bounds BUILD-MAP-ORDERED, but match-arm selection and implicit-return premises are unverified; successful current cfg-to-source composition is not a complete applicable derivation." + }, + { + "label": "J", + "field": "atom:B9", + "recommended_decision": "FAIL", + "evidence": "The stale-build conclusion is textually right, but match-arm selection for arena and arena-stop is unverified; the requested local trace prerequisite is incomplete." + }, + { + "label": "J", + "field": "atom:B10", + "recommended_decision": "FAIL", + "evidence": "The exclusion conclusion is textually right, but effective current-build mapping is incomplete even though cfg rules are checked; effective current-build rejection is not completely derived." + }, + { + "label": "J", + "field": "atom:B11", + "recommended_decision": "FAIL", + "evidence": "The Q/not-Q partition is asserted, but effective current-build mapping is incomplete even though cfg rules are checked; both directions of current supported source selection are not completely proved." + }, + { + "label": "J", + "field": "atom:B12", + "recommended_decision": "FAIL", + "evidence": "Valid safe use, false nonzero, zero UB, and UNSOUND are stated, but match-arm selection and implicit-return premises are unverified; the authoritative reachability link is missing." + }, + { + "label": "J", + "field": "atom:B13", + "recommended_decision": "FAIL", + "evidence": "The maximal-region formula is correct, but match-arm selection and implicit-return premises are unverified; both containment and every-excluded-case UB proofs consume that missing basis." + }, + { + "label": "J", + "field": "atom:B14", + "recommended_decision": "FAIL", + "evidence": "The regional zero-panic argument is stated, but match-arm selection and implicit-return premises are unverified; the Required-to-selected-body chain and if/equality flow are incomplete; Required-to-checked-body coverage is incomplete." + }, + { + "label": "J", + "field": "atom:B15", + "recommended_decision": "FAIL", + "evidence": "The UNPROVED wording is correct, but the prerequisite B12/B14 certificates remain incomplete because match-arm selection and implicit-return premises are unverified; this conjunctive atom therefore fails." + }, + { + "label": "A", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output/normal-return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "A", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output/normal-return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "A", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "A", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "B", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "B", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "B", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked successful-println and implicit-main-return premises; this is the exact G11 authority defect." + }, + { + "label": "B", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material successful-println and implicit-main-return premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "C", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful arm selection/return and all/not cfg semantics are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "C", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful arm selection/return and all/not cfg semantics are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "C", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "C", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "D", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although normal main return is an unverified material edge; one of the four required existential certificate links is not validly established." + }, + { + "label": "D", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because normal main return is an unverified material edge; BH7 applies independently of the atom failure." + }, + { + "label": "D", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked implicit-main-return semantics; this is the exact G11 authority defect." + }, + { + "label": "D", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material implicit-main-return semantics remain unverified while supporting affirmative verdicts." + }, + { + "label": "F", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although raw-path selection/normal return and all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "F", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because raw-path selection/normal return and all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "F", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, exact-pattern, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "F", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, exact-pattern, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "G", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although successful-output and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "G", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because successful-output and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "G", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, successful-println, and implicit-return premises; this is the exact G11 authority defect." + }, + { + "label": "G", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, successful-println, and implicit-return premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "H", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although block/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "H", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because block/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "H", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises; this is the exact G11 authority defect." + }, + { + "label": "H", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/tuple-pattern, block-order, successful-println, implicit-return, and all/not premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "I", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although pattern/output/return and exact all/not cfg premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "I", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because pattern/output/return and exact all/not cfg premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "I", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises; this is the exact G11 authority defect." + }, + { + "label": "I", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material Result/VarError, pattern, successful-println, implicit-return, all/not, and if/equality premises remain unverified while supporting affirmative verdicts." + }, + { + "label": "J", + "field": "hard_error:G5", + "recommended_decision": "PRESENT", + "evidence": "The report issues UNSOUND although match-arm selection and implicit-return premises are unverified; one of the four required existential certificate links is not validly established." + }, + { + "label": "J", + "field": "hard_error:BH7", + "recommended_decision": "PRESENT", + "evidence": "The mode-specific UNSOUND certificate lacks authoritative current-library/source reachability because match-arm selection and implicit-return premises are unverified; BH7 applies independently of the atom failure." + }, + { + "label": "J", + "field": "hard_error:G11", + "recommended_decision": "PRESENT", + "evidence": "Its affirmative build/source and UNSOUND results necessarily consume unchecked match/tuple-pattern, implicit-return, and if/equality premises; this is the exact G11 authority defect." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "BUILD-MAP-ORDERED is bounded, but material match/tuple-pattern, implicit-return, and if/equality premises remain unverified while supporting affirmative verdicts." + } + ], + "ambiguities": [ + "The frozen rules say a URL grants page identity rather than a proposition, but do not quantify how much verbatim quotation is required when a report gives an accurate nearby paraphrase. The comparisons credit explicit proposition-level paraphrases and do not credit a bare page or a citation proving only a different clause.", + "The atom dependency lists do not say that failure propagates mechanically. Later-atom challenges above are based only on the later proof actually consuming the same missing material premise, not merely on an earlier atom label being FAIL." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/attestation.json new file mode 100644 index 0000000000..f72d263c98 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_consistency_l", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "L", + "kind": "consistency", + "phase": "consistency", + "recorded_utc": "2026-08-02T01:35:10.748647Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/raw-output-manifest.json new file mode 100644 index 0000000000..8b9d72eb73 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 13578, + "path": "consistency.json", + "sha256": "b0d6538a142c385651ccbae0bd29176fedbdca3db1cb1c02817e258b11d1bde3", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/raw-output/consistency.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/raw-output/consistency.json new file mode 100644 index 0000000000..592c4a88c9 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/L/1/raw-output/consistency.json @@ -0,0 +1,207 @@ +{ + "schema_version": 1, + "mode": "L", + "atom_family_attestations": [ + { + "atom_id": "L1", + "all_ten_reports_compared": true, + "evidence": "A-J all identify the executed usize get_unchecked call's in-bounds obligation, state the out-of-bounds UB consequence, and target index < bytes.len(); no unequal L1 treatment remains." + }, + { + "atom_id": "L2", + "all_ten_reports_compared": true, + "evidence": "A-J all assert that the unsafe-containing else path has is_empty() == false and contrapose the zero-length contract. A/C/H quote true-arm exclusion as well as false-arm selection; B/D/F/G/I quote only false=>else, E gestures to unquoted same-paragraph rules, and J quotes true=>consequent plus false=>else without true=>skip-else. The cross-atom consequence of those extraction gaps is recorded as ambiguity." + }, + { + "atom_id": "L3", + "all_ten_reports_compared": true, + "evidence": "A-D and H-J check both len's usize type and the unsigned/nonnegative domain. E omits both; F states the return type but derives nonnegativity from element-count-as-natural rather than a checked usize-domain entry; G checks the usize domain but misclassifies the len-to-usize link as a local source/type fact. The F split is recorded as an equivalence ambiguity rather than challenged." + }, + { + "atom_id": "L4", + "all_ten_reports_compared": true, + "evidence": "A-D and G-J check built-in subtraction plus overflow boundaries and apply n > 0 across profiles. E/F assert representability and profile independence without those Rust authorities; both raw scorers consistently fail L4 there." + }, + { + "atom_id": "L5", + "all_ten_reports_compared": true, + "evidence": "Every report A-J substitutes index = bytes.len() - 1 and explicitly derives the strict upper bound index < bytes.len(); both scorers uniformly pass L5." + }, + { + "atom_id": "L6", + "all_ten_reports_compared": true, + "evidence": "All ten reports claim implementation PROVED and connect the branch/arithmetic chain to get_unchecked. E/F lack checked numeric leaves, B's formal Required drops valid uses/executions, and B/D/G/I/J expose the branch-extraction overlap recorded below; B's contraction is challenged under G1 rather than silently collapsed into this atom." + }, + { + "atom_id": "L7", + "all_ten_reports_compared": true, + "evidence": "A-J all separately call the existing lifetime-only SAFETY comment deficient for omitting the in-bounds obligation and its material derivation, while keeping that artifact verdict distinct from implementation soundness." + }, + { + "atom_id": "L8", + "all_ten_reports_compared": true, + "evidence": "All ten supply adjacent replacement text. A-D and G-J can refer back to checked premises for the full chain; E/F assert representable subtraction despite having no checked usize/subtraction/overflow entries, and F's text also does not name get_unchecked. The s1 PASS decisions for E/F are challenged." + }, + { + "atom_id": "L9", + "all_ten_reports_compared": true, + "evidence": "A-D and H-J inventory if selection, is_empty, len/type, usize domain, subtraction, overflow, and get_unchecked while separating source facts and mathematics. E/F omit the numeric Rust leaves; G omits len's return-type premise and misclassifies inferred index typing as local." + }, + { + "atom_id": "L10", + "all_ten_reports_compared": true, + "evidence": "A/C/H provide narrow 1.82.0 entries whose extracted text supports every consumed proposition. B/D/I omit true-arm exclusion from AX-IF, E/F additionally omit numeric entries, G additionally omits len's usize return, and J's two AX-IF fragments still omit the true=>skip-else clause consumed by O1. J's s1 PASS is challenged." + }, + { + "atom_id": "L11", + "all_ten_reports_compared": true, + "evidence": "A/C/H reconcile complete checked inventories. E/F/G have omitted or misclassified numeric/type leaves; B/D/I/J claim exact reconciliation although their extracted AX-IF prose does not establish true-arm exclusion. J's s1 PASS is challenged consistently with the other incomplete AX-IF reports." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:LH1", + "all_ten_reports_compared": true, + "evidence": "A-J all report implementation PROVED, reconstruct L1-L5, and treat comment deficiency separately; none issues UNSOUND or UNPROVED solely because of the comment." + }, + { + "field": "hard_error:LH2", + "all_ten_reports_compared": true, + "evidence": "Every report explicitly calls the existing comment deficient; none calls it adequate." + }, + { + "field": "hard_error:LH3", + "all_ten_reports_compared": true, + "evidence": "A-J each state every factual link from false is_empty through nonzero length, predecessor arithmetic, and index < len to the callee obligation. Authority defects are kept in LH4/G11 rather than converted into an omitted-link LH3." + }, + { + "field": "hard_error:LH4", + "all_ten_reports_compared": true, + "evidence": "E/F affirm complete reconciliation while wholly omitting consumed usize/subtraction/overflow authorities. B/D/G/I/J state the relevant propositions but incompletely extract or classify their support; whether that lesser evidence gap alone meets LH4's exact hard-error threshold is recorded as ambiguity." + }, + { + "field": "hard_error:LH5", + "all_ten_reports_compared": true, + "evidence": "All ten disclaim build, test, execution, lint, or dynamic evidence and none uses such success as universal proof." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "B alone formally defines Required as source x Rust/std x target x profile while omitting valid calls/inputs and executions, then certifies Covered = Required; the other reports include the valid-use/theorem domain. B's absent s2 decision is challenged." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Every report gives an explicit Required subset-of Covered or Covered = Required closure statement; B's contracted Required is handled independently as G1." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "No report invents policy precedence or relabels a conservative audit domain as the project's promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "No report uses CI, endpoints, sparse documentation, a cutoff, or a stability badge as interval coverage; all arguments are symbolic in target/profile." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "No report issues UNSOUND, so the missing-four-link UNSOUND trigger is absent across A-J." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "No report issues UNPROVED after establishing an existential UB certificate; all issue PROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "No report issues CONTRACT-BROKEN or relies on a UB-containing execution for such a verdict." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "No report claims an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "The target has no third-party unsafe dependency or caller-controlled safe callback, and none of A-J silently trusts one." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "A-J offer comment replacements only after separately judging the unchanged implementation; none certifies an unimplemented design or narrows current obligations with it." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "E/F necessarily rely on wholly unchecked numeric Rust premises and both scorers record G11. B/D/G/I/J instead cite the correct authority pages and state the propositions but incompletely extract or classify them; whether those gaps alone force G11 is recorded as ambiguity." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "No report evidences inspection of an oracle, sibling, condition map, prior report, evaluator material, or another prohibited source." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "All ten replacement comments are proposed artifact repairs and none is used as if already implemented to establish soundness or narrow obligations; both raw scorers uniformly record ABSENT." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "A/C/H have complete proposition-matched authority. E/F omit numeric premises, G misclassifies len's return type, and B/D/I/J incompletely extract AX-IF's exclusivity. Both scorers mark the defect for every such report except s1 on J; that J decision is challenged." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "A-J discuss only the supplied target/request and allowlisted Rust authorities; neither raw scorer finds report-visible evidence of prohibited source-scope departure." + } + ], + "challenges": [ + { + "label": "B", + "field": "hard_error:G1", + "recommended_decision": "PRESENT", + "evidence": "B says the request 'directly defines' Required as only exact source x Rust/std x targets x profiles, omitting valid calls/inputs and executions, then uses Covered = Required for its full PROVED certificate. That is the exact contracted-Required trigger; s2 records it absent." + }, + { + "label": "E", + "field": "atom:L8", + "recommended_decision": "FAIL", + "evidence": "E's proposed comment asserts representability of len - 1, but E has no checked entry for len's usize type/domain, built-in subtraction, or overflow. It therefore cannot give the required unambiguous references to checked authority propositions for the L2-L5 chain; s1 passes it." + }, + { + "label": "F", + "field": "atom:L8", + "recommended_decision": "FAIL", + "evidence": "F's replacement asserts representable subtraction while its report has no checked usize/subtraction/overflow entries, so it cannot reference checked propositions for the full chain. The text also says only 'in bounds for this same slice' without identifying get_unchecked; s1 passes L8." + }, + { + "label": "J", + "field": "atom:L10", + "recommended_decision": "FAIL", + "evidence": "J consumes true-condition exclusion of the else arm, but AX-IF quotes only true=>consequent-executes and false=>else-executes; it omits the exact prose that true skips else. The extracted prose therefore does not supply the consumed proposition. s1 passes L10 while materially equivalent incomplete extractions fail elsewhere." + }, + { + "label": "J", + "field": "atom:L11", + "recommended_decision": "FAIL", + "evidence": "J attests that its inventory exactly matches every semantic leaf, but O1's true-arm exclusion is not established by its quoted AX-IF fragments. This is the same reconciliation gap both scorers recognize in B/D/I; s1 passes J." + }, + { + "label": "J", + "field": "tcb_authority_defect", + "recommended_decision": "PRESENT", + "evidence": "TCB-R1 claims proposition-matched checked authority, yet its AX-IF extraction omits true=>skip-else while O1 consumes that exclusivity. s1 marks no authority defect although it marks the equivalent incomplete AX-IF authority in B/D/I; s2 correctly marks it present." + } + ], + "ambiguities": [ + "The frozen materials do not make explicit whether a correct, inventoried branch-selection proposition whose exact quotation supplies only one implication direction must also fail content/closure atoms L2 and L6, rather than only L10/L11, nor whether that extraction gap by itself meets the exact LH4/G11 threshold. This affects B/D/E/F/G/I/J; no challenge here resolves that overlap by speculation.", + "L3 prescribes the usize nonnegative-domain bridge but also requires acceptance of equivalently exact derivations. F establishes len as usize yet derives positivity from its separately stated element-count/natural-count meaning without a usize-domain entry; the packet does not unambiguously say whether that substitutes for the prescribed bridge, so the split raw L3 decision is not challenged.", + "L8 requires unambiguous references to checked authority propositions but does not say whether the adjacent comment itself must contain URLs or axiom labels. Direct method/contract names were treated as sufficient when the surrounding report actually contains a complete checked inventory; E/F fail for missing checked numeric entries independently of this formatting ambiguity.", + "L10 asks for exact prose, while some premises are carried by displayed signatures rather than prose. The packet does not specify a transcription format for such signatures; this review distinguishes an expressly inspected displayed signature from G's unquoted/misclassified len-return-type assertion." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/attestation.json new file mode 100644 index 0000000000..ba7d510652 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_consistency_p", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "P", + "kind": "consistency", + "phase": "consistency", + "recorded_utc": "2026-08-02T01:33:48.220001Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/raw-output-manifest.json new file mode 100644 index 0000000000..1e5bbef6dd --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 16706, + "path": "consistency.json", + "sha256": "9f4eb035e7c6d6bedd98431f3bdc0bf6453dff7eb0fc5b64339bcb52cf4a1372", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/raw-output/consistency.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/raw-output/consistency.json new file mode 100644 index 0000000000..48cadc1b9e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/P/1/raw-output/consistency.json @@ -0,0 +1,283 @@ +{ + "schema_version": 1, + "mode": "P", + "atom_family_attestations": [ + { + "atom_id": "P1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J include the V/T bounds in Scarlet directly or in an explicit exact-support conjunction. H alone labels an unbounded S0 body the exact Scarlet configuration predicate; its later Base conjunction repairs DS but not S0 itself." + }, + { + "atom_id": "P2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J include the V/T bounds in Indigo directly or in an explicit exact-support conjunction. H alone labels an unbounded I0 body the exact Indigo configuration predicate; Base repairs DI but not I0 itself." + }, + { + "atom_id": "P3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report gives a materially complete Scarlet-minus-Indigo witness and checks the decisive clauses; H's full-case 1.84/X/unhardened witness is valid within Base." + }, + { + "atom_id": "P4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report gives a materially complete Indigo-minus-Scarlet witness and checks the decisive clauses; H's 1.86/A/unhardened full-case witness is valid." + }, + { + "atom_id": "P5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten leave the controlling exact project predicate UNPROVED or unresolved and expressly separate that question from the analyst-selected audit domain." + }, + { + "atom_id": "P6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each ScarletCases construction retains version, target, both features, profile, debug assertions, and every valid Option input. In H, DS=Base and S0 supplies the correct full-case set despite P1's standalone-predicate defect." + }, + { + "atom_id": "P7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each IndigoCases construction retains all seven coordinates and their complete fibers. In H, DI=Base and I0 supplies the correct full-case set despite P2's standalone-predicate defect." + }, + { + "atom_id": "P8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report separately derives ScarletCases containment, by union introduction or implication into a stated full-case superset, while preserving the other coordinates." + }, + { + "atom_id": "P9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report separately derives IndigoCases containment, by union introduction or implication into a stated full-case superset, while preserving the other coordinates." + }, + { + "atom_id": "P10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten universally substitute turbo=true and target=W into Scarlet and show that !f and every X/A turbo arm are false." + }, + { + "atom_id": "P11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten universally substitute turbo=true and target=W into Indigo and show that !f and every X/A turbo arm are false." + }, + { + "atom_id": "P12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J combine exact BUILD-MAP-POLICY mapping with supplying all/cfg/compile_error authority. H makes the same rejection claim but supplies no exact-version all-predicate quotation or predicate-section authority, so its two-true-leaves step is unchecked." + }, + { + "atom_id": "P13", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report applies exact-version unwrap_or prose to the exhaustive None/Some(input) cases on the selected non-turbo branch." + }, + { + "atom_id": "P14", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report traces the byte produced by unwrap_or into the exact syntactically constructed Some(byte) receiver and rules out None at unwrap_unchecked." + }, + { + "atom_id": "P15", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report composes unwrap_or's value, local Some construction, and unwrap_unchecked's contained-value return to establish the turbo postcondition for all inputs." + }, + { + "atom_id": "P16", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every final Required predicate is stated on a tuple retaining version, target, turbo, hardened, profile, debug assertions, and input." + }, + { + "atom_id": "P17", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every Covered_sound formulation retains the complete case, either explicitly or through a full Base/K/F predicate; no report projects away a required coordinate." + }, + { + "atom_id": "P18", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J authority-close both selected source branches. H admits the !f region to Covered_sound while its selection proof relies on uncited exact-version not-predicate semantics, so that region lacks a complete applicable derivation." + }, + { + "atom_id": "P19", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J carry every Required case into authority-closed soundness coverage. H states the set inclusion, but its !f edge inherits P18's unchecked not premise and therefore is not a valid Covered_sound closure certificate." + }, + { + "atom_id": "P20", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J give TCB-qualified whole-domain soundness from valid closure. H affirmatively claims the same result although its required P19 certificate is incomplete." + }, + { + "atom_id": "P21", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every Covered_behavior/Covered_post formulation retains all seven coordinates through explicit conjuncts or full Base/K/F membership." + }, + { + "atom_id": "P22", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J provide authority-closed postcondition proofs on every admitted branch. H's admitted !f region again depends on uncited exact-version not-predicate selection semantics." + }, + { + "atom_id": "P23", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J map Required into completely proved behavioral regions. H states containment, but its !f mapping inherits P22's unchecked selection premise and is not a valid Covered_post certificate." + }, + { + "atom_id": "P24", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J state a conspicuously TCB-relative whole-domain postcondition conclusion backed by closure. H's affirmative conclusion lacks valid P23 closure and does not explicitly carry the shared TCB qualification." + }, + { + "atom_id": "P25", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten restrict BUILD-MAP-POLICY to the named bundled releases, supplied artifact, feature/target mapping, profile region, and reachability/rejection consumers; none widens it into Rust or backend semantics." + }, + { + "atom_id": "P26", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J explicitly share or repeat BUILD-MAP-POLICY qualification across soundness, behavior, and rejection. H qualifies soundness and rejection but says behavior only holds on the same domain, not under the same trust qualification." + }, + { + "atom_id": "P27", + "all_ten_reports_compared": true, + "evidence": "Compared A-J premise by premise. A-G, I, and J quote and link exact-release Option, conditional-compilation, and compile_error authority for the Rust semantics they use. H omits supplying all and not quotations/authority while relying on both in positive proofs." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report contracts or fails to justify its full-case Required domain before claiming PROVED; H's DS/DI union remains a justified Required set notwithstanding its standalone P1/P2 defects." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report explicitly states Required subset-of each Covered predicate. H's stated inclusions are semantically incomplete, addressed by PH4 and G11, but the G2-specific absence of a containment statement does not occur." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten deny authorized policy precedence and label the selected union or superset only as a conservative audit domain, never the project's exact promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None treats CI, endpoints, sparse documentation, a cutoff, or stability language as interval coverage; releases are handled as the exact finite V set." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report issues an UNSOUND conclusion, so no deficient four-link existential UNSOUND certificate occurs." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. The only UNPROVED conclusion is policy identity; no report establishes all four UNSOUND links and then stops at UNPROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report issues CONTRACT-BROKEN, let alone from an execution containing UB." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None argues that an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None silently trusts a third-party unsafe implementation or caller-controlled safe behavior; all reason locally from the supplied source and exact standard-library contracts." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Suggested SAFETY-comment rewrites are uniformly labeled documentation-only and are not used to narrow or certify current-artifact obligations." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. H alone necessarily relies on unchecked all/not Rust semantics in affirmative rejection and branch-coverage proofs. The other nine provide version-matched supplying quotations and URLs." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. No report evidences inspection of an oracle, sibling, condition map, prior report, score, or evaluator material; C's visible supplied-skill identification is expressly permitted." + }, + { + "field": "hard_error:PH1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report leaves the controlling exact promise unresolved; none selects Scarlet, Indigo, an intersection, a union, or another combination as authoritative policy." + }, + { + "field": "hard_error:PH2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every selected union or larger set is explicitly called an audit domain and explicitly denied status as the exact project promise." + }, + { + "field": "hard_error:PH3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All asserted incomparability and containment relations follow from the reports' stated full-case formulas and valid witnesses; H's two witnesses remain valid under its Base-bounded DS/DI definitions." + }, + { + "field": "hard_error:PH4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J claim whole-domain soundness/behavior only after valid full-case closure. H claims both PROVED while its Covered validity and P19/P23 certificates depend on an unchecked not-predicate premise, so PH4 is present there." + }, + { + "field": "hard_error:PH5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. A-G, I, and J support rejection with exact mapping plus applicable all, cfg, and compile_error implications. H affirmatively claims universal rejection without an applicable exact-version all implication, so PH5 is present there." + }, + { + "field": "hard_error:PH6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. None calls the supplied source UNSOUND or its postcondition CONTRACT-BROKEN; H expressly denies both." + }, + { + "field": "hard_error:PH7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All ten preserve BUILD-MAP-POLICY's exact identity, mappings, consumers, and region and distinguish it from Rust authority. H's defect is missing Rust authority/qualification, not invented or widened TCB content." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All comment proposals are clearly unimplemented documentation suggestions, and every current-artifact conclusion is presented as independently derived; proposal laundering is absent throughout." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. H has the defect because its positive proofs omit material all/not Rust authority and its behavioral conclusion omits conspicuous BUILD-MAP qualification. A-G, I, and J close authority and TCB accounting." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report stays visibly within the supplied target/source-review materials and allowed Rust authorities; no report establishes a material source-scope departure." + } + ], + "challenges": [ + { + "label": "H", + "field": "atom:P1", + "recommended_decision": "FAIL", + "evidence": "H lines 49-56 explicitly call S0 the exact Scarlet configuration predicate, but S0 omits v in V and t in T. Lines 58-59 add those bounds only to DS through Base; silently promoting that later conjunction into the standalone S0 atom would collapse P1 into P6." + }, + { + "label": "H", + "field": "atom:P2", + "recommended_decision": "FAIL", + "evidence": "H lines 61-68 explicitly call I0 the exact Indigo configuration predicate, but I0 omits v in V and t in T. Lines 70-71 repair only the induced DI full-case set through Base, not the P2 configuration-predicate proposition." + }, + { + "label": "H", + "field": "hard_error:PH4", + "recommended_decision": "PRESENT", + "evidence": "H lines 11-16 claim whole-domain soundness and behavior PROVED, while lines 139-143 use an unchecked complementary/not cfg rule for the non-turbo region admitted by Covered and lines 173-175 claim closure from it. Thus the affirmative verdicts lack a valid authority-closed Required subset-of Covered certificate." + }, + { + "label": "H", + "field": "hard_error:PH5", + "recommended_decision": "PRESENT", + "evidence": "H lines 17-19 and 99-112 claim universal turbo/wasm rejection. They provide BUILD-MAP mapping, cfg-attribute text, and compile_error text, but no applicable exact-version all-predicate implication for the material step from two true leaves to cfg(all(...)) true." + } + ], + "ambiguities": [ + "PH4 does not expressly say whether a syntactically stated full-case containment becomes invalid for PH4 when Covered validity fails solely because a material Rust authority premise is unchecked; that case also independently fits G11. The P18/P19 and P22/P23 dependency chains support treating H's affirmative whole-domain claims as PH4, but the overlap boundary is not explicit.", + "H's phrase 'on that same domain' in the behavioral verdict unambiguously imports the audit domain but is grammatically ambiguous about importing the preceding soundness bullet's BUILD-MAP-POLICY qualification. P26's separate conspicuous-qualification requirement makes implicit inheritance insufficient, but the prose-level inheritance rule is not otherwise specified." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/attestation.json new file mode 100644 index 0000000000..2fdd51d25e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_consistency_q", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "Q", + "kind": "consistency", + "phase": "consistency", + "recorded_utc": "2026-08-02T01:26:05.618621Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/raw-output-manifest.json new file mode 100644 index 0000000000..147d016b26 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 7521, + "path": "consistency.json", + "sha256": "460b7df3a9d496bf9a6c1b3e3b5c44ca77c75915cb817e0c360390605e5bc521", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/raw-output/consistency.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/raw-output/consistency.json new file mode 100644 index 0000000000..ab8ab71473 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/Q/1/raw-output/consistency.json @@ -0,0 +1,135 @@ +{ + "schema_version": 1, + "mode": "Q", + "atom_family_attestations": [ + { + "atom_id": "Q1", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report separately states the safe force_unreachable valid-use domain with no hidden caller precondition and the delegated_nonzero domain restricted to nonzero valid unsafe calls, then gives independent verdicts; value != 0 and 1..=255 are treated equivalently." + }, + { + "atom_id": "Q2", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every force_unreachable proof contains the same four material links: a valid safe call, unconditional reachability, falsity of the exact not-reached requirement, and the applicable Rust 1.80.0 documentation's UB consequence." + }, + { + "atom_id": "Q3", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report closes the existential certificate and gives Q-force-sound the strongest verdict UNSOUND rather than weakening the result to UNPROVED." + }, + { + "atom_id": "Q4", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report proves the unchanged nonzero argument discharges the dependency's caller precondition, refuses to promote the exact pin or API documentation into implementation proof, and identifies exact-version valid-call UB-freedom as the missing provider proposition because the body and accepted UNSAFE-DEP trust are absent." + }, + { + "atom_id": "Q5", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report gives Q-delegate-sound UNPROVED, does not invent a dependency UB execution, and calls for recursive audit of the exact implementation or acceptance of an equally precise UNSAFE-DEP proposition." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:QH1", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report calls force_unreachable sound or merely UNPROVED after establishing the four certificate links; all conclude UNSOUND." + }, + { + "field": "hard_error:QH2", + "all_ten_reports_compared": true, + "evidence": "Across A-J, each force_unreachable UNSOUND verdict includes valid use, reachability, falsity of the exact safety proposition, and authoritative UB consequence; none omits a required link." + }, + { + "field": "hard_error:QH3", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report expressly refuses to trust the unavailable dependency or treat the version pin as implementation proof, and all report delegated_nonzero UNPROVED rather than PROVED." + }, + { + "field": "hard_error:QH4", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report fabricates dependency body behavior or a UB execution, and none reports delegated_nonzero UNSOUND." + }, + { + "field": "hard_error:QH5", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the dependency precondition is treated as a caller-side obligation satisfied by valid nonzero inputs, never as an executed UB event." + }, + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report claims full PROVED; each preserves the requested compilation and valid-use domains and reports the two separate outcomes UNSOUND and UNPROVED." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report claims positive claim-level closure without Required being covered; each distinguishes the proved local nonzero forwarding step from the uncovered dependency-provider obligation." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the support domain is transcribed symbolically from the request, with no invented policy precedence or relabeling of a conservative audit domain as a project promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report uses CI, endpoints, sparse documentation, an audit cutoff, or a stability label as interval coverage; target and profile reasoning is source-parametric." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every UNSOUND verdict is confined to force_unreachable and is supported by all four existential certificate links." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report that establishes all four force_unreachable links issues UNSOUND, not only UNPROVED." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report issues CONTRACT-BROKEN from the UB-containing force_unreachable execution; multiple reports expressly reject that inference." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no report claims that an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Across A-J, every report conspicuously leaves exact dependency provider correctness unproved and does not silently trust third-party unsafe implementation behavior." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Across A-J, suggested repairs, replacement implementations, recursive audits, and possible future trust entries are prospective resolutions only and never narrow or certify the current artifact." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the only consumed Rust semantic authority is the exact version-matched unreachable_unchecked Safety proposition; dependency documentation is used only for its caller contract and not as authority for absent implementation behavior." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Across A-J, reports evidence only supplied packet artifacts, harmless hashes or quotations of those artifacts, and the exact allowed Rust URL; none evidences inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Across A-J, no unimplemented proposal supports a current verdict or narrows a current obligation; all repair and trust options remain explicitly future work requiring implementation, audit, or acceptance." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Across A-J, the accepted Rust proposition is identified by exact version, URL, proposition, domain, and force consumer, while dependency implementation trust is conspicuously rejected; no report changes this evidence standard." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Across A-J, each report confines its evidence to supplied source-packet material and the permitted exact Rust URL and disclaims unavailable dependency bodies, builds, binaries, tools, and prior audits; no visible material scope departure appears." + } + ], + "challenges": [], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/attestation.json new file mode 100644 index 0000000000..b5d33268cc --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_consistency_r", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "R", + "kind": "consistency", + "phase": "consistency", + "recorded_utc": "2026-08-02T01:41:38.195309Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/raw-output-manifest.json new file mode 100644 index 0000000000..dd66920606 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 9372, + "path": "consistency.json", + "sha256": "1418b5c85bfbde5a2ba6ae156bd8728fb23b95e2203704e6bb98ff53dc928ec2", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/raw-output/consistency.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/raw-output/consistency.json new file mode 100644 index 0000000000..26e4317240 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/consistency/R/1/raw-output/consistency.json @@ -0,0 +1,176 @@ +{ + "schema_version": 1, + "mode": "R", + "atom_family_attestations": [ + { + "atom_id": "R1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. B, C, E, H, and I construct the return-2 downstream implementation and safe call with all four version-matched Rust authority links; A, D, F, G, and J use the same witness but omit material unsafe-function authority, so the common PASS/FAIL split is justified." + }, + { + "atom_id": "R2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report traces index 2 to get_unchecked_mut on length 2 and cites its UB consequence; B, C, E, H, and I also establish R1, while A, D, F, G, and J do not, yielding the same dependency-based split." + }, + { + "atom_id": "R3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All literally say the current API is UNSOUND and proposal-independent, but only B, C, E, H, and I close dependent R2; A, D, F, G, and J therefore consistently fail R3." + }, + { + "atom_id": "R4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report extracts the owned wrapping increment of element 1 and expressly says downstream Slot implementations or generic calls need not be preserved; all PASS treatments are equivalent." + }, + { + "atom_id": "R5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Each proposes a nongeneric safe checked-index specialization with fixed element 1 and no caller-selected implementation or index; free-function and Tail inherent-method spellings are materially equivalent." + }, + { + "atom_id": "R6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Every report identifies removal of the trait/generic surface, gives the call-site migration, and ties the intentional downstream break to the expressly authorized unreleased contract delta." + }, + { + "atom_id": "R7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. All keep the sketch conditional and demand implementation plus fresh audit, but R7 expressly depends on R3: B, C, E, H, and I establish R3, whereas A, D, F, G, and J do not. The latter five must therefore be FAIL despite satisfying R7's direct redesign-language clauses." + } + ], + "defect_family_attestations": [ + { + "field": "hard_error:G1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none claims full safe-API PROVED after contracting or failing to justify Required. Each PROVED statement is confined to the requested Tail behavior." + }, + { + "field": "hard_error:G2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every positive Tail result supplies an all-input, target/profile-parametric coverage derivation or explicit Required-subset-of-Covered statement, so G2 is absent throughout." + }, + { + "field": "hard_error:G3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none invents policy precedence or converts a conservative audit domain into a project promise." + }, + { + "field": "hard_error:G4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; some name an audit cutoff, but no report uses a cutoff, CI, endpoints, documentation sparsity, or badges as interval coverage. Coverage is source-parametric." + }, + { + "field": "hard_error:G5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. G5 is present for A, D, F, G, and J because their affirmative UNSOUND certificates omit checked authority for the valid ordinary safe-function call; it is absent for B, C, E, H, and I, which cite that Rust 1.82 rule." + }, + { + "field": "hard_error:G6", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; no report issues only UNPROVED after establishing all four existential links. All issue UNSOUND." + }, + { + "field": "hard_error:G7", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none derives CONTRACT-BROKEN from the UB witness, and several expressly reject that use." + }, + { + "field": "hard_error:G8", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report places UB at the out-of-bounds call itself and none claims an observation remains guaranteed merely because it precedes UB." + }, + { + "field": "hard_error:G9", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none silently trusts third-party unsafe implementation or caller-controlled safe behavior; all treat downstream Slot control as the defect." + }, + { + "field": "hard_error:G10", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every redesign is explicitly unimplemented and excluded from the current verdict, with fresh audit required." + }, + { + "field": "hard_error:G11", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. G11 is present for A, D, F, G, and J because their UNSOUND proof necessarily consumes uncited safe-versus-unsafe-function semantics; it is absent for B, C, E, H, and I, which supply applicable Rust 1.82 authority." + }, + { + "field": "hard_error:G12", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; no report evidences inspection of an oracle, sibling, condition map, prior report, score, or evaluator material. H's naming of the supplied skill package is expressly permitted." + }, + { + "field": "hard_error:RH1", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report quantifies beyond Tail and constructs an arbitrary downstream implementation returning 2, so none trusts Tail as the only safe implementation." + }, + { + "field": "hard_error:RH2", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; none treats safe-trait prose as a caller obligation, and all say documentation alone would not repair the generic safe boundary." + }, + { + "field": "hard_error:RH3", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; all reports call the current API UNSOUND rather than sound or merely UNPROVED." + }, + { + "field": "hard_error:RH4", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; all proposals are expressly conditional, denied a current artifact verdict, and subjected to implementation plus fresh audit." + }, + { + "field": "hard_error:RH5", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; every report fixes the current UNSOUND conclusion before redesign and states that design intent or authorization does not narrow it." + }, + { + "field": "proposal_laundering", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; absent throughout because no report uses its unimplemented specialization to certify current soundness, narrow current obligations, or claim a post-change verdict without fresh audit." + }, + { + "field": "tcb_authority_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J. Present for A, D, F, G, and J due to the omitted Rust 1.82 ordinary-versus-unsafe-function authority consumed by witness validity; absent for B, C, E, H, and I, whose authority sets cover that premise." + }, + { + "field": "visible_scope_defect", + "all_ten_reports_compared": true, + "evidence": "Compared A-J; absent throughout. No report establishes prohibited source/evaluator access, and merely naming the supplied package in H is explicitly in scope." + } + ], + "challenges": [ + { + "label": "A", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. A's R3 is unestablished because its safe-call certificate omits the required Rust 1.82 unsafe-function authority; conditional proposal language and a fresh-audit demand cannot cure that failed prerequisite." + }, + { + "label": "D", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. D's R3 is unestablished because its valid-safe-call premise lacks checked Rust 1.82 unsafe-function authority, so its otherwise conditional and unaudited sketch cannot make R7 pass." + }, + { + "label": "F", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. F's R3 fails through its authority-incomplete safe-use certificate; saying the redesign is not a verdict and needs fresh audit satisfies direct clauses but not the dependency." + }, + { + "label": "G", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. G's R3 is unestablished because AX-ACCESS does not verify ordinary-function caller safety, so the explicit post-implementation audit does not satisfy the failed prerequisite." + }, + { + "label": "J", + "field": "atom:R7", + "recommended_decision": "FAIL", + "evidence": "R7 expressly depends on R3. J's R3 is unestablished because its TCB omits safe-versus-unsafe-function authority for the witness call; its correct conditional framing cannot override that dependency." + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/attestation.json new file mode 100644 index 0000000000..b020bb7f14 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_b_s1", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "B-s1", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T01:19:55.125301Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/raw-output-manifest.json new file mode 100644 index 0000000000..d739aadd23 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 38673, + "path": "score.json", + "sha256": "68aa251dab96542fd092f97d4de606a072ff2e0f77f107c5ed25a91d01960d0d", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/raw-output/score.json new file mode 100644 index 0000000000..321da00d31 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s1/1/raw-output/score.json @@ -0,0 +1,298 @@ +{ + "schema_version": 1, + "mode": "B", + "scorer_id": "s1", + "reports": [ + { + "label": "H", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Defines the three targets, both burst and allocator states, all profiles, both debug states, every u8, and only wasm32/arena excluded under Rust/Cargo 1.85.1."}, + {"id": "B2", "decision": "FAIL", "evidence": "Calls the six classes exhaustive, but AX-ENV omits Result's Ok/Err exhaustiveness and tuple-struct-pattern semantics needed to exclude another outcome."}, + {"id": "B3", "decision": "FAIL", "evidence": "The R,S success row lacks verified block sequencing, successful println line effect, and implicit main-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The R,A success row asserts normal return without verified source-order, successful-output, or function-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "It states R,A then explicit panic/no library, but the completed-line and source-order premises are not verified by its authorities."}, + {"id": "B6", "decision": "FAIL", "evidence": "The R-only rejection rows lack tuple-pattern/source-order and successful-line authority sufficient for both raw classes."}, + {"id": "B7", "decision": "FAIL", "evidence": "Although q models failed-call bytes, no block-order or successful-println premise verifies the prior completed R prefix at allocator-write failures."}, + {"id": "B8", "decision": "FAIL", "evidence": "The Cargo qualification is conspicuous, but the successful/failing local traces and exact Rust cfg selection needed for composition remain unproved."}, + {"id": "B9", "decision": "FAIL", "evidence": "BUILD-2 states the requested sequence, but relies on unverified R-before-A successful and arena-stop local traces."}, + {"id": "B10", "decision": "FAIL", "evidence": "CFG-1 asserts all(...) truth and cfg inclusion without verifying all, key/value-option truth, and true/false cfg-attribute rules."}, + {"id": "B11", "decision": "FAIL", "evidence": "The U/not-U body partition is asserted without verified all/not, key/value, and true-versus-false cfg semantics."}, + {"id": "B12", "decision": "FAIL", "evidence": "The UNSOUND witness reaches the first body only through the incomplete build/cfg derivation, so authoritative reachability is missing."}, + {"id": "B13", "decision": "FAIL", "evidence": "The formula is correct, but both containments rely on the unverified body/build partition and unverified false-if flow."}, + {"id": "B14", "decision": "FAIL", "evidence": "The regional zero argument relies on the unverified complementary cfg selection and build-to-source closure."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED is stated correctly, but its required UB and regional-panic certificates are incomplete because B12/B14 are unproved."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It issues UNSOUND while supported-Q reachability rests on unverified build-return and exact cfg-selection premises."}, + {"id": "BH7", "evidence": "SOUND-1 lacks a valid authoritative reachability link from raw arena through the current library to the unchecked body."}, + {"id": "G11", "evidence": "Its positive build/source conclusions necessarily use unchecked Rust block, println-success, return, and all/not semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly future work requiring re-audit and is not used for any current verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is bounded, but multiple material Rust premises supporting PROVED/UNSOUND claims are not verified by applicable versioned text."}, + "visible_scope_defect": {"present": false, "evidence": "The report describes only supplied target files/policies and allowed source-level authorities; it evidences no prohibited evaluator material."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Supported names every target, feature/allocator state, profile, debug state, u8 value, Rust/Cargo 1.85.1, and only the wasm32/arena exclusion."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six rows are stated exhaustive, but Result exhaustiveness and tuple-struct enum-pattern semantics are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "R,S and normal success are asserted, but successful println output, tuple-pattern handling of NotPresent, and implicit return are not authoritatively established."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row has the right endpoint but lacks verified successful-output and implicit-function-return premises for the complete trace."}, + {"id": "B5", "decision": "FAIL", "evidence": "The arena-stop row has the right panic/no-library result, but successful A-line completion is not verified by the cited println premise."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode rows are present, but successful R output and tuple-struct-pattern semantics are incomplete."}, + {"id": "B7", "decision": "FAIL", "evidence": "It handles failed calls and incomplete bytes, but the completed R prefix used after second-write failure lacks a verified successful-println effect."}, + {"id": "B8", "decision": "FAIL", "evidence": "Exact TCB consumers are listed, but upstream successful traces and Rust all/not source selection are incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness prose is exact, yet the prerequisite successful arena and completed-line local trace lacks full Rust authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The exclusion uses all(...) without verifying Rust all/key-value truth semantics, and depends on incomplete successful-selector closure."}, + {"id": "B11", "decision": "FAIL", "evidence": "It calls the blocks complementary but never verifies all/not configuration semantics or complete build-to-source reachability."}, + {"id": "B12", "decision": "FAIL", "evidence": "The witness states all four ideas, but authoritative reachability through the successful arena build and selected block is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M has the intended formula, but the positive and complement proofs consume the unproved body/build partition."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-C zero proof is conditional on an unproved current-source partition and therefore does not cover the required build relation."}, + {"id": "B15", "decision": "FAIL", "evidence": "It gives the intended UNPROVED wording, but the underlying B12 and B14 derivations are incomplete."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued without an authoritative complete reachability chain through normal build-script return and exact cfg selection."}, + {"id": "BH7", "evidence": "The asserted witness lacks a validly established supported-current-library reachability link."}, + {"id": "G11", "evidence": "PROVED and UNSOUND conclusions necessarily rely on unchecked successful-println, function-return, Result-pattern, and all/not premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The suggested repair is not treated as implemented or as support for the current verdicts."}, + "tcb_authority_defect": {"present": true, "evidence": "The TCB itself is kept narrow, but material Rust premises for build completion and cfg selection are not verified."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing in the report establishes inspection beyond the supplied crate/policies and versioned documentation."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "F/C include Rust and Cargo 1.85.1, the three supported targets, both feature/allocator/debug states, every profile/u8, and only W/arena excluded."}, + {"id": "B2", "decision": "FAIL", "evidence": "The table lists all six classes, but exact Result/VarError variant exhaustiveness and literal/wildcard/tuple-pattern semantics are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "The two system rows lack verified enum/literal pattern selection and implicit main-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row states R,A0 success but does not verify literal-pattern selection or normal function return."}, + {"id": "B5", "decision": "FAIL", "evidence": "R,A0 then panic/no library is stated, but reaching the arena-stop arm is unsupported by applicable literal-pattern authority."}, + {"id": "B6", "decision": "FAIL", "evidence": "The rejection rows are correct textually, but wildcard and NotUnicode tuple-pattern selection are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Explicitly covers first-write failure, every allocator-write failure, prior [R], incomplete failed-call bytes, panic, and no library under the exact TCB."}, + {"id": "B8", "decision": "FAIL", "evidence": "Cargo effects are narrowly qualified, but the successful local traces and exact Rust cfg truth/selection relation remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The requested stale-build outcomes are enumerated, but prerequisite arena/arena-stop path selection and successful return are unverified."}, + {"id": "B10", "decision": "FAIL", "evidence": "It asserts the wasm32/arena all predicate and converse without verifying all, option-truth, and false-cfg removal semantics."}, + {"id": "B11", "decision": "FAIL", "evidence": "Q/not-Q are called complementary without verified all/not cfg rules and complete successful mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "The stated safe zero witness lacks a valid authoritative source-reachability derivation."}, + {"id": "B13", "decision": "FAIL", "evidence": "The maximal formula and case split are correct, but rely on unproved cfg/build reachability and false-if behavior."}, + {"id": "B14", "decision": "FAIL", "evidence": "The regional panic assertion lacks a complete cfg/body and false/true conditional-semantics derivation over Required."}, + {"id": "B15", "decision": "FAIL", "evidence": "The verdict is worded correctly, but neither its complete UB certificate nor regional proof is established."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "The UNSOUND verdict rests on an incompletely authorized successful-selector and cfg-body reachability chain."}, + {"id": "BH7", "evidence": "The existential certificate's reachability link is not validly established from the cited Rust premises."}, + {"id": "G11", "evidence": "The report necessarily relies on unchecked Result/pattern, function-return, and all/not semantics for its affirmative conclusions."} + ], + "proposal_laundering": {"present": false, "evidence": "Its repair is explicitly prospective and not used to certify the supplied implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "Although BUILD-MAP-ORDERED is bounded, required Rust semantic leaves for exhaustive paths and cfg selection are missing."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences review only of supplied target material and versioned allowed authorities."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "S exactly states all target, burst, allocator, profile/debug, and u8 axes under 1.85.1, excluding only wasm32/arena."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six classes are explicitly called exhaustive, but Result's two-way shape and tuple-struct enum matching are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "Absent/system R,Sline normal return lacks verified successful-println and implicit-return premises, with tuple matching also omitted for absence."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena success trace asserts a complete Aline and normal return without verifying println success or function-body return."}, + {"id": "B5", "decision": "FAIL", "evidence": "The arena-stop ordering is stated, but completion of R/Aline on successful println calls is not verified."}, + {"id": "B6", "decision": "FAIL", "evidence": "The two R-only rejection rows lack verified successful-line and NotUnicode tuple-pattern premises."}, + {"id": "B7", "decision": "FAIL", "evidence": "q correctly avoids atomicity assumptions, but the completed [R] premise after a later failure lacks verified println-success semantics."}, + {"id": "B8", "decision": "FAIL", "evidence": "The TCB is conspicuous and cfg rules are cited, but upstream successful return/output and exhaustive selector traces are incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness sequence is exact textually, yet its successful prior [R,Aline] premise is not authoritatively established."}, + {"id": "B10", "decision": "FAIL", "evidence": "The conditional compile_error proof is correct in isolation, but effective build closure depends on the incomplete successful-arena mapping in B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "all/not semantics are stated, but the exact supported current-source partition still depends on the incomplete B4/B8 mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "Valid use, false precondition, and UB are stated; the authoritative current-library reachability link is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M and both set arguments are stated, but every excluded-case UB proof consumes the incomplete reachability certificate."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-K zero source argument is present, but the required build-to-body coverage remains incomplete."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED/not-CONTRACT-BROKEN is correct, but the report has not completed the prerequisite whole UB and regional coverage proofs."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It reports UNSOUND while the supported-current-library reachability link lacks verified successful-output and function-return semantics."}, + {"id": "BH7", "evidence": "F-1's reachability certificate is incomplete even though its false-precondition and UB links are correct."}, + {"id": "G11", "evidence": "Its PROVED/UNSOUND results necessarily rely on unchecked Result/tuple, println-success, and function-return premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed check is clearly a future repair followed by re-audit, not current evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is not widened, but material Rust semantics needed for current selector success and exhaustiveness are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "No report text evidences access to prohibited evaluation, sibling, oracle, or condition material."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q/U include Rust/Cargo 1.85.1, exact targets, both feature/allocator/debug states, every profile and u8, with only wasm32/arena removed."}, + {"id": "B2", "decision": "FAIL", "evidence": "It calls the partition exhaustive but explicitly lets BUILD.md supply it; Result/VarError exhaustiveness and exact pattern behavior are not verified as Rust semantics."}, + {"id": "B3", "decision": "FAIL", "evidence": "The system rows lack exact match/pattern and implicit-return authority despite showing the intended R,L_s endpoint."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row shows R,L_a success but does not verify exact literal-arm selection or falling-through main return."}, + {"id": "B5", "decision": "FAIL", "evidence": "Its arena-stop prefix/panic outcome is correct, but reaching that literal arm is not established by the cited vague match premise."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode outcomes are listed, but wildcard and tuple-struct pattern semantics are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Covers failed first and every applicable second write, earlier complete R, arbitrary failed-call bytes, panic exits, and exact TCB no-library consequences."}, + {"id": "B8", "decision": "FAIL", "evidence": "Exact TCB use is described, but selector success/exhaustiveness and Rust cfg all/not source selection remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The three rerun failures are right, but the prior-success and arena-stop arm derivations rely on unchecked local Rust semantics."}, + {"id": "B10", "decision": "FAIL", "evidence": "B-03 asserts all(...) and exact rejection without verifying all/key-value cfg semantics or complete B8 mapping."}, + {"id": "B11", "decision": "FAIL", "evidence": "The C/not-C block split is asserted without version-matched all/not and false-cfg semantics, atop incomplete mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "F-01 states four bullets, but supported current-source reachability is not validly established by the report's authorities."}, + {"id": "B13", "decision": "FAIL", "evidence": "S has the intended formula, but its complement proof relies on the incomplete cfg/build reachability chain."}, + {"id": "B14", "decision": "FAIL", "evidence": "S-01's zero panic proof is only conditional on an unproved complementary source selection."}, + {"id": "B15", "decision": "FAIL", "evidence": "POST-01 gives the intended verdict, but B12/B14 are not complete applicable derivations."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued without a valid authoritative reachability link through the accepted raw arena path and cfg body."}, + {"id": "BH7", "evidence": "F-01's current-library/source reachability link is incomplete despite correct zero and UB propositions."}, + {"id": "G11", "evidence": "The report expressly uses BUILD.md to supply a Rust-semantic raw partition and also omits material return/all-not authorities."} + ], + "proposal_laundering": {"present": false, "evidence": "No proposed repair is used to narrow or certify the current artifact; it calls for re-audit."}, + "tcb_authority_defect": {"present": true, "evidence": "It treats BUILD.md as supplying the complete raw semantic partition and leaves other material Rust cfg/return premises unchecked."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no access outside supplied source/policy material and allowed documentation."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C/S/U recover all exact release, target, feature, allocator, profile/debug, and u8 cases with only W/arena excluded."}, + {"id": "B2", "decision": "PASS", "evidence": "Explicitly gives the six disjoint raw classes and verifies Result, VarError, as_str, first-match, literal, tuple, and wildcard exhaustiveness."}, + {"id": "B3", "decision": "FAIL", "evidence": "The R,CS rows assert return success, but no versioned function-body premise establishes implicit normal return after the final println."}, + {"id": "B4", "decision": "FAIL", "evidence": "The R,CA arena row likewise lacks authoritative implicit-return completion despite correct order/output reasoning."}, + {"id": "B5", "decision": "PASS", "evidence": "Shows arena-stop as [R,CA], then explicit panic, unsuccessful exit, and no current library; allocator-write failure is separately distinguished."}, + {"id": "B6", "decision": "PASS", "evidence": "Both other-Unicode and non-Unicode reach explicit panic with exactly prior complete [R], no allocator attempt, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "Enumerates common and all class-specific println failures, prior successful prefixes, arbitrary failed-call bytes, no later steps, and exact TCB rejection."}, + {"id": "B8", "decision": "FAIL", "evidence": "Cargo/cfg composition is otherwise exact, but the only-successful-return premise consumes unverified implicit main-return semantics from B3/B4."}, + {"id": "B9", "decision": "PASS", "evidence": "Conditioning on a prior successful arena build, it proves R preceded CA; the exact TCB then stales arena, forces the arena-stop rerun, and rejects every rerun exit without reuse."}, + {"id": "B10", "decision": "FAIL", "evidence": "The compile_error proof is exact conditionally, but effective build-to-source closure still depends on the incomplete successful-arena B8 derivation."}, + {"id": "B11", "decision": "FAIL", "evidence": "The all/not body proof is exact conditionally, but current supported-source reachability depends on the incomplete B4/B8 success relation."}, + {"id": "B12", "decision": "FAIL", "evidence": "Safe use, false NZ, and zero-UB are authoritative; current-library reachability remains incomplete at the build-script normal-return edge."}, + {"id": "B13", "decision": "FAIL", "evidence": "M/WIT are algebraically exact, but maximality consumes the incomplete supported reachability certificate."}, + {"id": "B14", "decision": "FAIL", "evidence": "The zero-source proof is correct conditionally, but Required-to-current-body coverage is incomplete through B8/B11."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended UNPROVED reasoning is present, but its prerequisite complete B12 and B14 certificates do not hold."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It issues UNSOUND although the current supported library reachability link omits verified implicit-return semantics."}, + {"id": "BH7", "evidence": "F-UB's raw-arena-to-current-library reachability certificate is incomplete at normal main return."}, + {"id": "G11", "evidence": "Its build/source and maximality affirmatives necessarily rely on unchecked function-return semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "F-UB's remediation is future code requiring re-audit, not evidence for this snapshot."}, + "tcb_authority_defect": {"present": true, "evidence": "The exact TCB is carefully bounded, but normal build-script return is a material unverified Rust premise used by positive verdicts."}, + "visible_scope_defect": {"present": false, "evidence": "No prohibited evaluation or sibling material is mentioned or otherwise evidenced."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "R names 1.85.1, all three support targets, both feature/allocator/debug states, every profile/u8, and removes exactly Wasm/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The six raw classes are exhaustive via explicitly verified env::var, Result, VarError, match, tuple/literal/wildcard, and as_str propositions."}, + {"id": "B3", "decision": "FAIL", "evidence": "Absent/system [RERUN,CS] normal return is asserted without verified println success or implicit function-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "Arena [RERUN,CA] normal return lacks verified completed-line and implicit-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "Arena-stop's later panic is right, but successful CA completion is not verified because AX-EXIT covers only println failure."}, + {"id": "B6", "decision": "FAIL", "evidence": "Both rejection classes are partitioned correctly, but the completed RERUN prefix lacks verified successful println output semantics."}, + {"id": "B7", "decision": "FAIL", "evidence": "It handles every failure and arbitrary partial bytes, but the required preceding completed [RERUN] is not supported by a verified successful-println proposition."}, + {"id": "B8", "decision": "FAIL", "evidence": "The TCB and cfg stages are explicit, but the successful/failure local relation remains incomplete through B3-B7."}, + {"id": "B9", "decision": "FAIL", "evidence": "Freshness outcomes are enumerated, but the prior successful [RERUN,CA] trace lacks output/return authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The wasm/arena cfg proof is correct conditionally, but actual effective closure depends on incomplete B8 selector success."}, + {"id": "B11", "decision": "FAIL", "evidence": "AX-CFG proves complementarity conditionally, but supported current-source selection depends on incomplete B4/B8."}, + {"id": "B12", "decision": "FAIL", "evidence": "The zero/NZ/UB links are correct, but current Q-library reachability is incomplete at successful script output/return."}, + {"id": "B13", "decision": "FAIL", "evidence": "Smax and the four cases are exact algebraically, but every-complement UB reachability is not completely established."}, + {"id": "B14", "decision": "FAIL", "evidence": "The checked-body zero proof is correct conditionally, but complete Required-to-body coverage through B8 is absent."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended verdict is stated, but B12/B14 do not provide complete applicable certificates."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "The report issues UNSOUND without a fully verified successful-build reachability link."}, + {"id": "BH7", "evidence": "Its A64/on/arena safe-call certificate is incomplete at println success and normal main return."}, + {"id": "G11", "evidence": "PROVED/UNSOUND conclusions necessarily rely on unchecked successful-println and function-return semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "Repair options are explicitly prospective and do not certify the current implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is bounded correctly, but material successful-output and normal-return Rust premises are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences no inspection of prohibited oracle, evaluator, sibling, or condition material."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C exactly includes Rust/Cargo 1.85.1, all listed target/feature/allocator/profile/debug/u8 cases, and only the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "Verifies env::var, both Result/VarError variants, as_str, match, tuple/literal/wildcard rules and states the exact six-class exhaustive partition."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent and Unicode system are traced R then READ then S then normal main return, with exactly [R,S] and no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena is traced R then READ then A then normal return, with exactly [R,A] and no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "arena-stop yields [R,A] then explicit panic after successful writes and no current compilation under exact BUILD-MAP-ORDERED."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode each leave only completed [R], attempt no allocator line, explicitly panic, and produce no library."}, + {"id": "B7", "decision": "PASS", "evidence": "Covers first-write and every applicable allocator-write failure, prior complete prefixes, no later operation, and no current library without consuming failed bytes."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful system/arena returns feed exact allocator cfgs; admitted feature/target mappings plus verified cfg semantics select source, with TCB scope conspicuous."}, + {"id": "B9", "decision": "PASS", "evidence": "Proves prior arena wrote R before A, present-to-present change stales it, exhaustive rerun failures yield no current or reused library."}, + {"id": "B10", "decision": "PASS", "evidence": "For all feature/profile/debug fibers, wasm32 plus arena retains compile_error and fails; all other pairs remove it, and E is outside C."}, + {"id": "B11", "decision": "PASS", "evidence": "Defines B as the exact three-leaf conjunction and proves the first block versus not(B) checked block are exhaustive and complementary."}, + {"id": "B12", "decision": "PASS", "evidence": "A supported aarch64/burst/arena lane_id(0) safe use reaches new_unchecked(0), falsifies nonzero, invokes the exact zero-UB contract, and yields UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND = C×u8 minus B/zero; proves all included cases sound and every excluded case UB, establishing exact maximality relative to the TCB."}, + {"id": "B14", "decision": "PASS", "evidence": "Every zero case outside B selects the checked body, equality reaches panic before unsafe, covering all target/allocator/feature/profile/debug fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "States whole zero-panic theorem UNPROVED, not CONTRACT-BROKEN/PROVED, because B/zero has UB while every other zero case is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The report treats repair as future implementation followed by re-audit, never as current evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "It identifies exact BUILD-MAP-ORDERED identity/consumers/exclusions and verifies material Rust propositions with applicable versioned authorities."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing indicates inspection beyond the supplied target and exact versioned documentation."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q/L/U include Rust/Cargo 1.85.1, exact targets, both feature/allocator/debug states, every profile/u8, and sole wasm32/arena exclusion."}, + {"id": "B2", "decision": "FAIL", "evidence": "It states exact Result/VarError and literal/wildcard cases, but does not verify match-arm choice or tuple-struct enum-pattern semantics."}, + {"id": "B3", "decision": "FAIL", "evidence": "The [R,S] system returns lack verified match selection and implicit function-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The [R,A] arena return lacks verified match-arm and falling-through-main return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "The complete arena-stop prefix/panic is stated, but exact arm selection is unsupported without match semantics."}, + {"id": "B6", "decision": "FAIL", "evidence": "The R-only rows are stated, but NotUnicode tuple matching and match control are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Defines prefixes as earlier successful complete lines, leaves failed-call bytes unconstrained, and covers every write failure, later-step cutoff, and no-library result."}, + {"id": "B8", "decision": "FAIL", "evidence": "The Cargo mapping is exact conditionally, but upstream selector partition/success traces lack match and return authority."}, + {"id": "B9", "decision": "FAIL", "evidence": "The stale sequence is complete textually, but the successful arena and arena-stop source paths are not validly established."}, + {"id": "B10", "decision": "FAIL", "evidence": "The compile_error argument is correct conditionally, but effective current-build mapping remains incomplete through B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "Cfg all/not semantics are supplied, but the supported current-source partition depends on incomplete B4/B8 reachability."}, + {"id": "B12", "decision": "FAIL", "evidence": "Zero falsity and UB are authoritative, but the safe call's current-library reachability is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M has the exact intended set shape, but inclusion/maximality also use unverified if/comparison behavior and incomplete reachability."}, + {"id": "B14", "decision": "FAIL", "evidence": "It asserts zero enters the checked panic without verifying Rust if/comparison semantics or complete build-to-body coverage."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED is stated, but its UB and regional-panic prerequisite proofs are incomplete."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It reports UNSOUND without a valid authoritative match/return-supported current-library reachability link."}, + {"id": "BH7", "evidence": "The stated aarch64/burst/arena certificate is incomplete at build-path and source reachability."}, + {"id": "G11", "evidence": "Its affirmative conclusions necessarily rely on unchecked match, tuple-pattern, function-return, and if/comparison semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed repair is prospective and accompanied by a re-audit requirement."}, + "tcb_authority_defect": {"present": true, "evidence": "The Cargo TCB is bounded, but several material Rust control-flow and pattern premises are absent from its authority log."}, + "visible_scope_defect": {"present": false, "evidence": "No report evidence shows access to prohibited evaluation or sibling artifacts."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C/U recover all exact release, target, feature, allocator, profile/debug, and u8 cases and remove only wasm32/arena."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six classes are stated, but Result/VarError exact variants and literal/wildcard/tuple-pattern propositions are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "System-success rows lack verified pattern selection, successful println output, and implicit return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "Arena success asserts CFG(arena) and return without verified literal-pattern, completed-line, or function-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "arena-stop's complete line then panic is stated, but literal-arm reachability and successful-line semantics are unverified."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode R-only rejections lack verified wildcard/tuple patterns and successful stdout-line effect."}, + {"id": "B7", "decision": "FAIL", "evidence": "It models failed-call byte prefixes and all sites, but the preceding complete RERUN relies on uncited println-success semantics."}, + {"id": "B8", "decision": "FAIL", "evidence": "BUILD-MAP use is narrow, but successful raw traces and exact Rust all/not cfg source mapping remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness outcomes are correct textually, but prerequisite successful-arena and arena-stop local traces lack full authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The exclusion asserts all truth/falsehood without verifying Rust all/key-value semantics and depends on incomplete B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "H/not-H selection is asserted without version-matched all/not and false-cfg authority or complete mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "BAD has the right safe-zero and UB facts, but current-body reachability rests on incomplete build/cfg derivations."}, + {"id": "B13", "decision": "FAIL", "evidence": "SOUND is algebraically right, but its positive and excluded-case proofs rely on unverified cfg and if/comparison behavior."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-H zero panic assertion has no verified if/equality semantics and lacks complete Required-to-body mapping."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended verdict is present, but B12/B14 do not supply complete applicable certificates."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued while the current-source reachability link lacks verified pattern, output, return, and cfg semantics."}, + {"id": "BH7", "evidence": "BAD's reachability chain is incomplete despite correct safe-use, false-precondition, and UB assertions."}, + {"id": "G11", "evidence": "PROVED/UNSOUND claims necessarily rely on unchecked Result/pattern, println-success, function-return, all/not, and if/comparison premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly a future change requiring re-audit and does not support a current positive verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED remains narrow, but numerous material Rust semantic premises are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of prohibited oracle, condition, sibling, or evaluator access."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "The frozen rules do not define how much quotation is required for a proposition correctly paraphrased beside an exact versioned URL. I credited explicit, accurate paraphrases tied to the applicable page, but not a bare page identity or a citation that states only a different clause.", + "The atom dependency lists do not explicitly prescribe mechanical failure propagation. I evaluated later atoms on whether their needed dependency propositions were actually established; an earlier atom failing only an unrelated clause did not automatically force failure.", + "B7 says failed-call byte details are not required. I treated E's empty/list prefixes as lists of earlier successfully completed directives, not as an assertion that a failing write emitted zero bytes." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/attestation.json new file mode 100644 index 0000000000..a3081bf0cc --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_b_s2", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "B-s2", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T00:37:18.253475Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/raw-output-manifest.json new file mode 100644 index 0000000000..0bb431efe9 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 36275, + "path": "score.json", + "sha256": "f3be21eb3a23aca4f0f6fe5b50548fbbb7c7716734ecd31ae4f9b2ace2196b8c", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/raw-output/score.json new file mode 100644 index 0000000000..258e9aca47 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/B-s2/1/raw-output/score.json @@ -0,0 +1,258 @@ +{ + "schema_version": 1, + "mode": "B", + "scorer_id": "s2", + "reports": [ + { + "label": "C", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain section fixes Rust/Cargo 1.85.1 and all target, burst, allocator, profile, debug, and u8 cases, excluding only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered-relation table explicitly calls omitted, system, arena, arena-stop, other Unicode, and non-Unicode exhaustive."}, + {"id": "B3", "decision": "PASS", "evidence": "Its first two table rows give R then READ then the system line and normal return when both writes succeed, with no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R then READ then the arena line and normal return on successful writes, with no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "The arena-stop row gives completed R,A followed by explicit panic and states that BUILD-MAP-ORDERED produces no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other-Unicode and non-Unicode rows leave only R, panic before any allocator attempt, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It treats failed R before READ and failed system/arena writes after completed R, permits incomplete bytes, and assigns every failure no library."}, + {"id": "B8", "decision": "PASS", "evidence": "It limits cfg consumption to successful selector returns, names exact allocator, feature, and target mappings, applies Rust cfg rules, and conspicuously qualifies BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness challenge derives prior R,A, present-to-present arena-stop invalidation, rerun, exhaustive failed exits, and no stale result."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32 plus arena retains compile_error! for either feature and all profile/debug fibers, while that pair has no API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines Q as exactly aarch64/burst-on/arena and proves the two cfg bodies are the exhaustive disjoint Q and not-Q selections."}, + {"id": "B12", "decision": "PASS", "evidence": "It gives a supported safe lane_id(0) in Q, reaches new_unchecked(0), falsifies nonzero, applies the 1.85.1 UB contract, and says UNSOUND relative to BUILD-MAP-ORDERED."}, + {"id": "B13", "decision": "PASS", "evidence": "It states M = C×U minus Q/zero, proves checked and Q/nonzero sufficiency, and proves every excluded Q/zero point has UB, establishing exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every zero-input not-Q case takes the checked branch and panics before unsafe code, parametrically over profiles and debug assertions."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately reports the whole zero-panic postcondition UNPROVED, not CONTRACT-BROKEN, because Q/zero has UB while all other zero cases are proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "Repairs are explicitly future changes requiring re-audit and are not used to certify the current snapshot."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is identified and narrowly consumed only for its accepted Cargo/freshness/status mappings; Rust premises use versioned official authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied snapshot and explicitly disclaims builds, tests, prior audits, and out-of-scope binary/backend evidence."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The exact-domain section fixes 1.85.1 and defines L×U over all targets, burst states, allocators, profiles, debug states, and u8, subtracting only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "Step 2 proves the exact absent, three named Unicode, other-Unicode, and non-Unicode partition from Result, VarError, as_str, literals, and wildcard."}, + {"id": "B3", "decision": "PASS", "evidence": "Step 3 gives omitted/system as R,S then successful return when both writes succeed, and exactly the system cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "Step 3 gives Unicode arena as R,A then successful return on successful writes, and exactly the arena cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Step 4 gives arena-stop either allocator-write failure after R or completed R,A followed by explicit panic, with no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Step 4 gives other Unicode and non-Unicode explicit panic after R, no allocator line, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "Steps 1, 3, and 4 cover first and every second-write failure, preserve only earlier complete lines, allow failed-call bytes, and assign no library."}, + {"id": "B8", "decision": "PASS", "evidence": "Step 5 restricts downstream consumption to successful R,S/R,A, then maps exact allocator, burst, target cfgs, and Rust-selected source under qualified BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "Its freshness proof uses the prior R,A run, arena-to-arena-stop staleness, forced rerun, three failed outcomes, and prohibition on prior-artifact reuse."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves the wasm32/arena predicate retains compile_error! independently of burst, profile, and debug assertions and excludes that pair from L and the witness."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines C as exactly aarch64/burst-on/arena and proves cfg selects the immediate unchecked block there and the complementary checked block elsewhere."}, + {"id": "B12", "decision": "PASS", "evidence": "The opening certificate gives supported safe lane_id(0), selected unchecked reachability, false nonzero condition, exact zero-UB consequence, and an UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "M excludes exactly C/zero; the report proves every included checked or nonzero case sound and every complement fiber UB, hence exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves zero enters the checked branch and panics before unsafe code for every supported not-C configuration, with profile/debug fibers covered."}, + {"id": "B15", "decision": "PASS", "evidence": "It states the global panic promise is UNPROVED rather than CONTRACT-BROKEN or PROVED because the only uncovered zero executions contain UB."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The suggested repairs are not implemented or used as evidence for any current-snapshot verdict."}, + "tcb_authority_defect": {"present": false, "evidence": "The report names BUILD-MAP-ORDERED exactly, confines its consumers, and separately supports Rust semantics with versioned Reference/std authority."}, + "visible_scope_defect": {"present": false, "evidence": "It describes only the supplied files and expressly says no build, run, expansion, modification, prior material, or tool evidence was used."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Required is defined as Rust/Cargo 1.85.1, C×all u8, with all T×B×A×P×D fibers and exactly the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "BUILD-1 explicitly proves absent, system, arena, arena-stop, other Unicode, and non-Unicode are the exhaustive raw classes."}, + {"id": "B3", "decision": "PASS", "evidence": "The table gives omitted/system successful R,S and normal return, with exactly system selected and no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "The table gives Unicode arena successful R,A and normal return, with exactly arena selected and no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop with successful writes leaves R,A and explicitly panics; the same row and TCB qualification say no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave R, panic before an allocator print, and have no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "The table covers first-write and every class-specific second-write failure, models arbitrary failed-call fragment q, and gives no library on all failures."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selector rows feed exact allocator cfgs; BUILD-1 and the projection apply admitted feature/target mappings and Rust cfg selection with explicit TCB boundaries."}, + {"id": "B9", "decision": "PASS", "evidence": "BUILD-2 derives prior R,A, present-to-present invalidation, mandatory rerun, all three failed outcomes, and no current or stale arena library."}, + {"id": "B10", "decision": "PASS", "evidence": "CFG-1 proves wasm32/arena includes compile_error! for both feature states and all profile/debug fibers and yields no supported library."}, + {"id": "B11", "decision": "PASS", "evidence": "The source projection and U definition prove the unchecked body exactly for aarch64/burst-on/arena and the checked complementary body everywhere else."}, + {"id": "B12", "decision": "PASS", "evidence": "SOUND-1 supplies a supported safe zero call, exact selected reachability, false nonzero precondition, documented UB, and whole-domain UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "S is not-U or nonzero; the positive proof covers every member and SOUND-1 applies to every omitted U/zero fiber, proving exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "The panic section proves every supported not-U zero input executes panic before unsafe, with the domain proof retaining all profiles and debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "It gives the full panic theorem UNPROVED, not CONTRACT-BROKEN, because U/zero is UB while every other zero case is regionally proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The minimum repair is presented only as future remediation followed by re-audit, not as current evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is conspicuously limited to its exact accepted build propositions, while material Rust leaves cite 1.85.1 authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report says it used the supplied crate/policies only and no build, test, prior audit, dependency, generated material, or tool result."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "It defines S×U from Rust/Cargo 1.85.1 and the full target, feature, allocator, profile, debug, and u8 product, removing only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered table and preceding Result/VarError proof explicitly exhaust omitted, system, arena, arena-stop, other Unicode, and non-Unicode."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted and Unicode system rows give R,CS then normal success if both writes succeed, with no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R,CA then normal success if both writes succeed, with no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "The arena-stop row gives completed R,CA then explicit panic, or prior R on write failure, and TCB-ORDERED supplies no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode rows give completed R, no allocator attempt, explicit panic, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It enumerates common line 4 and class-specific lines 8, 12, 15, 18 failures, allows arbitrary partial bytes, and rejects every exit."}, + {"id": "B8", "decision": "PASS", "evidence": "Exactly the accepted successful classes feed current allocator cfgs; the report then applies admitted burst/target leaves and Rust cfg semantics under an explicit TCB alias."}, + {"id": "B9", "decision": "PASS", "evidence": "The same-directory proof derives prior R,CA, arena-stop staleness, rerun, all write/panic exits, and no reuse of the old library."}, + {"id": "B10", "decision": "PASS", "evidence": "The exact-exclusion section proves both directions of wasm32/arena compile_error! rejection for every feature/profile/debug fiber and no API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines K exactly as aarch64/burst-on/arena and proves the first and not-all blocks select K and its complement over all P×D."}, + {"id": "B12", "decision": "PASS", "evidence": "F-UB gives a supported safe lane_id(0), K reachability, false NZ, exact new_unchecked zero UB, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "M removes exactly WIT=K/zero; all M cases discharge NZ or panic, and each complement point has UB, proving equality and maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "The report proves every not-K zero case executes the equality branch and panic before unsafe across the supported configuration fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "It reports the universal panic contract UNPROVED, not CONTRACT-BROKEN or PROVED, because K/zero has UB and the complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed checked-constructor repair is clearly future work and does not alter the current UNSOUND/UNPROVED judgments."}, + "tcb_authority_defect": {"present": false, "evidence": "TCB-ORDERED is explicitly defined as the exact BUILD-MAP-ORDERED entry and is not widened; Rust claims use versioned official sources."}, + "visible_scope_defect": {"present": false, "evidence": "It confines the audit to supplied files and expressly excludes builds, tests, prior audits, external dependencies, backend, and binary evidence."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Its normalization gives exactly all 1.85.1 T×F×A×P×D×u8 cases except wasm32/arena, with both policy containments explicit."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered relation exhausts absent, system, arena, arena-stop, every other Unicode string, and non-Unicode using exact Result/VarError and match facts."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent and Unicode system attempt R then S and, on both successful writes, return normally with exactly system and no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena attempts R then A and, on both successful writes, returns normally with exactly arena and no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop either fails its A write after R or completes R,A then explicitly panics; the report states no current compilation follows."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode explicitly panic after R, attempt no allocator line, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers R failure before READ and every second-write failure after R, counts only complete earlier lines, and gives every failure no library."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selector runs supply exactly one allocator cfg; the report applies exact admitted feature/target cfgs and checked Rust selection without widening BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness paragraph derives prior R,A, arena-stop staleness and rerun, all three unsuccessful outcomes, and no current or earlier arena artifact."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena makes all(...) true and compile_error! fail for both feature states and all P,D, while every other tuple removes the item."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines B exactly as aarch64/burst-on/arena and proves the source cfg predicates are B and not-B, selecting exactly one corresponding body."}, + {"id": "B12", "decision": "PASS", "evidence": "The certificate chooses supported aarch64/burst-on/arena lane_id(0), reaches the unchecked call, falsifies NZ, applies exact UB text, and declares UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND excludes exactly B/zero; all included cases are proved safe or panic before unsafe, and every complement point has UB, establishing unique maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It states the exact proved panic region is every supported not-B zero case and derives equality, if, and panic before unsafe across all P,D."}, + {"id": "B15", "decision": "PASS", "evidence": "The report separately says the full postcondition is UNPROVED, not CONTRACT-BROKEN, because B/zero has UB while the exact complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "F-1's proposed repair is not implemented or used to narrow or certify the current artifact."}, + "tcb_authority_defect": {"present": false, "evidence": "It records the exact accepted BUILD-MAP-ORDERED identity and consumers, explicitly denies widening, and checks Rust leaves against 1.85.1 authority."}, + "visible_scope_defect": {"present": false, "evidence": "It identifies the supplied snapshot and says no build, execution, expansion, test, tool evidence, or additional assumptions were used."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain R and surrounding prose fix 1.85.1 and the full T×burst×allocator×P×D×u8 product, subtracting all wasm32/arena fibers only."}, + {"id": "B2", "decision": "PASS", "evidence": "The complete relation expressly exhausts absent, system, arena, arena-stop, all other Unicode, and non-Unicode via Result/VarError and pattern semantics."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent/system success is exactly RERUN,CS then normal return and the system cfg; no arena line is present."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena success is exactly RERUN,CA then normal return and the arena cfg; no system line is present."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop with successful writes leaves RERUN,CA then explicit panic, and the report states the completed selector cannot produce a current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave only RERUN, explicitly panic without allocator output, and produce no library."}, + {"id": "B7", "decision": "PASS", "evidence": "It models partial(L), covers first-write and every second-write failure, preserves only earlier complete RERUN, and rejects every failed execution."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful RERUN,CS/CA is consumed; exact allocator, burst, and target cfgs then select source under conspicuously bounded BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness witness derives prior RERUN,CA, present-value change, forced rerun, three unsuccessful cases, and no stale/current arena result."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena alone activates compile_error! independent of burst, profile, and debug assertions, with no library or witness from that pair."}, + {"id": "B11", "decision": "PASS", "evidence": "The source closure defines F exactly as aarch64/burst-on/arena and selects only the unchecked body there and only the checked body elsewhere."}, + {"id": "B12", "decision": "PASS", "evidence": "It supplies supported A64/burst-on/arena lane_id(0), safe-use validity, selected reachability, false NZ, authoritative zero UB, and UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "Smax is not-F or nonzero; three included cases prove soundness and F/zero proves every complement point UB, establishing maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-F zero case takes the equality branch and panics before unsafe, with all P×D fibers retained."}, + {"id": "B15", "decision": "PASS", "evidence": "It reports the global zero-panic theorem UNPROVED rather than CONTRACT-BROKEN because only UB cases remain after the proved not-F region."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The minimum repair is future remediation and is not used as support for the current artifact's verdicts."}, + "tcb_authority_defect": {"present": false, "evidence": "The exact BUILD-MAP-ORDERED entry and its narrow consumers are recorded; Cargo is not used as Rust authority and Rust claims cite 1.85.1 sources."}, + "visible_scope_defect": {"present": false, "evidence": "It states that only the supplied snapshot was audited and that no build, execution, expansion, test, prior audit, or external result was used."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain section fixes exact 1.85.1 C0×u8, every target, burst, allocator, profile, and debug fiber, with only wasm32/arena removed."}, + {"id": "B2", "decision": "PASS", "evidence": "The build section calls absent, system, arena, arena-stop, other Unicode including empty, and non-Unicode an exact exhaustive partition."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent/system successful writes give exactly R,Sline and normal return, selecting system only."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena successful writes give exactly R,Aline and normal return, selecting arena only."}, + {"id": "B5", "decision": "PASS", "evidence": "Successful arena-stop writes completed R,Aline then explicitly panics, and BUILD-MAP-ORDERED is used to derive no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode panic with completed R before any allocator attempt and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers failed R before READ and all second-write failures after R, permits an arbitrary fragment q, and assigns no source effect or library."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selectors supply exact allocator cfgs; admitted burst/target leaves and Rust cfg then select source under explicit BUILD-MAP-ORDERED limits."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness certificate derives prior completed R, arena-stop invalidation, rerun, all failed outcomes, and no old library as current."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena exactly retains compile_error! for both feature states and every profile/debug fiber and is rejected before any API use."}, + {"id": "B11", "decision": "PASS", "evidence": "K is exactly aarch64/burst-on/arena; cfg semantics are used to prove the first body on K and the complementary checked body on not-K."}, + {"id": "B12", "decision": "PASS", "evidence": "F-1 gives a supported successful arena build and safe lane_id(0), reaches new_unchecked(0), falsifies its contract, applies UB, and says UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "M is not-K or nonzero; the report proves each included case safe and every omitted K/zero point UB, so the region is exact and maximal."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-K zero execution takes the check and panics before unsafe, parametrically over profiles and debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately concludes the whole panic postcondition is UNPROVED, not CONTRACT-BROKEN, because K/zero is UB and not-K is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly prospective and no design change is used to affect the current-snapshot verdicts."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is accepted only at its stated identity and consumers; Cargo pages are corroboration only and Rust premises use versioned authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied files and expressly says no prior audit, test, dependency, tool result, generated source, or backend evidence was used."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Supported fixes Rust/Cargo 1.85.1 and all T×B×A×P×D×V cases, with V all u8 and only wasm32/arena excluded."}, + {"id": "B2", "decision": "PASS", "evidence": "The relation explicitly says its omitted, system, arena, arena-stop, other Unicode, and non-Unicode rows are all raw classes."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted/system rows give R,S and normal success when both writes succeed, with system as the exact mapping and no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R,A and normal success when both writes succeed, with arena as the exact mapping and no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop gives completed R,A then explicit panic when writes succeed and is explicitly excluded from any successful current execution/library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other-Unicode and non-Unicode give completed R, explicit panic, no allocator attempt, and no current library under the accepted premise."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers failed R before classification and each allocator-write failure after R, allows incomplete failing bytes, and gives every failed exit no library."}, + {"id": "B8", "decision": "PASS", "evidence": "The successful mapping is limited to accepted returns; exact allocator, burst, and target cfgs feed Rust source selection with BUILD-MAP-ORDERED conspicuously bounded."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness proof derives prior R,A, present-to-present arena-stop invalidation, rerun, every failed outcome, and no prefix or old artifact as current."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves successful wasm32/arena sets both cfg leaves, retains compile_error! for all feature/profile/debug cases, and yields no library."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines C exactly as aarch64/burst-on/arena and proves the cfg blocks form an exhaustive complementary C/not-C source partition."}, + {"id": "B12", "decision": "PASS", "evidence": "It gives supported safe zero use in C, exact unchecked reachability, false nonzero proposition, versioned zero-UB consequence, and whole-domain UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "M is Supported×V with C/zero removed; the report proves all M cases safe and all excluded points UB, hence both containment and exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every not-C zero call takes the equality branch and panics before the unsafe call across all profile/debug fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "It says the whole panic promise is UNPROVED, not CONTRACT-BROKEN, because C/zero contains UB while not-C/zero is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The suggested validation change is clearly a future repair and is not used to certify the current source."}, + "tcb_authority_defect": {"present": false, "evidence": "The report identifies BUILD-MAP-ORDERED and restricts it to exact accepted Cargo/status/freshness leaves; Rust claims use 1.85.1 official sources."}, + "visible_scope_defect": {"present": false, "evidence": "It describes the complete supplied snapshot and explicitly disclaims dependencies, generated files, tool results, builds, tests, and prior audits."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q and U cover exact Rust/Cargo 1.85.1 T×F×A×P×D×u8, subtracting every wasm32/arena feature/profile/debug fiber and no other case."}, + {"id": "B2", "decision": "PASS", "evidence": "B-01 explicitly labels omitted, system, arena, arena-stop, every other Unicode, and non-Unicode as the exhaustive remaining relation."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted/system successful R,L_s writes end in normal return and exactly system; no arena selector occurs."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena successful R,L_a writes end in normal return and exactly arena; no system selector occurs."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop completes R,L_a then explicitly panics when writes succeed, and both its exits are assigned no current result."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave R, panic before any selector attempt, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It quantifies arbitrary failed-write bytes p(X), covers first and every applicable second write, preserves only prior R, and rejects all failures."}, + {"id": "B8", "decision": "PASS", "evidence": "Only normal accepted exits supply the exact current allocator cfg; admitted feature/target mappings and Rust cfg select source under explicit BUILD-MAP-ORDERED limits."}, + {"id": "B9", "decision": "PASS", "evidence": "B-02 derives prior successful R,L_a, present arena-stop staleness, forced rerun, three failed outcomes, and no stale/current library."}, + {"id": "B10", "decision": "PASS", "evidence": "B-03 proves every wasm32/arena fiber retains compile_error! and fails compilation, while this pair is outside Q and no API is produced."}, + {"id": "B11", "decision": "PASS", "evidence": "B-03 defines C exactly as aarch64/burst-on/arena and states cfg selects only the immediate unchecked body on C and only the checked body on not-C."}, + {"id": "B12", "decision": "PASS", "evidence": "F-01 gives a supported safe lane_id(0), C reachability, false nonzero requirement, exact standard-library UB, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "S is not-C or nonzero; S-01/S-02 prove every included case sound and every excluded C/zero case UB, establishing exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "S-01 proves every supported not-C zero input executes panic before unsafe and explicitly covers all profile/debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "POST-01 declares the universal panic theorem UNPROVED rather than CONTRACT-BROKEN, because C/zero has UB and the complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "F-01's code repair is only a recommendation followed by re-audit, never evidence for present soundness or postconditions."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is named, scoped to its exact accepted Cargo propositions and consumers, and not substituted for cited Rust 1.85.1 semantics."}, + "visible_scope_defect": {"present": false, "evidence": "The report limits itself to supplied files and says no build, execution, test, expansion, dependency, tool result, or extra premise was used."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain fixes Rust/Cargo 1.85.1 and C×U over all T×B×A×P×D and u8, with exactly the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "It explicitly defines the disjoint exhaustive raw set as absent, three named Unicode values, other Unicode, and non-Unicode."}, + {"id": "B3", "decision": "PASS", "evidence": "The table and failure prose give absent/system as successful RERUN then READ then CFG(system) then return, with no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "They give Unicode arena as successful RERUN then READ then CFG(arena) then return, with no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop completes RERUN,CFG(arena) then explicitly panics when writes succeed, and BUILD-MAP-ORDERED makes the prefix inert with no library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave RERUN, attempt no allocator write, explicitly panic, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers first-write failure before READ and each later CFG failure after RERUN, permits byte prefixes, and assigns no library to every failed exit."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful current CFG(a) reaches compilation; exact admitted allocator, feature, and target mappings feed Rust cfg source selection under qualified BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness witness derives prior RERUN,CFG(arena), registered present-value change, mandatory rerun, exhaustive failed exits, and no stale artifact."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena makes the compile_error! cfg true regardless of burst and rejects all such current compilations, with no excluded API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines H exactly as aarch64/burst-on/arena and states admitted mappings plus all/not cfg semantics select the first body on H and the checked complement otherwise."}, + {"id": "B12", "decision": "PASS", "evidence": "BAD supplies supported safe lane_id(0), H-selected reachability, false nonzero condition, exact zero-UB consequence, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND removes exactly H/zero; the positive bullets cover every member and BAD applies to every complement profile/debug fiber, proving maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-H zero input executes the check and panic before the unsafe call, with profiles and debug states retained."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately reports the full panic postcondition UNPROVED, not CONTRACT-BROKEN, because H/zero has UB while all not-H zero cases are proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The recommended dominating check is prospective remediation and is not used to certify or narrow current obligations."}, + "tcb_authority_defect": {"present": false, "evidence": "The TCB log names BUILD-MAP-ORDERED, exact identity and consumers, denies widening, and uses official versioned Rust pages for semantic premises."}, + "visible_scope_defect": {"present": false, "evidence": "It confines the audit to the supplied manifest, policies, TCB, build script, and library and disclaims tests, prior audits, generated files, and tool results."}, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/attestation.json new file mode 100644 index 0000000000..52b485d701 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_l_s1", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "L-s1", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T01:00:50.968667Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/raw-output-manifest.json new file mode 100644 index 0000000000..163582679e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 24727, + "path": "score.json", + "sha256": "87526ee57cfbfc1982ea9fdf0470262453682430fc4fe0193d26e7c0c0fc317b", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/raw-output/score.json new file mode 100644 index 0000000000..da2e7dcb4f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s1/1/raw-output/score.json @@ -0,0 +1,239 @@ +{ + "schema_version": 1, + "mode": "L", + "scorer_id": "s1", + "reports": [ + { + "label": "F", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "Calls in-bounds the exact get_unchecked obligation, notes OOB is UB, and derives I < L."}, + {"id": "L2", "decision": "FAIL", "evidence": "AX-IF quotes false => else but the proof uses the unsupported converse else => false."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN explicitly identifies L as an element count represented as usize; as a natural count, L != 0 yields L >= 1."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability/profile independence as predecessor arithmetic without checking Rust subtraction or overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 explicitly derives I = L - 1 and 0 <= I < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The full-scope PROVED closure depends on the unsupported branch, usize-domain, and subtraction premises."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately deems the lifetime-only comment deficient because it omits the bounds obligation and derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "Supplies adjacent text from false is_empty through nonzero length, defined predecessor, and the in-bounds conclusion."}, + {"id": "L9", "decision": "FAIL", "evidence": "The four-entry inventory omits built-in subtraction/overflow and the rubric's separate usize-domain entry."}, + {"id": "L10", "decision": "FAIL", "evidence": "Required numeric/subtraction/overflow entries are absent, and AX-IF's quote does not establish the proposition claimed."}, + {"id": "L11", "decision": "FAIL", "evidence": "Its claim that no other Rust proposition is consumed conflicts with the unchecked numeric and control-flow premises."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Claims a complete authoritative reconciliation while silently consuming subtraction/overflow semantics and reversing AX-IF."}, + {"id": "G11", "evidence": "The positive verdict necessarily relies on unchecked subtraction/overflow semantics and an inapplicable implication direction for AX-IF."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is only a repair; the current-artifact verdict is not based on its implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "The asserted Rust-only TCB omits consumed subtraction/overflow authority and overclaims the cited if proposition."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences only the supplied source and versioned allowlisted Rust authorities."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states the in-bounds requirement and OOB UB for the usize call."}, + {"id": "L2", "decision": "PASS", "evidence": "O1 and AX-IF establish false on the else path; AX-EMPTY contraposition yields n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN and AX-USIZE establish n: usize, unsigned, hence n > 0."}, + {"id": "L4", "decision": "PASS", "evidence": "O2 checks subtraction and overflow authority and proves n - 1 representable in every profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 derives 0 <= n - 1 < n and identifies index with that value."}, + {"id": "L6", "decision": "PASS", "evidence": "Gives full requested scope, exhaustive branch coverage, and an explicit Required subset-of Covered certificate."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately marks the lifetime comment deficient for omitting the exact bounds proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false branch, zero-length contract, positivity, no underflow, index < len, and get_unchecked's requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "Inventories if, is_empty, len/type, usize, subtraction, overflow, and get_unchecked, separating source facts and mathematics."}, + {"id": "L10", "decision": "PASS", "evidence": "Each consumed Rust/std premise has a narrow 1.82.0 URL, exact excerpt, proposition, consumer, and applicability statement."}, + {"id": "L11", "decision": "PASS", "evidence": "Explicitly maps every AX entry to O1-O3 and states no unlisted Rust/std or tool premise supplies an inference."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is not used to certify the current implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The Rust 1.82 authority inventory is complete, applicable, checked, and reconciled."}, + "visible_scope_defect": {"present": false, "evidence": "The report stays within the supplied source and allowlisted versioned authority."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A7 identifies in-bounds indexing as required and an OOB index as UB."}, + {"id": "L2", "decision": "FAIL", "evidence": "A2 quotes false => else but claims that execution of else entails false, reversing the cited implication."}, + {"id": "L3", "decision": "PASS", "evidence": "A3 gives len's usize type and A4 gives unsigned nonnegativity, yielding L >= 1 from L != 0."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 plus L >= 1 establish representability and no overflow under any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 identifies index = L - 1 and derives 0 <= index < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The claimed exhaustive full-scope closure depends materially on A2's unsupported converse."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately calls the current lifetime-only comment deficient and distinguishes artifact from implementation."}, + {"id": "L8", "decision": "PASS", "evidence": "Provides adjacent wording covering false branch, zero-length implication, nonzero length, defined predecessor, bound, and callee requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A7 inventory all required Rust/std leaves and identifies remaining derivation as source facts or mathematics."}, + {"id": "L10", "decision": "FAIL", "evidence": "The exact A2 excerpt does not supply its verified proposition that else execution entails a false condition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact reconciliation overlooks the unsupported direction of the consumed branch premise."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Attests complete premise reconciliation although A2's quoted authority does not establish the branch proposition consumed."}, + {"id": "G11", "evidence": "The PROVED result necessarily relies on an invalid converse of the quoted if rule."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement is a documentation proposal, not evidence for the current proof."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-1 overstates what its A2 authority excerpt verifies."}, + "visible_scope_defect": {"present": false, "evidence": "No prohibited material or out-of-scope inspection is evidenced."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states the in-bounds obligation and OOB UB; the proof targets index < len."}, + {"id": "L2", "decision": "FAIL", "evidence": "AX-IF supplies false => else, not the claimed else => false needed on the unsafe path."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize and AX-USIZE gives nonnegativity, so n != 0 implies n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "AX-SUB/AX-OVERFLOW and n >= 1 prove n - 1 representable under every overflow setting."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 4 derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "Its closure relies on the unsupported AX-IF converse and defines Required without the valid-call/input dimension."}, + {"id": "L7", "decision": "PASS", "evidence": "Correctly separates a deficient lifetime comment from a sound implementation claim."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text gives false branch, len > 0, non-underflowing subtraction, index < len, same slice, and get_unchecked."}, + {"id": "L9", "decision": "PASS", "evidence": "Inventories all seven required Rust/std premises and classifies local/source and arithmetic reasoning."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF's quoted sentence does not verify the report's only-for-false proposition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The stated exact reconciliation misses the invalid implication direction at the control-flow leaf."} + ], + "hard_errors": [ + {"id": "G1", "evidence": "The formal Required product omits valid calls/inputs even though the full PROVED verdict quantifies over them."}, + {"id": "LH4", "evidence": "Claims every nonlocal premise is checked and reconciled while AX-IF does not support the consumed converse."}, + {"id": "G11", "evidence": "The positive proof necessarily relies on an inapplicable direction of its cited if authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The comment repair is not treated as implemented current evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "The asserted Rust-only authority set contains an unsupported AX-IF proposition."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied source and allowed Rust pages."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A4 states OOB UB and the required in-bounds usize index."}, + {"id": "L2", "decision": "FAIL", "evidence": "A3 quotes only false => consequent skipped and vaguely invokes other branch rules; it does not extract authority proving else-path false."}, + {"id": "L3", "decision": "FAIL", "evidence": "It calls the element count a natural number but never verifies len's usize type or usize's nonnegative domain."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability/no underflow across profiles without inventorying built-in subtraction or Rust overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 explicitly derives index = n - 1 with 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The PROVED closure depends on unsupported control-flow, unsigned-domain, and subtraction premises."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately finds the lifetime comment materially deficient for omitting the in-bounds derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false is_empty, nonzero len, representable predecessor, index < len, and get_unchecked's bounds need."}, + {"id": "L9", "decision": "FAIL", "evidence": "The four-entry list omits len's usize type, usize domain, built-in subtraction, and overflow behavior."}, + {"id": "L10", "decision": "FAIL", "evidence": "Required numeric/arithmetic authorities are absent and A3's excerpt does not supply the asserted branch biconditional."}, + {"id": "L11", "decision": "FAIL", "evidence": "Its completeness/no-silent-premise claim conflicts with the omitted Rust numeric and branch premises."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Calls the authority list complete while silently consuming usize, subtraction, overflow, and inadequately checked branch semantics."}, + {"id": "G11", "evidence": "The positive result necessarily relies on unchecked Rust numeric and control-flow authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement wording is not used as if already implemented."}, + "tcb_authority_defect": {"present": true, "evidence": "The purported authoritative inventory omits multiple consumed Rust premises."}, + "visible_scope_defect": {"present": false, "evidence": "Only supplied source facts and allowlisted Rust documentation are evidenced."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A-GET quotes both the in-bounds obligation's OOB UB consequence and the element-reference result."}, + {"id": "L2", "decision": "PASS", "evidence": "A-IF quotes both arm-selection directions; A-EMPTY contraposition yields nonzero length on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A-LEN establishes n: usize and A-USIZE nonnegativity, deriving n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A-SUB/A-OVERFLOW plus n >= 1 establish no underflow or overflow in every profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 derives index = n - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "Exhaustive paths, parametric target/profile proof, and Required subset-of Covered are explicit."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately labels the lifetime statement deficient because it omits the bounds and arithmetic proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Adjacent replacement covers false branch, zero-length implication, nonzero len, defined subtraction, strict bound, and get_unchecked."}, + {"id": "L9", "decision": "PASS", "evidence": "A-GET through A-USIZE inventory every required Rust/std leaf and separate source facts and mathematics."}, + {"id": "L10", "decision": "PASS", "evidence": "All entries use narrow 1.82.0 URLs, exact excerpts, verified propositions, consumers, and full-domain qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "TCB/reconciliation states the exact consumers and excludes any additional premise, dependency, tool, or test."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The repair proposal is separate from the proof of the supplied implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The authority set is version-matched, proposition-checked, complete, and consumer-mapped."}, + "visible_scope_defect": {"present": false, "evidence": "No evidence of inspecting anything beyond supplied source and allowed authority appears."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states that OOB is UB and requires an in-bounds usize element index."}, + {"id": "L2", "decision": "PASS", "evidence": "AX-IF quotes true/false arm selection and AX-EMPTY contraposition establishes L != 0 on the unsafe path."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives L: usize and AX-USIZE gives minimum zero, so L != 0 implies L >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "AX-SUB/AX-OVERFLOW show L - 1 remains in range in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Steps 3-4 derive index = L - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "It covers both Boolean paths across the exact target/profile domain and explicitly proves Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately deems the existing comment deficient despite proving the implementation."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text gives the false branch, nonzero length, representable subtraction, strict bound, and get_unchecked obligation."}, + {"id": "L9", "decision": "PASS", "evidence": "The seven-entry inventory covers all required Rust/std premises and classifies local facts and integer reasoning."}, + {"id": "L10", "decision": "PASS", "evidence": "Every entry has the matching 1.82.0 narrow URL, extracted text/table fact, verified proposition, and applicability."}, + {"id": "L11", "decision": "PASS", "evidence": "The proof consumes AX-IF through AX-GET as mapped and expressly excludes additional TCB or unlisted premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is a repair recommendation, not current-artifact proof evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "TCB-R182-v1 contains checked, applicable Rust authority for every consumed semantic premise."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no inspection beyond the supplied target and allowlisted authority."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 states the in-bounds usize obligation and OOB UB."}, + {"id": "L2", "decision": "FAIL", "evidence": "A4 quotes false => else but uses it as else => false on the unsafe path."}, + {"id": "L3", "decision": "FAIL", "evidence": "A2 verifies only element count; the proof's n: usize premise is neither inventoried nor checked as len's return type."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and n >= 1 establish an in-range subtraction in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "The proof explicitly computes i = n - 1 and derives 0 <= i < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "Full Required closure depends on the unsupported branch converse and unverified len-to-usize link."}, + {"id": "L7", "decision": "PASS", "evidence": "The report separately finds the lifetime-only comment deficient and not an implementation defect."}, + {"id": "L8", "decision": "PASS", "evidence": "Adjacent replacement covers false branch, zero-length relation, nonzero len, safe predecessor, strict bound, and callee."}, + {"id": "L9", "decision": "FAIL", "evidence": "It omits len's usize return type as a Rust/std premise and instead misclassifies inferred index typing as a local source fact."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 does not extract the usize return type, and A4's quote does not establish its claimed reverse implication."}, + {"id": "L11", "decision": "FAIL", "evidence": "The no-unlisted-premise reconciliation conflicts with the unchecked len typing and branch direction."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Certifies A1-A7 as complete while silently consuming len's return type and reversing the checked A4 implication."}, + {"id": "G11", "evidence": "The implementation verdict necessarily relies on unchecked/inapplicable Rust authority at two material links."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is not treated as part of the supplied artifact."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-1 omits the consumed len return-type proposition and overclaims A4."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences no prohibited or out-of-scope source access."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 quotes OOB UB and states the in-bounds usize index requirement."}, + {"id": "L2", "decision": "FAIL", "evidence": "A4's exact quote establishes false => else, not execution of else => false as consumed in O2."}, + {"id": "L3", "decision": "PASS", "evidence": "A2 establishes n: usize and A5 its zero minimum, deriving n >= 1 from n != 0."}, + {"id": "L4", "decision": "PASS", "evidence": "A6 checks subtraction/overflow and proves n - 1 representable across all ordinary profiles."}, + {"id": "L5", "decision": "PASS", "evidence": "O2-O3 explicitly derive index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The advertised Required subset-of Covered certificate materially relies on A4's unsupported converse."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately reports the comment deficient for omitting the actual bounds proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false branch, nonzero len, representability, strict bound, and the adjacent in-bounds obligation."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A6 inventory all required semantic leaves, with subtraction/overflow combined and consumers reconciled."}, + {"id": "L10", "decision": "FAIL", "evidence": "A4's quoted proposition does not supply the verified proposition used for branch reachability."}, + {"id": "L11", "decision": "FAIL", "evidence": "The explicit reconciliation overlooks that A4 is consumed in an unverified direction."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Claims only checked version-matched premises and complete reconciliation while A4 does not support the consumed converse."}, + {"id": "G11", "evidence": "The positive proof necessarily relies on an inapplicable direction of its if authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The documentation repair is not used as current implementation evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-R1 overstates the branch proposition established by A4."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of prohibited evaluation or sibling material access."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A5 quotes OOB UB and states 0 <= index < n as the usize in-bounds obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "A3 quotes both branch-selection directions and A2 contraposition yields n != 0 on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A1 gives n: usize and A4 gives minimum zero, hence a nonzero n is at least one."}, + {"id": "L4", "decision": "PASS", "evidence": "A4 checks integer minus and overflow bounds, proving n - 1 in range for every width/profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O1 derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 exhaust both branches and explicitly establish Required subset-of Covered over the full symbolic domain."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately finds the existing lifetime comment inadequate while retaining implementation PROVED."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states branch false, nonzero length, defined subtraction, strict bound, and get_unchecked's requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A5 cover all seven required Rust/std propositions, with numeric and arithmetic entries grouped, and classify remaining logic/source facts."}, + {"id": "L10", "decision": "PASS", "evidence": "Every consumed premise has a narrow 1.82.0 URL, exact quoted prose/signature/table entry, verified proposition, and scope."}, + {"id": "L11", "decision": "PASS", "evidence": "The TCB log and O1-O3 mapping reconcile every authority to a consumer and exclude silent assumptions."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is a proposed artifact repair and does not narrow or certify the current obligation."}, + "tcb_authority_defect": {"present": false, "evidence": "A1-A5 are version-matched, proposition-checked, applicable, complete, and reconciled."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied source and allowlisted Rust documentation."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "L8 does not specify whether a replacement must spell out the usize nonnegative-to-positive bridge verbatim; I treated direct nonzero/positive-length to defined-subtraction wording as sufficient when the bound and callee obligation were explicit." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/attestation.json new file mode 100644 index 0000000000..9a72e4c271 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_l_s2", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "L-s2", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T00:51:44.004738Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/raw-output-manifest.json new file mode 100644 index 0000000000..89c0a1b047 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 25849, + "path": "score.json", + "sha256": "99564b83ed633e6194dbb67918706172806638a651a800fc3a7d5d939c99d479", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/raw-output/score.json new file mode 100644 index 0000000000..f65fe1280a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/L-s2/1/raw-output/score.json @@ -0,0 +1,228 @@ +{ + "schema_version": 1, + "mode": "L", + "scorer_id": "s2", + "reports": [ + { + "label": "J", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states that an out-of-bounds get_unchecked index is UB, and O3 identifies in-bounds as the call obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "O1/O2 place the call in the false else arm and contrapose AX-EMPTY to obtain n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize and AX-USIZE supplies the unsigned domain, from which O2 derives n > 0."}, + {"id": "L4", "decision": "PASS", "evidence": "O2 proves n - 1 remains in range and explicitly makes the result independent of overflow checks and profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 substitutes index = n - 1 and derives 0 <= n - 1 < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report connects the branch/arithmetic proof to AX-GET, claims PROVED over the full requested scope, and gives Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately calls the comment deficient because the lifetime sentence establishes neither the bounds obligation nor its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The proposed adjacent comment names is_empty and get_unchecked and exposes nonzero length, defined subtraction, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "The inventory includes if selection, is_empty, len/type, usize, subtraction, overflow, and get_unchecked, while classifying source and mathematical steps."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF quotes true=>consequent and false=>else but omits the text that a true condition skips else, so the quotation does not supply the consumed else-reached=>false direction."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact reconciliation depends on the inadequately extracted AX-IF branch-selection proposition."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is proposed only after the current implementation is proved; it is not used to narrow or certify the implementation obligation."}, + "tcb_authority_defect": {"present": true, "evidence": "The AX-IF quotation does not establish the converse branch fact the proof consumes."}, + "visible_scope_defect": {"present": false, "evidence": "The report discusses only the supplied source/request and the permitted Rust 1.82.0 authorities."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-UNCHECKED states that an out-of-bounds index is UB and step 4 treats in-bounds as the exact obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "Step 2 identifies the false else path and contraposes the zero-length is_empty contract to L != 0."}, + {"id": "L3", "decision": "FAIL", "evidence": "Although AX-LEN notes a usize return, the report substitutes 'natural count' and never checks the required nonnegative usize value-domain premise."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability and profile independence without checking Rust 1.82.0 integer-minus or overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 explicitly uses I = L - 1 and predecessor arithmetic to derive 0 <= I < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The all-scope PROVED closure depends on the unverified usize-domain, subtraction, and overflow premises, so the implementation certificate is incomplete."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime-only comment deficient and distinguishes that defect from implementation status."}, + {"id": "L8", "decision": "FAIL", "evidence": "The proposed comment gives a bounds chain but neither identifies get_unchecked in the text nor refers to checked usize/subtraction/overflow propositions, which the report lacks."}, + {"id": "L9", "decision": "FAIL", "evidence": "The claimed complete inventory omits the usize value domain, built-in subtraction meaning, and overflow/profile semantics materially used by steps 2-3."}, + {"id": "L10", "decision": "FAIL", "evidence": "No version-matched checked entries or exact quotations are supplied for usize, subtraction, or overflow; AX-IF also quotes only false=>else."}, + {"id": "L11", "decision": "FAIL", "evidence": "The report says no other Rust proposition is consumed despite silently using the omitted integer premises."} + ], + "hard_errors": [ + {"id": "G11", "evidence": "The PROVED result necessarily relies on unchecked Rust usize-domain, integer-subtraction, and overflow premises."}, + {"id": "LH4", "evidence": "It claims the authority inventory is complete while silently consuming Rust integer-domain, subtraction, and overflow semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is not used as evidence that the current implementation is sound."}, + "tcb_authority_defect": {"present": true, "evidence": "Material Rust integer premises are asserted without applicable checked Rust 1.82.0 authority."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing in the report evidences inspection beyond the supplied source/request and permitted authority pages."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 quotes the out-of-bounds UB rule and O3 discharges the corresponding in-bounds obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "O2 states that reaching else makes is_empty false and uses A3 to derive n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "A2 establishes len as usize and A5 establishes minimum zero, yielding n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A6 and O2 prove n - 1 is representable and non-overflowing throughout the profile domain."}, + {"id": "L5", "decision": "PASS", "evidence": "O3 derives 0 <= index = n - 1 < n = bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 are connected to a full-scope PROVED verdict and an explicit Required subset-of Covered certificate."}, + {"id": "L7", "decision": "PASS", "evidence": "The report separately says the lifetime comment neither states nor proves the in-bounds caller obligation."}, + {"id": "L8", "decision": "PASS", "evidence": "The adjacent replacement exposes false is_empty, nonzero len, representable subtraction, and index < len for the displayed unsafe call."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A6 inventory all required Rust/std leaves, and the proof treats assignments and inequalities as local source facts and mathematics."}, + {"id": "L10", "decision": "FAIL", "evidence": "A4 quotes only false=>else but claims the converse, execution-of-else=>false; the exact quotation does not supply that consumed proposition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The asserted exact reconciliation inherits A4's unsupported converse branch-selection premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The documentation-only replacement is not used to justify the current implementation verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "The checked A4 excerpt does not establish the direction of if semantics consumed by O2."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied target/request and allowed versioned Rust authorities."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 states out-of-bounds get_unchecked is UB and OBL-1 proves the index in bounds."}, + {"id": "L2", "decision": "PASS", "evidence": "OBL-1 identifies the false else path and contraposes A3 to n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "The proof explicitly takes n: usize, applies A7's unsigned domain, and derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and OBL-1 prove n - 1 stays in range and cannot overflow in any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "OBL-1 substitutes i = n - 1 and derives 0 <= i < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report connects the exhaustive branch proof to A1, reports full-scope PROVED, and states Covered = Required."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately identifies the lifetime-only comment as deficient for omitting the bounds derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The proposed adjacent comment names is_empty and get_unchecked and exposes the complete nonzero/subtraction/bounds chain."}, + {"id": "L9", "decision": "FAIL", "evidence": "The report misclassifies index: usize as a local source/type-signature fact; the supplied source has no such annotation, and len's return type is a consumed std premise."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 quotes and verifies only len's element-count meaning, not its usize return type; A4 also quotes only false=>else while consuming the converse."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed no-silent-premise reconciliation omits authoritative establishment of len's usize return type and inadequately extracts if selection."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement wording follows, rather than supplies, the proof of the current source."}, + "tcb_authority_defect": {"present": true, "evidence": "A consumed standard-library return-type premise is not inventoried and quoted as authority, and AX-IF's excerpt is directionally incomplete."}, + "visible_scope_defect": {"present": false, "evidence": "The report gives no evidence of inspecting prohibited evaluation or sibling material."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A-GET quotes the exact out-of-bounds UB rule and O3 discharges in-bounds for the usize index."}, + {"id": "L2", "decision": "PASS", "evidence": "A-IF supplies both branch directions and O1 contraposes A-EMPTY to obtain nonzero length."}, + {"id": "L3", "decision": "PASS", "evidence": "A-LEN establishes n: usize, A-USIZE supplies nonnegativity, and O2 derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A-SUB/A-OVERFLOW and O2 establish representability and no underflow or overflow in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 explicitly concludes index = n - 1 < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O4 close the unsafe obligation over the full stated domain and the report gives Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the existing comment deficient because a lifetime property does not prove the sole bounds precondition."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names is_empty/get_unchecked and exposes false branch, nonzero len, defined subtraction, and the strict bound."}, + {"id": "L9", "decision": "PASS", "evidence": "A-GET through A-USIZE inventory every required Rust/std premise and separately identify local source facts and mathematical inference."}, + {"id": "L10", "decision": "PASS", "evidence": "Every entry has the matching 1.82.0 narrow URL, exact supporting quotation or displayed signature, verified proposition, consumer, and scope qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "The report explicitly maps all authority entries to O1-O4 and states that no other Rust/std premise or TCB assumption is used."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is a proof-artifact repair and is not used to establish current soundness."}, + "tcb_authority_defect": {"present": false, "evidence": "All material nonlocal premises are supported by matching official Rust 1.82.0 authority; no target TCB assumption is used."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied source/request and permitted official authorities."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET quotes out-of-bounds UB and step 5 treats in-bounds as the exact unsafe-call requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "AX-IF gives both branch directions and steps 1-2 use AX-EMPTY contrapositively to derive L != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN establishes L: usize; AX-USIZE gives minimum zero; step 3 derives 1 <= L."}, + {"id": "L4", "decision": "PASS", "evidence": "Steps 3-4 and AX-SUB/AX-OVERFLOW prove L - 1 is in range and non-underflowing in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Steps 3-4 derive index = L - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "The exhaustive proof discharges AX-GET across the exact scope, reports PROVED, and explicitly certifies Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "DOC-1 separately explains that the lifetime comment mentions neither bounds nor the material derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement identifies get_unchecked's obligation and states false is_empty, nonzero len, representable subtraction, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "AX-IF through AX-GET inventory all required semantic leaves, with source observations and arithmetic identified separately."}, + {"id": "L10", "decision": "PASS", "evidence": "All seven entries have narrow 1.82.0 URLs, exact supporting text/signatures, verified propositions, and full-domain applicability."}, + {"id": "L11", "decision": "PASS", "evidence": "The derivation consumes each AX entry and expressly states there are no added environmental, implementation, or pending TCB premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is offered after a complete proof of the unchanged implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The proof relies only on applicable, proposition-matched Rust 1.82.0 Reference/std authority."}, + "visible_scope_defect": {"present": false, "evidence": "No report statement evidences access beyond the supplied target/request and allowed authorities."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A5 quotes the get_unchecked out-of-bounds UB rule and O2 discharges its in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "A3 supplies true/false branch semantics and O1 contraposes A2 to n != 0 on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A1 establishes n: usize and A4 gives the zero minimum, yielding n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A4 and O1 show n - 1 lies in the usize range and cannot overflow under any profile setting."}, + {"id": "L5", "decision": "PASS", "evidence": "O1 explicitly derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 close the sole unsafe consumer for every requested case and provide Required subset-of Covered with a full-scope PROVED verdict."}, + {"id": "L7", "decision": "PASS", "evidence": "The proof-artifact verdict separately calls the lifetime sentence inadequate for the in-bounds obligation and its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names slice::get_unchecked and states false emptiness, nonzero length, no overflow, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A5 cover every required Rust/std leaf, while the remaining source observations and logic/arithmetic are explicitly separated."}, + {"id": "L10", "decision": "PASS", "evidence": "Each consumed authority has a narrow 1.82.0 URL, exact quotation/signature, verified proposition, and target/profile qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "The O1-O3 mapping consumes every inventoried entry and disclaims all extra TCB, dependency, tool, and platform assumptions."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The comment repair is not used to prove or narrow the current implementation's obligations."}, + "tcb_authority_defect": {"present": false, "evidence": "All materially used Rust propositions are supported by applicable official 1.82.0 authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report only reviews the supplied artifact and allowed authoritative pages."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states out-of-bounds is UB, and step 5 discharges the in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "Steps 1-2 place execution in the false else arm and contrapose AX-EMPTY to n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize, AX-USIZE supplies nonnegativity, and step 3 derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "Step 4 and AX-SUB/AX-OVERFLOW show n - 1 is representable under every overflow-check setting."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 4 explicitly derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report closes both obligations and the empty path over the full domain, with PROVED and Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime-only comment deficient for omitting both the exact bound and its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names get_unchecked and exposes the false-branch, positive-length, no-underflow, strict-bound chain."}, + {"id": "L9", "decision": "PASS", "evidence": "AX-EMPTY through AX-GET inventory all material Rust leaves and distinguish local source facts from arithmetic and contraposition."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF quotes false=>else but uses it for else-reached=>false and true-path exclusion; the quotation does not supply those converse/exclusivity facts."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed complete reconciliation depends on branch-selection authority not established by the quoted AX-IF text."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement is a requested documentation repair, not evidence for current soundness."}, + "tcb_authority_defect": {"present": true, "evidence": "The AX-IF evidence is directionally insufficient for the proposition the proof consumes."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of access outside the supplied source/request and permitted Rust authorities."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A4 states that out-of-bounds get_unchecked is UB and O2 treats in-bounds as its exact requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "O2 places the call on false is_empty and contraposes A1 to n != 0."}, + {"id": "L3", "decision": "FAIL", "evidence": "A2 verifies only element-count meaning; the report never establishes len's usize type or the unsigned/nonnegative usize domain."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representable subtraction and profile independence without checking built-in minus or integer-overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 uses index = n - 1 and ordinary predecessor arithmetic to derive 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The full-scope PROVED closure relies on unverified type, unsigned-domain, subtraction, and overflow premises."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime comment deficient because it omits get_unchecked's bounds obligation and derivation."}, + {"id": "L8", "decision": "FAIL", "evidence": "The replacement states the desired chain but refers to no checked authority for its material usize and subtraction/overflow steps."}, + {"id": "L9", "decision": "FAIL", "evidence": "The supposedly complete inventory omits len's usize return type, usize's value domain, built-in subtraction, and overflow/profile behavior."}, + {"id": "L10", "decision": "FAIL", "evidence": "There are no matching checked entries or quotations for the omitted integer premises, and A3 does not quote the full branch-selection rule it claims."}, + {"id": "L11", "decision": "FAIL", "evidence": "The report claims no overflow, width, or other Rust fact is silently consumed while its derivation depends on exactly those omitted premises."} + ], + "hard_errors": [ + {"id": "G11", "evidence": "The PROVED conclusion necessarily relies on unchecked Rust type/domain, subtraction, and overflow propositions."}, + {"id": "LH4", "evidence": "It affirmatively calls the authority list complete while silently consuming the omitted integer premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is not used to certify or narrow the present implementation obligation."}, + "tcb_authority_defect": {"present": true, "evidence": "Several material Rust/std premises have no checked version-matched authority entry."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied target/request and permitted authority set."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A7 states out-of-bounds get_unchecked is UB, and step 4 discharges its in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "Steps 1-2 identify false is_empty on else and contrapose A1 to L != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "A3 gives L: usize, A4 gives the unsigned domain, and step 2 derives L >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and step 3 prove L - 1 remains representable and does not overflow in any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 substitutes index = L - 1 and concludes 0 <= index < L."}, + {"id": "L6", "decision": "PASS", "evidence": "The exhaustive branch proof closes A7 for the entire exact domain, reports PROVED, and states Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately says the lifetime comment does not establish the bounds obligation and requires reconstruction."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names is_empty and get_unchecked and supplies nonzero length, non-underflow, and the strict bound."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A7 inventory all required Rust/std premises and map them to steps, leaving only source and mathematical facts outside."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 quotes only false=>else but claims else-execution=>false; the exact quotation does not supply the consumed converse."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact A1-A7 reconciliation inherits A2's inadequately supported branch proposition."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The requested replacement comment follows an independent proof of the current implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "The quoted A2 text is insufficient for the branch direction used in the proof."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "L8 does not say whether an adjacent replacement must contain an inline URL or axiom label. I treated explicit method/contract references to already checked entries as unambiguous, but not references to material arithmetic premises for which the report supplied no checked entry.", + "L10 asks for exact prose although return types are ordinarily supplied by displayed signatures. I accepted an expressly inspected/displayed versioned signature, but not an unquoted or misclassified type fact.", + "For if semantics, an excerpt stating only false=>else does not logically establish else-reached=>false. I scored that as an L10/L11 authority-extraction defect where the omitted true-arm exclusion was not quoted, but did not infer the exact LH4 hard-error trigger merely from an incomplete excerpt." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/attestation.json new file mode 100644 index 0000000000..96b646cdd2 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_p_s1", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "P-s1", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T00:34:32.224692Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/raw-output-manifest.json new file mode 100644 index 0000000000..bbcb600afb --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 43317, + "path": "score.json", + "sha256": "98b837424d1eacde07a4d82a2c92a9697f680780bfe06056ae5015a4a067c764", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/raw-output/score.json new file mode 100644 index 0000000000..f1e0e9e393 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s1/1/raw-output/score.json @@ -0,0 +1,383 @@ +{ + "schema_version": 1, + "mode": "P", + "scorer_id": "s1", + "reports": [ + { + "label": "G", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"G lines 19–23 state the exact Scarlet predicate, including V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"G lines 28–32 state the exact Indigo predicate, including V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"G line 34 substitutes (1.84.0,X,true,false) and proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"G line 34 substitutes (1.84.0,X,true,true) and proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"G line 10 calls exact-promise identity UNPROVED and line 60 keeps the union only as an audit envelope."}, + {"id":"P6","decision":"PASS","evidence":"G lines 36–42 define D_S over all seven coordinates, all profiles, both d states, and all Option inputs."}, + {"id":"P7","decision":"PASS","evidence":"G lines 36–42 define D_I over the same complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"G line 58 separately maps every Scarlet disjunct into U and preserves remaining dimensions."}, + {"id":"P9","decision":"PASS","evidence":"G line 58 separately maps every Indigo disjunct into U and preserves remaining dimensions."}, + {"id":"P10","decision":"PASS","evidence":"G line 80 proves f=true,t=W falsifies every Scarlet turbo disjunct for arbitrary remaining coordinates."}, + {"id":"P11","decision":"PASS","evidence":"G line 80 proves the same universal wasm exclusion for Indigo."}, + {"id":"P12","decision":"PASS","evidence":"G lines 64, 68, 75, and 80 combine exact TCB mapping, all/cfg semantics, and compile_error! for the full R_W fiber."}, + {"id":"P13","decision":"PASS","evidence":"G lines 66 and 82 apply each exact-version unwrap_or contract to None and Some(x) on C_N."}, + {"id":"P14","decision":"PASS","evidence":"G lines 66 and 84 trace r into the syntactically constructed Some(r), excluding a None receiver."}, + {"id":"P15","decision":"PASS","evidence":"G line 84 composes unwrap_or, Some(r), and unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"G lines 54–55 define Required=D_A while retaining v,t,f,h,p,d,input."}, + {"id":"P17","decision":"PASS","evidence":"G lines 75–77 and 93 define Covered_sound from full seven-coordinate C_N/C_T predicates."}, + {"id":"P18","decision":"PASS","evidence":"G lines 82–84 prove both covered source branches; lines 90–95 admit exactly their full-case union."}, + {"id":"P19","decision":"PASS","evidence":"G lines 97–101 carry every Required coordinate through the !f/f split and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"G lines 7 and 97–104 state TCB-relative whole-domain soundness and supply its closure certificate."}, + {"id":"P21","decision":"PASS","evidence":"G lines 75–77 and 94 define Covered_behavior with all seven coordinates retained."}, + {"id":"P22","decision":"PASS","evidence":"G lines 82–84 prove Q on both branches admitted by Covered_behavior."}, + {"id":"P23","decision":"PASS","evidence":"G lines 97–102 prove Required subset Covered_behavior without projecting any coordinate."}, + {"id":"P24","decision":"PASS","evidence":"G lines 8 and 97–104 state the qualified whole-domain postcondition and its certificate."}, + {"id":"P25","decision":"PASS","evidence":"G line 68 limits BUILD-MAP-POLICY to the exact releases, mappings, profiles, and reachability/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"G lines 7–9 explicitly qualify all three mapping-dependent conclusions; line 68 labels the premise accepted trust, not Rust semantics."}, + {"id":"P27","decision":"PASS","evidence":"G lines 64–66 quote and link per-release cfg, compile_error!, unwrap_or, and unwrap_unchecked authority."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"G neither proposes nor certifies any unimplemented design."}, + "tcb_authority_defect": {"present":false,"evidence":"G gives exact TCB scope/qualification and version-matched quoted Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"G evidences review only of the supplied source snapshot and permitted authorities."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"I lines 40–44 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"I lines 45–49 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"I lines 51–53 prove (1.84.0,X,true,false) is Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"I lines 53–55 prove (1.84.0,X,true,true) is Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"I lines 17 and 21–22 leave exact-promise identity UNPROVED and separate it from Required."}, + {"id":"P6","decision":"PASS","evidence":"I lines 57–63 define D_S over the full tuple, every profile, both debug states, and every valid input."}, + {"id":"P7","decision":"PASS","evidence":"I lines 57–64 define D_I over that same full product."}, + {"id":"P8","decision":"PASS","evidence":"I lines 67–70 separately prove D_S subset Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"I lines 67–70 separately prove D_I subset Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"I lines 103–105 universally substitute f=true,t=W into Scarlet and exclude it."}, + {"id":"P11","decision":"PASS","evidence":"I lines 103–105 give the same universal substitution for Indigo."}, + {"id":"P12","decision":"PASS","evidence":"I lines 76–101 quote the exact cfg/all/macro rules and lines 91–107 apply the accepted mapping over h,p,d,i."}, + {"id":"P13","decision":"PASS","evidence":"I lines 111–126 apply exact-version unwrap_or prose to every input on the non-turbo branch."}, + {"id":"P14","decision":"PASS","evidence":"I lines 111–127 connect the local Some(y) receiver to the unchecked call's None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"I line 128 composes y from unwrap_or with unwrap_unchecked's contained-value result."}, + {"id":"P16","decision":"PASS","evidence":"I lines 57–65 define Required with v,t,f,h,p,d,i retained."}, + {"id":"P17","decision":"PASS","evidence":"I lines 137–145 define Base and Covered_sound with every case coordinate."}, + {"id":"P18","decision":"PASS","evidence":"I lines 124–133 prove the unsafe obligation on every branch in the stated coverage region."}, + {"id":"P19","decision":"PASS","evidence":"I lines 147–157 carry Base coordinates and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"I lines 15 and 155–161 give the TCB-qualified PROVED soundness conclusion and closure."}, + {"id":"P21","decision":"PASS","evidence":"I lines 137–145 define Covered_post using full Base(c)."}, + {"id":"P22","decision":"PASS","evidence":"I lines 126–128 provide complete Q derivations for both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"I lines 147–158 separately prove Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"I lines 16 and 155–161 state the postcondition PROVED under the same TCB qualification and certificate."}, + {"id":"P25","decision":"PASS","evidence":"I lines 165–171 identify the exact TCB entry, mappings, releases, and only permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"I lines 15–16 make the shared TCB qualification explicit, and lines 165–170 distinguish trust from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"I lines 76–89 and 111–120 provide quotations and exact-version URLs for every used Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"I contains no unimplemented proposal used as current evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"I precisely scopes and qualifies the TCB and supplies complete exact-version Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"I shows no inspection of prohibited evaluation or sibling material."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"A lines 40–44 reproduce the exact Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"A lines 45–49 reproduce the exact Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"A lines 58–60 establish the stated Scarlet-only witness in both predicates."}, + {"id":"P4","decision":"PASS","evidence":"A lines 60–63 establish the stated Indigo-only witness in both predicates."}, + {"id":"P5","decision":"PASS","evidence":"A lines 17 and 21–22 call policy identity UNPROVED and deny that Required resolves it."}, + {"id":"P6","decision":"PASS","evidence":"A lines 34–55 define D_S across all seven requested coordinates."}, + {"id":"P7","decision":"PASS","evidence":"A lines 34–55 define D_I across all seven requested coordinates."}, + {"id":"P8","decision":"PASS","evidence":"A lines 80–83 separately prove D_S subset Required with unchanged p,d,o."}, + {"id":"P9","decision":"PASS","evidence":"A lines 80–83 separately prove D_I subset Required with unchanged p,d,o."}, + {"id":"P10","decision":"PASS","evidence":"A lines 76–80 derive the union and expressly show Scarlet has no f,t=W case."}, + {"id":"P11","decision":"PASS","evidence":"A lines 76–80 likewise show Indigo has no f,t=W case."}, + {"id":"P12","decision":"PASS","evidence":"A lines 87–104, 119–126, and 158–164 supply exact mapping, all/cfg/macro authority, and universal rejection."}, + {"id":"P13","decision":"PASS","evidence":"A lines 106–117 and 148–150 prove the non-turbo result for every Option input."}, + {"id":"P14","decision":"PASS","evidence":"A lines 110–116 and 151–156 prove the unchecked receiver is the locally constructed Some(r)."}, + {"id":"P15","decision":"PASS","evidence":"A lines 151–157 compose both Option contracts to prove the turbo result."}, + {"id":"P16","decision":"PASS","evidence":"A lines 68–74 define Required over v,t,f,h,p,d,o."}, + {"id":"P17","decision":"PASS","evidence":"A lines 138–145 define full K(c) and Covered_sound without projection."}, + {"id":"P18","decision":"PASS","evidence":"A lines 148–157 prove every case admitted by Covered_sound on its selected branch."}, + {"id":"P19","decision":"PASS","evidence":"A lines 166–170 prove U implies the covered source region and Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"A lines 14, 19–22, and 168–172 give a TCB-qualified whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"A lines 138–145 define Covered_behavior over the full K tuple."}, + {"id":"P22","decision":"PASS","evidence":"A lines 148–157 prove Q for both branches included in Covered_behavior."}, + {"id":"P23","decision":"PASS","evidence":"A lines 166–172 separately prove Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"A lines 15, 19–22, and 168–172 give the qualified whole-domain behavioral conclusion."}, + {"id":"P25","decision":"PASS","evidence":"A lines 119–127 identify BUILD-MAP-POLICY via its alias and keep its exact identity, region, mappings, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"A lines 14–16 and 19–21 conspicuously qualify every mapping-dependent conclusion; lines 119–126 distinguish the TCB from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"A lines 87–117 pair every material cfg, compile_error!, and Option premise with quotations and exact-version URLs."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"A proposes only a comment improvement and does not use it to certify current code."}, + "tcb_authority_defect": {"present":false,"evidence":"A's TCB-BUILD-MAP alias is expressly identified as exact BUILD-MAP-POLICY and is correctly scoped and qualified."}, + "visible_scope_defect": {"present":false,"evidence":"A evidences no access beyond supplied source-review material and allowed authorities."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"J lines 28–34 state Scarlet exactly with the outer V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"J lines 36–42 state Indigo exactly with the outer V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"J lines 44–46 substitute and prove the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"J lines 46–50 substitute and prove the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"J lines 19 and 73–77 leave exact-promise identity UNPROVED and distinguish the audit union."}, + {"id":"P6","decision":"PASS","evidence":"J lines 54–68 define Base and D_S over all seven full-case coordinates."}, + {"id":"P7","decision":"PASS","evidence":"J lines 54–68 define Base and D_I over all seven full-case coordinates."}, + {"id":"P8","decision":"PASS","evidence":"J lines 69–75 separately prove D_S subset Required by disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"J lines 69–75 separately prove D_I subset Required by disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"J lines 90–93 universally falsify every Scarlet disjunct at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"J lines 90–93 universally falsify every Indigo disjunct at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"J lines 85–100 combine per-version all/cfg/macro authority with exact TCB mapping across the rejected fiber."}, + {"id":"P13","decision":"PASS","evidence":"J lines 84 and 106–112 apply unwrap_or to both exhaustive inputs on every non-turbo case."}, + {"id":"P14","decision":"PASS","evidence":"J lines 84 and 114–119 show the exact unchecked receiver is Some(value), never None."}, + {"id":"P15","decision":"PASS","evidence":"J lines 114–122 compose both Option operations and prove the turbo result for all inputs."}, + {"id":"P16","decision":"PASS","evidence":"J lines 60–70 define Required through full Base(c), retaining all coordinates."}, + {"id":"P17","decision":"PASS","evidence":"J lines 135–140 define Covered_sound using full Base(c)."}, + {"id":"P18","decision":"PASS","evidence":"J lines 106–122 prove each branch admitted by Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"J lines 143–148 prove Required subset Covered_sound while carrying Base(c)."}, + {"id":"P20","decision":"PASS","evidence":"J lines 16 and 143–149 give TCB-relative soundness and its full-case certificate."}, + {"id":"P21","decision":"PASS","evidence":"J lines 135–140 define Covered_post with every Base coordinate."}, + {"id":"P22","decision":"PASS","evidence":"J lines 106–122 establish g(i) on every branch included in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"J lines 143–149 independently prove Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"J lines 17 and 143–149 state the postcondition PROVED with the same TCB qualification and closure."}, + {"id":"P25","decision":"PASS","evidence":"J lines 155–160 restrict BUILD-MAP-POLICY to exact releases, manifest/source, mappings, and permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"J lines 16–18 explicitly qualify all dependent verdicts; lines 155–161 separate trusted mapping from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"J lines 81–86 quote and link all material Option, cfg/all/not, and compile_error! rules for each exact release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"J does not use any unimplemented design as current evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"J has complete exact TCB accounting, conspicuous qualification, and exact-version Rust quotations."}, + "visible_scope_defect": {"present":false,"evidence":"J establishes no material departure from supplied source-review scope."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"H lines 49–59 give the exact Scarlet predicate within full Base(c)."}, + {"id":"P2","decision":"PASS","evidence":"H lines 61–71 give the exact Indigo predicate within full Base(c)."}, + {"id":"P3","decision":"PASS","evidence":"H lines 73–76 prove the full Scarlet-only witness by substitution."}, + {"id":"P4","decision":"PASS","evidence":"H lines 76–79 prove the full Indigo-only witness by substitution."}, + {"id":"P5","decision":"PASS","evidence":"H lines 20–23 and 89–91 leave project-promise identity UNPROVED and label A only an audit domain."}, + {"id":"P6","decision":"PASS","evidence":"H lines 42–59 define DS through Base(c), which retains all seven coordinates and full fibers."}, + {"id":"P7","decision":"PASS","evidence":"H lines 42–71 define DI through the same complete Base(c)."}, + {"id":"P8","decision":"PASS","evidence":"H lines 81–89 separately prove DS subset A by the left union disjunct."}, + {"id":"P9","decision":"PASS","evidence":"H lines 81–89 separately prove DI subset A by the right union disjunct."}, + {"id":"P10","decision":"PASS","evidence":"H lines 95–97 universally exclude f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"H lines 95–97 universally exclude f=true,t=W from Indigo."}, + {"id":"P12","decision":"FAIL","evidence":"H lines 99–112 assert cfg(all(...)) rejection, but quote only cfg-attribute and compile_error! text; no exact-version authority supplies the material all predicate rule."}, + {"id":"P13","decision":"PASS","evidence":"H lines 124–143 cite each exact unwrap_or contract and prove both non-turbo input cases."}, + {"id":"P14","decision":"PASS","evidence":"H lines 124–149 cite the None prohibition and trace the receiver to constructed Some(x)."}, + {"id":"P15","decision":"PASS","evidence":"H lines 144–149 compose unwrap_or with unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"H lines 42–46 and 81–85 define Required=A over all seven coordinates."}, + {"id":"P17","decision":"PASS","evidence":"H lines 158–163 define Executable and Covered_sound through full Base(c)."}, + {"id":"P18","decision":"FAIL","evidence":"H's non-turbo coverage proof at lines 139–143 relies on not(feature=\"turbo\") selection, but no version-matched not semantics is cited or quoted."}, + {"id":"P19","decision":"FAIL","evidence":"H lines 168–174 claim closure, but Covered_sound applicability is incomplete because the non-turbo cfg-not selection premise is unchecked."}, + {"id":"P20","decision":"FAIL","evidence":"H lines 11–14 claim whole-domain soundness, but its required P19 certificate rests on the incomplete Covered_sound derivation."}, + {"id":"P21","decision":"PASS","evidence":"H lines 158–165 define Covered_post through full Base(c), retaining v,t,f,h,p,d,i."}, + {"id":"P22","decision":"FAIL","evidence":"H lines 139–149 prove local results, but Covered_post applicability for f=false still relies on uncited exact-version not semantics."}, + {"id":"P23","decision":"FAIL","evidence":"H lines 168–175 claim behavioral closure from a Covered_post derivation whose non-turbo source-selection premise is unchecked."}, + {"id":"P24","decision":"FAIL","evidence":"H lines 15–16 state behavior PROVED without importing the TCB qualification and the P23 closure certificate is incomplete."}, + {"id":"P25","decision":"PASS","evidence":"H lines 180–185 accurately limit BUILD-MAP-POLICY to exact releases, supplied inputs, mappings, and allowed reachability/rejection consumers."}, + {"id":"P26","decision":"FAIL","evidence":"H's behavior verdict at lines 15–16 says only 'on that same domain'; unlike soundness and rejection, it does not conspicuously carry the BUILD-MAP-POLICY qualification."}, + {"id":"P27","decision":"FAIL","evidence":"H's authority inventory omits exact-version quotations/URLs for the all and not semantics materially used at lines 102 and 139."} + ], + "hard_errors": [ + {"id":"G11","evidence":"H's positive rejection and coverage claims necessarily rely on unchecked all/not Rust semantics absent from its exact-version authority inventory."} + ], + "proposal_laundering": {"present":false,"evidence":"H proposes only a comment rewrite and does not use it to certify the current implementation."}, + "tcb_authority_defect": {"present":true,"evidence":"H omits material all/not Rust authority and fails to carry the accepted-TCB qualification into its behavioral conclusion."}, + "visible_scope_defect": {"present":false,"evidence":"H evidences no prohibited oracle, sibling, condition-map, prior-score, or evaluator access."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"C lines 23–25 state Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"C lines 27–29 state Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"C line 37 proves the stated configuration is Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"C line 38 proves the stated configuration is Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"C lines 11–13 and 115 leave exact-promise identity UNPROVED/unresolved and distinguish R."}, + {"id":"P6","decision":"PASS","evidence":"C lines 17–33 define K and D_S with every full-case coordinate and fiber."}, + {"id":"P7","decision":"PASS","evidence":"C lines 17–33 define K and D_I with every full-case coordinate and fiber."}, + {"id":"P8","decision":"PASS","evidence":"C lines 42–46 separately prove D_S subset R by its left disjunct."}, + {"id":"P9","decision":"PASS","evidence":"C lines 42–46 separately prove D_I subset R by its right disjunct."}, + {"id":"P10","decision":"PASS","evidence":"C line 66 substitutes f=true,t=W and universally excludes Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"C line 66 performs the same universal Indigo exclusion."}, + {"id":"P12","decision":"PASS","evidence":"C lines 50–66 combine exact-version all/cfg/macro text and exact TCB mapping over the whole wasm fiber."}, + {"id":"P13","decision":"PASS","evidence":"C lines 54 and 74–76 prove the non-turbo postcondition for every input."}, + {"id":"P14","decision":"PASS","evidence":"C lines 54 and 77 prove the unchecked receiver is the locally constructed Some(value)."}, + {"id":"P15","decision":"PASS","evidence":"C lines 77–78 compose both Option results into spec(i)."}, + {"id":"P16","decision":"PASS","evidence":"C lines 17–21 and 42–44 define Required=R over the complete c tuple."}, + {"id":"P17","decision":"PASS","evidence":"C lines 93–101 define Covered_sound via c in K, preserving all seven axes."}, + {"id":"P18","decision":"PASS","evidence":"C lines 58–64 and 74–78 give complete branch-selection and unsafe proofs for every covered case."}, + {"id":"P19","decision":"PASS","evidence":"C lines 101–105 carry each Required case into the applicable covered branch and state the containment."}, + {"id":"P20","decision":"PASS","evidence":"C lines 9, 13, and 103–107 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"C lines 97–101 define Covered_post through full K membership."}, + {"id":"P22","decision":"PASS","evidence":"C lines 76–78 prove spec(i) on both branches in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"C lines 103–105 prove Required subset Covered_post as part of the exact intersection closure."}, + {"id":"P24","decision":"PASS","evidence":"C lines 10, 13, and 103–107 state qualified behavior PROVED with its closure."}, + {"id":"P25","decision":"PASS","evidence":"C lines 58 and 109–113 keep BUILD-MAP-POLICY at its exact mapping, profile region, and permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"C lines 9–13 conspicuously qualify both conclusions, while lines 109–113 distinguish TCB from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"C lines 48–54 provide exact-version quotations and URLs for every material Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"C's suggested comment is not used as evidence for the current artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"C supplies exact TCB accounting and complete, version-matched authority closure."}, + "visible_scope_defect": {"present":false,"evidence":"C's naming of the supplied skill package is expressly in scope; no prohibited material is evidenced."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"D lines 33–39 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"D lines 41–49 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"D lines 51–53 state the valid Scarlet-only witness after giving exact formulas."}, + {"id":"P4","decision":"PASS","evidence":"D lines 51–53 state the valid Indigo-only witness after giving exact formulas."}, + {"id":"P5","decision":"PASS","evidence":"D lines 22–24 and 70–71 say the audit union does not identify the crate promise."}, + {"id":"P6","decision":"PASS","evidence":"D lines 28–30 and 55–60 define D_S across v,t,f,h,p,d,i."}, + {"id":"P7","decision":"PASS","evidence":"D lines 28–30 and 55–60 define D_I across v,t,f,h,p,d,i."}, + {"id":"P8","decision":"PASS","evidence":"D lines 62–70 separately prove D_S subset Required by left disjunction."}, + {"id":"P9","decision":"PASS","evidence":"D lines 62–70 separately prove D_I subset Required by right disjunction."}, + {"id":"P10","decision":"PASS","evidence":"D lines 95–101 universally exclude f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"D lines 95–101 universally exclude f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"D lines 86–101 and 165–181 combine exact mapping with quoted option-predicate, all, cfg, and macro rules over all build axes."}, + {"id":"P13","decision":"PASS","evidence":"D lines 128–129 and 154–158 prove unwrap_or's result for both non-turbo inputs."}, + {"id":"P14","decision":"PASS","evidence":"D lines 130 and 159–164 prove the exact unchecked receiver is Some(x), not None."}, + {"id":"P15","decision":"PASS","evidence":"D lines 130–131 and 159–164 compose unwrap_or with the contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"D lines 55–65 define Required through complete D_S/D_I full-case predicates."}, + {"id":"P17","decision":"PASS","evidence":"D lines 75–84 define Covered_SND via B(c), retaining every coordinate."}, + {"id":"P18","decision":"PASS","evidence":"D lines 86–94 and 128–131 establish applicable soundness on both branches admitted by Covered_SND."}, + {"id":"P19","decision":"PASS","evidence":"D lines 103–115 prove Required subset Covered_SND while carrying h,p,d,i parametrically."}, + {"id":"P20","decision":"PASS","evidence":"D lines 17–20 and 103–111 give TCB-qualified whole-domain soundness and closure."}, + {"id":"P21","decision":"PASS","evidence":"D lines 75–84 define Covered_POST via full B(c)."}, + {"id":"P22","decision":"PASS","evidence":"D lines 129–131 give complete Q proofs for both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"D lines 103–115 independently prove Required subset Covered_POST."}, + {"id":"P24","decision":"PASS","evidence":"D lines 19–20 and 103–111 state POST PROVED under the same TCB and its closure."}, + {"id":"P25","decision":"PASS","evidence":"D lines 183–189 state the exact Cargo/releases, mappings, profiles, consumers, exclusions, and triggers."}, + {"id":"P26","decision":"PASS","evidence":"D lines 17–20 share an explicit TCB qualification, and lines 183–189 label it out-of-band rather than Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"D lines 150–181 quote and link every material Option, cfg/all/not, and compile_error! premise per release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"D does not use its proposed comment replacement to certify an unimplemented artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"D has exact TCB scope, conspicuous qualification, and complete exact-version Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"D evidences no source-scope departure or prohibited evaluator access."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"B lines 23–28 state Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"B lines 29–34 state Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"B line 40 substitutes and proves the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"B line 40 substitutes and proves the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"B lines 12 and 53 distinguish unresolved crate-level Required from theorem-only Required_A."}, + {"id":"P6","decision":"PASS","evidence":"B lines 16–18 and 36–38 define S(c) across the complete full-case product."}, + {"id":"P7","decision":"PASS","evidence":"B lines 16–18 and 36–38 define I(c) across the complete full-case product."}, + {"id":"P8","decision":"PASS","evidence":"B lines 42–51 separately prove S subset A with every p,d,i unchanged."}, + {"id":"P9","decision":"PASS","evidence":"B lines 42–51 separately prove I subset A with every p,d,i unchanged."}, + {"id":"P10","decision":"PASS","evidence":"B lines 45–51 and 69–70 establish Scarlet's universal turbo/W exclusion."}, + {"id":"P11","decision":"PASS","evidence":"B lines 45–51 and 69–70 establish Indigo's universal turbo/W exclusion."}, + {"id":"P12","decision":"PASS","evidence":"B lines 57–70 quote and apply exact mapping, all/cfg, and compile_error! rules across all required axes."}, + {"id":"P13","decision":"PASS","evidence":"B lines 61 and 72–75 prove unwrap_or's exact non-turbo result for all inputs."}, + {"id":"P14","decision":"PASS","evidence":"B lines 61 and 75 show the unsafe receiver is constructed as Some(x), never None."}, + {"id":"P15","decision":"PASS","evidence":"B line 75 composes the first result with unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"B lines 16–18, 42, and 53 define Required_A over the complete case tuple."}, + {"id":"P17","decision":"PASS","evidence":"B lines 87–99 define Covered_sound through full A(c) and the complete selected execution."}, + {"id":"P18","decision":"PASS","evidence":"B lines 67 and 74–75 prove every selected branch admitted by Covered_sound UB-free."}, + {"id":"P19","decision":"PASS","evidence":"B lines 101–102 give the exhaustive full-case split and prove Required_A subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"B lines 9 and 101–102 state TCB-qualified whole-domain soundness with exact closure."}, + {"id":"P21","decision":"PASS","evidence":"B lines 87–99 define Covered_post through A(c), retaining all dimensions and input."}, + {"id":"P22","decision":"PASS","evidence":"B lines 74–75 prove q(i) on both branches admitted by Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"B lines 101–102 prove Required_A subset Covered_post and exact aggregate closure."}, + {"id":"P24","decision":"PASS","evidence":"B lines 10 and 101–102 give the TCB-qualified whole-domain postcondition conclusion."}, + {"id":"P25","decision":"PASS","evidence":"B line 63 records the exact releases, supplied inputs, mappings, all profiles, and permitted selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"B lines 9–11 use an explicit shared qualification; line 63 distinguishes BUILD-MAP-POLICY from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"B lines 57–61 quote and link every material cfg/all/not, compile_error!, and Option proposition per exact release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"B's comment suggestion is not used to narrow or certify current obligations."}, + "tcb_authority_defect": {"present":false,"evidence":"B accurately scopes and qualifies BUILD-MAP-POLICY and supplies complete exact-version authority."}, + "visible_scope_defect": {"present":false,"evidence":"B establishes no review of prohibited evaluation materials."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"F line 37 states the exact Scarlet predicate with V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"F line 41 states the exact Indigo predicate with V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"F lines 45–47 substitute and prove the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"F lines 48–50 substitute and prove the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"F lines 25–27 and 65–66 leave exact-promise identity UNPROVED and distinguish R."}, + {"id":"P6","decision":"PASS","evidence":"F lines 31–33 and 52–56 define D_S over all seven coordinates and complete fibers."}, + {"id":"P7","decision":"PASS","evidence":"F lines 31–33 and 52–56 define D_I over all seven coordinates and complete fibers."}, + {"id":"P8","decision":"PASS","evidence":"F lines 58–64 separately prove D_S subset R as a full-case containment."}, + {"id":"P9","decision":"PASS","evidence":"F lines 58–64 separately prove D_I subset R as a full-case containment."}, + {"id":"P10","decision":"PASS","evidence":"F lines 115–117 universally falsify Scarlet at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"F lines 115–117 universally falsify Indigo at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"F lines 83–95 and 119–125 provide exact all/cfg/macro authority, TCB mapping, and full-fiber rejection."}, + {"id":"P13","decision":"PASS","evidence":"F lines 70–80 and 138–143 prove the non-turbo result for every valid input and exact release."}, + {"id":"P14","decision":"PASS","evidence":"F lines 70–80 and 145–150 connect Some(x) at the exact unsafe receiver to the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"F lines 145–152 compose unwrap_or and unwrap_unchecked to establish Q."}, + {"id":"P16","decision":"PASS","evidence":"F lines 10–12 and 52–60 define Required=R over v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"F lines 164–176 define Covered_sound=R and explicitly retain every dimension through universal branch lemmas."}, + {"id":"P18","decision":"PASS","evidence":"F lines 109–113 and 138–152 prove each branch in Covered_sound has a complete soundness derivation."}, + {"id":"P19","decision":"PASS","evidence":"F lines 171–180 exhaust f and prove Required=Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"F lines 22 and 178–184 give the BUILD-MAP-POLICY-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"F lines 164–176 define Covered_post=R while explicitly retaining v,t,f,h,p,d,i."}, + {"id":"P22","decision":"PASS","evidence":"F lines 138–152 prove Q completely on both branches admitted by Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"F lines 171–183 separately prove Required=Covered_post and its containment."}, + {"id":"P24","decision":"PASS","evidence":"F lines 23 and 180–184 give the qualified whole-domain behavioral conclusion and closure."}, + {"id":"P25","decision":"PASS","evidence":"F lines 97–105 keep BUILD-MAP-POLICY to exact bundled releases, mappings, supplied artifact, profiles, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"F lines 22–24 conspicuously qualify all verdicts, and lines 97–104 distinguish accepted mapping from Rust semantics."}, + {"id":"P27","decision":"PASS","evidence":"F lines 70–95 pair all used Option, cfg/all/not, and compile_error! propositions with exact-version URLs and quotations."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"F uses no unimplemented design as proof of current soundness or behavior."}, + "tcb_authority_defect": {"present":false,"evidence":"F provides exact TCB scope and conspicuous qualification plus complete versioned Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"F evidences no review outside supplied source scope and permitted authority pages."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"E lines 26–33 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"E lines 35–42 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"E lines 44–48 state a valid Scarlet-only witness, (1.84.0,A,true,true)."}, + {"id":"P4","decision":"PASS","evidence":"E lines 44–48 state a valid Indigo-only witness, (1.84.0,X,true,true)."}, + {"id":"P5","decision":"PASS","evidence":"E lines 12 and 17–19 leave exact-promise identity UNPROVED and deny renaming the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"E lines 53–59 define D_S over all profiles, both debug states, and every Option input."}, + {"id":"P7","decision":"PASS","evidence":"E lines 53–60 define D_I over the same complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"E lines 66–80 separately prove D_S is contained in the transparent full-case superset Required."}, + {"id":"P9","decision":"PASS","evidence":"E lines 66–80 separately prove D_I is contained in Required."}, + {"id":"P10","decision":"PASS","evidence":"E line 82 universally falsifies Scarlet at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"E line 82 universally falsifies Indigo at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"E lines 82–88 and 95–107 apply exact all/cfg/macro authority and BUILD-MAP-POLICY across the complete wasm fiber."}, + {"id":"P13","decision":"PASS","evidence":"E lines 108–116 and 125–129 prove the non-turbo postcondition for every input and exact release."}, + {"id":"P14","decision":"PASS","evidence":"E lines 108–116 and 131–137 prove the unsafe receiver is immediately constructed as Some(y), not None."}, + {"id":"P15","decision":"PASS","evidence":"E lines 131–139 compose unwrap_or and unwrap_unchecked to prove the turbo result."}, + {"id":"P16","decision":"PASS","evidence":"E lines 66–72 define Required over the full F(c) tuple with no projected dimension."}, + {"id":"P17","decision":"PASS","evidence":"E lines 148–154 define Covered_sound from full L0/L1 case predicates."}, + {"id":"P18","decision":"PASS","evidence":"E lines 125–139 prove soundness on every case in L0 or L1."}, + {"id":"P19","decision":"PASS","evidence":"E lines 157–162 exhaust f and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"E lines 13, 17–18, and 157–164 give the BUILD-MAP-POLICY-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"E lines 148–155 define Covered_behavior from full L0/L1 predicates, retaining every case coordinate."}, + {"id":"P22","decision":"PASS","evidence":"E lines 125–139 prove the exact documented result on both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"E lines 157–164 separately prove Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"E lines 14, 17–18, and 157–164 give the qualified whole-domain behavioral conclusion and closure."}, + {"id":"P25","decision":"PASS","evidence":"E lines 168–173 limit BUILD-MAP-POLICY to exact releases, mappings, supplied artifact, and selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"E lines 13–18 conspicuously qualify all dependent conclusions, and lines 168–173 distinguish the TCB from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"E lines 90–116 pair each material cfg/all/not, compile_error!, and Option premise with exact-version quotations and URLs."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"E's suggested comment is not used as evidence for the current artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"E gives exact TCB accounting, explicit qualification, and complete version-matched Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"E establishes no material departure from the supplied review scope."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "H: the rubric does not explicitly state how far an unchecked cfg-combinator authority premise cascades beyond P12/P27. I scored P18–P24 downstream failures where complete applicability and listed dependencies require that source-selection premise.", + "H: 'on that same domain' could import only the preceding domain or also its TCB qualification. I scored P26 FAIL because the behavioral verdict does not conspicuously say it shares the BUILD-MAP-POLICY qualification." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/attestation.json new file mode 100644 index 0000000000..79e383fb72 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_p_s2", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "P-s2", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T00:36:40.484807Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/raw-output-manifest.json new file mode 100644 index 0000000000..7bbaaed04b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 41960, + "path": "score.json", + "sha256": "040fcb90b1466aa92a9609e415f8030300535af6c5555b4e43c34c822e1ba243", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/raw-output/score.json new file mode 100644 index 0000000000..5dc9a90b5e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/P-s2/1/raw-output/score.json @@ -0,0 +1,382 @@ +{ + "schema_version": 1, + "mode": "P", + "scorer_id": "s2", + "reports": [ + { + "label": "C", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L23-25 gives the complete Scarlet formula, including V/T bounds and all three disjuncts."}, + {"id":"P2","decision":"PASS","evidence":"L27-29 gives the complete Indigo formula, including both versioned turbo arms."}, + {"id":"P3","decision":"PASS","evidence":"L35-38 substitutes (1.84.0,X,true,false) and proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L35-38 substitutes (1.84.0,X,true,true) and proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L11 and L42-46 leave exact-promise identity UNPROVED while using the union only as an audit requirement."}, + {"id":"P6","decision":"PASS","evidence":"L17-21 and L31-33 define D_S over the complete seven-coordinate product."}, + {"id":"P7","decision":"PASS","evidence":"L17-21 and L31-33 define D_I over the complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"L42-46 proves D_S subseteq R by the left union disjunct."}, + {"id":"P9","decision":"PASS","evidence":"L42-46 separately proves D_I subseteq R by the right union disjunct."}, + {"id":"P10","decision":"PASS","evidence":"L66 universally falsifies every Scarlet arm when f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"L66 universally falsifies every Indigo arm when f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"L50-52 and L58-66 apply exact BUILD-MAP-POLICY, all/cfg, and compile_error contracts over v,h,p,d."}, + {"id":"P13","decision":"PASS","evidence":"L54 and L76 apply each exact-version unwrap_or contract to None and Some."}, + {"id":"P14","decision":"PASS","evidence":"L54 and L77 trace unwrap_or's byte into the exact Some(value) receiver and discharge the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L54 and L78 compose unwrap_or, Some construction, and unwrap_unchecked's return contract."}, + {"id":"P16","decision":"PASS","evidence":"L21, L42-44, and L93 define Required=R over complete tuples in K."}, + {"id":"P17","decision":"PASS","evidence":"L95 and L101 retain v,t,f,h,p,d,i in Covered_sound through K."}, + {"id":"P18","decision":"PASS","evidence":"L76-77 and L95 prove both no-unsafe and turbo-unsafe regions admitted to Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L103-105 maps each Required f branch to proved coverage and states Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L9, L13, and L103-107 conclude whole-domain soundness PROVED relative to BUILD-MAP-POLICY from closure."}, + {"id":"P21","decision":"PASS","evidence":"L97-101 retain all seven coordinates in Covered_post through K."}, + {"id":"P22","decision":"PASS","evidence":"L76, L78, and L97-99 establish the postcondition on every case admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L103-105 independently gives Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L10, L13, and L103-107 conclude the full-domain postcondition PROVED with the TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L58 and L111-113 confine BUILD-MAP-POLICY to its exact mapping identity, consumers, and region."}, + {"id":"P26","decision":"PASS","evidence":"L9-10, L13, L66, and L79 conspicuously carry BUILD-MAP-POLICY into all dependent conclusions."}, + {"id":"P27","decision":"PASS","evidence":"L50-54 supplies exact-version URLs and quotations for cfg/all/not, compile_error, unwrap_or, and unwrap_unchecked."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L81-89 labels the suggested comment as documentation-only and proves the current implementation independently."}, + "tcb_authority_defect": {"present":false,"evidence":"L50-54 and L111-113 separate exact Rust authority from the narrowly accepted build mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5 identifies only the supplied snapshot and expressly disclaims prior-audit use."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L39-44 reproduces Scarlet with its exact bounds and versioned X/A arms."}, + {"id":"P2","decision":"PASS","evidence":"L45-49 reproduces Indigo with its exact bounds and versioned X/A arms."}, + {"id":"P3","decision":"PASS","evidence":"L58-60 checks (1.84.0,X,true,false) in Scarlet and out of Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L60-63 checks (1.84.0,X,true,true) in Indigo and out of Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L17 and L19-22 state policy identity UNPROVED and distinguish Required from the project promise."}, + {"id":"P6","decision":"PASS","evidence":"L28-36 and L51-56 define D_S with all seven coordinates and every valid Option input."}, + {"id":"P7","decision":"PASS","evidence":"L28-36 and L51-56 define D_I with all seven coordinates and every valid Option input."}, + {"id":"P8","decision":"PASS","evidence":"L76-83 separately proves D_S subseteq Required via S implies S or I."}, + {"id":"P9","decision":"PASS","evidence":"L76-83 separately proves D_I subseteq Required via I implies S or I."}, + {"id":"P10","decision":"PASS","evidence":"L76-80 and L158-160 show Scarlet has no f=true,t=W case for arbitrary remaining axes."}, + {"id":"P11","decision":"PASS","evidence":"L76-80 and L158-160 show Indigo has no f=true,t=W case for arbitrary remaining axes."}, + {"id":"P12","decision":"PASS","evidence":"L87-104 and L158-164 give the exact mapping, all/cfg inclusion, and compile_error failure for every full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L106-117 and L148-150 apply exact-version unwrap_or prose to both Option variants."}, + {"id":"P14","decision":"PASS","evidence":"L151-157 traces r through unwrap_or into the immediate Some(r) receiver and rules out None."}, + {"id":"P15","decision":"PASS","evidence":"L151-157 composes both Option return contracts to obtain Q(o)."}, + {"id":"P16","decision":"PASS","evidence":"L67-74 defines Required over v,t,f,h,p,d,o without projection."}, + {"id":"P17","decision":"PASS","evidence":"L138-146 defines K and Covered_sound with every case coordinate."}, + {"id":"P18","decision":"PASS","evidence":"L148-157 proves the safe and turbo regions included in Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L166-172 carries all common conjuncts and proves Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L14, L19-22, and L166-172 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L138-146 defines Covered_behavior over the same complete K tuple."}, + {"id":"P22","decision":"PASS","evidence":"L148-157 proves Q(o) on every non-turbo and turbo case admitted to behavioral coverage."}, + {"id":"P23","decision":"PASS","evidence":"L166-172 separately proves Required subseteq Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L15, L19-22, and L166-172 conclude the postcondition PROVED over Required relative to the TCB."}, + {"id":"P25","decision":"PASS","evidence":"L119-127 records the exact bundled releases, manifest, mappings, consumers, and exclusions."}, + {"id":"P26","decision":"PASS","evidence":"L14-16 and L19-22 conspicuously qualify soundness, behavior, and rejection with TCB-BUILD-MAP."}, + {"id":"P27","decision":"PASS","evidence":"L87-117 provides version-matched URLs and supplying quotations for every material Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L181-191 identifies a documentation-only replacement and does not use it to prove the current code."}, + "tcb_authority_defect": {"present":false,"evidence":"L119-127 narrowly accounts for BUILD-MAP-POLICY and separates exact Rust axioms."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 confines the review to supplied files and disclaims prior-audit evidence."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L16-23 states Scarlet's full V/T-bounded predicate and every disjunct."}, + {"id":"P2","decision":"PASS","evidence":"L25-32 states Indigo's full V/T-bounded predicate and every disjunct."}, + {"id":"P3","decision":"PASS","evidence":"L34 substitutes the 1.84 X unhardened witness into both predicates."}, + {"id":"P4","decision":"PASS","evidence":"L34 substitutes the 1.84 X hardened witness into both predicates."}, + {"id":"P5","decision":"PASS","evidence":"L10 and L60 leave exact-promise identity UNPROVED and label U only an audit envelope."}, + {"id":"P6","decision":"PASS","evidence":"L36-42 defines D_S over the full seven-coordinate case."}, + {"id":"P7","decision":"PASS","evidence":"L36-42 defines D_I over the full seven-coordinate case."}, + {"id":"P8","decision":"PASS","evidence":"L51-58 proves every Scarlet disjunct implies U with remaining dimensions unchanged."}, + {"id":"P9","decision":"PASS","evidence":"L51-58 separately proves every Indigo disjunct implies U."}, + {"id":"P10","decision":"PASS","evidence":"L75 and L80 prove the entire f=true,t=W fiber is disjoint from D_S."}, + {"id":"P11","decision":"PASS","evidence":"L75 and L80 prove the entire f=true,t=W fiber is disjoint from D_I."}, + {"id":"P12","decision":"PASS","evidence":"L64, L68, and L75-80 apply the accepted mapping and exact-version all/cfg/compile_error implications universally."}, + {"id":"P13","decision":"PASS","evidence":"L66 and L82 apply unwrap_or's exact contract to arbitrary None/Some input."}, + {"id":"P14","decision":"PASS","evidence":"L66 and L84 connect r=input.unwrap_or(0) to the exact Some(r) unsafe receiver."}, + {"id":"P15","decision":"PASS","evidence":"L66 and L84 use unwrap_unchecked's return contract to recover the original specification result."}, + {"id":"P16","decision":"PASS","evidence":"L36-55 states Required=D_A with v,t,f,h,p,d,input retained."}, + {"id":"P17","decision":"PASS","evidence":"L75-77 and L90-95 define Covered_sound from full-case C_N and C_T predicates."}, + {"id":"P18","decision":"PASS","evidence":"L82-84 establishes applicable no-unsafe and unsafe-site proofs throughout C_N union C_T."}, + {"id":"P19","decision":"PASS","evidence":"L97-102 maps each Required branch to C_N or C_T and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L7 and L97-104 conclude full-domain soundness PROVED relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L75-77 and L90-95 retain the complete tuple in Covered_behavior."}, + {"id":"P22","decision":"PASS","evidence":"L82-84 proves the return specification for all C_N and C_T inputs."}, + {"id":"P23","decision":"PASS","evidence":"L97-102 independently states Required subseteq Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L8 and L97-104 give the TCB-qualified whole-domain postcondition verdict."}, + {"id":"P25","decision":"PASS","evidence":"L68 restricts BUILD-MAP-POLICY to the three Cargo identities, named mappings, profiles, and allowed consumers."}, + {"id":"P26","decision":"PASS","evidence":"L7-10, L68, and L80 carry the accepted mapping qualification into all dependent results."}, + {"id":"P27","decision":"PASS","evidence":"L64-66 pairs each material cfg/compile_error/Option proposition with per-release URLs and quotations."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L106-116 calls the suggested comment documentation debt and does not use it as current-artifact evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"L64-68 separates versioned Rust quotations from the narrowly scoped accepted build premise."}, + "visible_scope_defect": {"present":false,"evidence":"L5 identifies only the complete supplied target snapshot and source-level scope."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L26-34 reproduces Scarlet exactly, including V/T bounds and both turbo targets."}, + {"id":"P2","decision":"PASS","evidence":"L36-42 reproduces Indigo exactly, including its versioned X and A clauses."}, + {"id":"P3","decision":"PASS","evidence":"L44-46 verifies the 1.84 X unhardened Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"L46-50 verifies the 1.84 X hardened Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"L19 and L73-77 keep exact-promise identity UNPROVED and distinct from the audit union."}, + {"id":"P6","decision":"PASS","evidence":"L54-68 defines Base over all seven axes and D_S as Base intersect Scarlet."}, + {"id":"P7","decision":"PASS","evidence":"L54-68 defines Base over all seven axes and D_I as Base intersect Indigo."}, + {"id":"P8","decision":"PASS","evidence":"L69-75 separately proves D_S subseteq Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L69-75 separately proves D_I subseteq Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L90-93 shows every full f=true,t=W case is outside Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L90-93 shows every full f=true,t=W case is outside Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L85-100 combines exact-version all/cfg/compile_error contracts with the accepted mapping across the full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L84 and L104-112 apply unwrap_or to both exhaustive valid inputs."}, + {"id":"P14","decision":"PASS","evidence":"L84 and L114-119 trace value into the immediate Some(value) receiver and rule out None."}, + {"id":"P15","decision":"PASS","evidence":"L114-122 composes unwrap_or and unwrap_unchecked return contracts to obtain g(i)."}, + {"id":"P16","decision":"PASS","evidence":"L54-70 states Required over complete Base tuples."}, + {"id":"P17","decision":"PASS","evidence":"L135-141 defines Covered_sound with every Base coordinate."}, + {"id":"P18","decision":"PASS","evidence":"L106-122 and L143-144 prove both source branches admitted by Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L143-148 maps all Required cases and states Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L16, L18, and L143-149 provide the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L135-141 defines Covered_post over the complete Base tuple."}, + {"id":"P22","decision":"PASS","evidence":"L106-122 proves g(i) on every branch included in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L143-148 independently proves Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L17-18 and L143-149 conclude the full-domain postcondition with the same TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L155-160 gives the exact bundled-Cargo identity, supplied artifact, mappings, consumers, and exclusions."}, + {"id":"P26","decision":"PASS","evidence":"L16-18, L95-100, and L155-160 conspicuously qualify every mapping-dependent conclusion."}, + {"id":"P27","decision":"PASS","evidence":"L81-86 supplies exact-version URLs and quotations for Option, all/not/cfg, and compile_error semantics."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L124-131 labels the replacement as documentation debt and the proof does not depend on it."}, + "tcb_authority_defect": {"present":false,"evidence":"L81-86 and L155-160 keep exact Rust authority separate from the accepted mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 confines the audit to the supplied target materials."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L23-33 gives Scarlet's exact bounded predicate and all disjuncts."}, + {"id":"P2","decision":"PASS","evidence":"L35-42 gives Indigo's exact bounded predicate and all disjuncts."}, + {"id":"P3","decision":"PASS","evidence":"L44-48 correctly checks (1.84.0,A,true,true) as Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"L44-48 correctly checks (1.84.0,X,true,true) as Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"L12 and L17-19 leave policy identity UNPROVED and refuse to rename the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"L53-60 defines D_S over every profile, both debug states, and all valid Option inputs."}, + {"id":"P7","decision":"PASS","evidence":"L53-60 defines D_I over every profile, both debug states, and all valid Option inputs."}, + {"id":"P8","decision":"PASS","evidence":"L66-80 separately proves Scarlet cases imply the selected full superset."}, + {"id":"P9","decision":"PASS","evidence":"L66-80 separately proves Indigo cases imply the selected full superset."}, + {"id":"P10","decision":"PASS","evidence":"L82-88 universally excludes f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L82-88 universally excludes f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L82-88 and L95-107 apply exact mapping, all/cfg selection, and compile_error failure to the full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L108-116 and L125-129 apply exact-version unwrap_or behavior to both variants."}, + {"id":"P14","decision":"PASS","evidence":"L131-139 traces y into the syntactically immediate Some(y) receiver."}, + {"id":"P15","decision":"PASS","evidence":"L131-139 composes both Option contracts to prove the documented result."}, + {"id":"P16","decision":"PASS","evidence":"L66-72 defines Required with all seven dimensions explicit."}, + {"id":"P17","decision":"PASS","evidence":"L148-155 retains the full F(c) tuple in Covered_sound."}, + {"id":"P18","decision":"PASS","evidence":"L125-139 and L151-154 completely prove both L0 and L1 soundness regions."}, + {"id":"P19","decision":"PASS","evidence":"L157-164 exhausts f and proves Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L13, L17-19, and L157-164 certify soundness over Required relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L148-155 retains the full F(c) tuple in Covered_behavior."}, + {"id":"P22","decision":"PASS","evidence":"L125-139 proves the documented return on every L0 and L1 case."}, + {"id":"P23","decision":"PASS","evidence":"L157-164 separately proves Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L14, L17-19, and L157-164 certify the full-domain behavior theorem with TCB relativity."}, + {"id":"P25","decision":"PASS","evidence":"L168-173 confines BUILD-MAP-POLICY to exact releases, mappings, consumers, and excludes Rust/backend claims."}, + {"id":"P26","decision":"PASS","evidence":"L13-18 and L82-88 explicitly qualify all mapping-dependent verdicts."}, + {"id":"P27","decision":"PASS","evidence":"L92-116 pairs every material cfg/compile_error/Option premise with exact-version links and quotes."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L175-186 labels the replacement documentation-only and does not use it for current proof."}, + "tcb_authority_defect": {"present":false,"evidence":"L168-173 narrowly scopes the accepted mapping and keeps CFG/CE/OPTION as exact Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"L5-8 states a source-only review of the supplied target and no external execution evidence."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L37-44 reproduces the complete bounded Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"L45-49 reproduces the complete bounded Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"L51-55 verifies the Scarlet-only 1.84 X unhardened witness."}, + {"id":"P4","decision":"PASS","evidence":"L53-55 verifies the Indigo-only 1.84 X hardened witness."}, + {"id":"P5","decision":"PASS","evidence":"L17 and L19-24 leave project-promise identity UNPROVED and distinguish the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"L57-65 defines D_S over all seven requested coordinates."}, + {"id":"P7","decision":"PASS","evidence":"L57-65 defines D_I over all seven requested coordinates."}, + {"id":"P8","decision":"PASS","evidence":"L67-70 separately proves D_S subseteq Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L67-70 separately proves D_I subseteq Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L103-107 substitutes f=true,t=W and excludes all Scarlet cases."}, + {"id":"P11","decision":"PASS","evidence":"L103-107 substitutes f=true,t=W and excludes all Indigo cases."}, + {"id":"P12","decision":"PASS","evidence":"L76-101 combines exact-version all/cfg/compile_error quotations with exact BUILD-MAP-POLICY mapping."}, + {"id":"P13","decision":"PASS","evidence":"L111-126 applies per-release unwrap_or prose to every valid input."}, + {"id":"P14","decision":"PASS","evidence":"L111-127 traces the produced byte into immediate Some(y) and rules out None."}, + {"id":"P15","decision":"PASS","evidence":"L111-128 composes unwrap_or and unwrap_unchecked returns to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L57-65 defines Required as a predicate on v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"L137-145 defines Covered_sound with all Base coordinates retained."}, + {"id":"P18","decision":"PASS","evidence":"L124-133 proves the no-unsafe and turbo unsafe-obligation regions underlying Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L147-158 maps every Required policy arm into Compiles and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L15, L19-21, and L147-161 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L137-145 defines Covered_post with every full-case coordinate."}, + {"id":"P22","decision":"PASS","evidence":"L124-133 proves Q on every case admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L147-158 separately proves Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L16, L19-21, and L147-161 conclude the documented postcondition on the whole domain under the same qualification."}, + {"id":"P25","decision":"PASS","evidence":"L91-94 and L165-171 limit BUILD-MAP-POLICY to its exact mapping and listed source-selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"L15-16, L106, L129, and L165-171 carry BUILD-MAP-POLICY into every dependent conclusion."}, + {"id":"P27","decision":"PASS","evidence":"L76-89 and L111-120 provide exact-release URLs and supplying quotations for all material Rust semantics."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L173-183 explicitly calls the replacement documentation-only while the current implementation remains proved."}, + "tcb_authority_defect": {"present":false,"evidence":"L165-171 keeps the accepted mapping within its consumers and uses exact-version Rust authority separately."}, + "visible_scope_defect": {"present":false,"evidence":"L5-11 limits scope to the supplied target and its visible surfaces."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L31-37 states Scarlet exactly with V/T bounds and both turbo arms."}, + {"id":"P2","decision":"PASS","evidence":"L39-41 states Indigo exactly with V/T bounds and both versioned arms."}, + {"id":"P3","decision":"PASS","evidence":"L43-47 verifies the Scarlet-only 1.84 X unhardened configuration."}, + {"id":"P4","decision":"PASS","evidence":"L48-50 verifies the Indigo-only 1.84 X hardened configuration."}, + {"id":"P5","decision":"PASS","evidence":"L25-27 and L65-66 leave exact promise identity UNPROVED and distinguish R from policy."}, + {"id":"P6","decision":"PASS","evidence":"L31-33 and L52-56 define D_S with all full-case dimensions."}, + {"id":"P7","decision":"PASS","evidence":"L31-33 and L52-56 define D_I with all full-case dimensions."}, + {"id":"P8","decision":"PASS","evidence":"L58-64 separately proves D_S subseteq R by union introduction."}, + {"id":"P9","decision":"PASS","evidence":"L58-64 separately proves D_I subseteq R by union introduction."}, + {"id":"P10","decision":"PASS","evidence":"L115-117 universally excludes f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L115-117 universally excludes f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L83-95 and L119-125 apply exact mapping, all/cfg, and compile_error authority over all remaining axes."}, + {"id":"P13","decision":"PASS","evidence":"L70-80 and L138-143 prove unwrap_or's result for None and every Some(n)."}, + {"id":"P14","decision":"PASS","evidence":"L145-152 traces x into an immediate Some(x) receiver and discharges the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L145-152 uses both exact Option return contracts to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L52-60 states Required=R on the complete tuple c."}, + {"id":"P17","decision":"PASS","evidence":"L164-176 defines Covered_sound=R and explicitly retains v,t,f,h,p,d,i."}, + {"id":"P18","decision":"PASS","evidence":"L138-152 and L171-176 establish valid soundness proofs on both exhaustive R branches."}, + {"id":"P19","decision":"PASS","evidence":"L171-180 exhausts f, maps to proved lemmas, and states Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L22, L24, and L178-184 conclude whole-domain soundness relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L164-176 defines Covered_post=R with every coordinate retained."}, + {"id":"P22","decision":"PASS","evidence":"L138-152 and L171-176 prove Q throughout both Covered_post branches."}, + {"id":"P23","decision":"PASS","evidence":"L178-181 independently proves Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L23-24 and L178-184 provide the TCB-relative whole-domain postcondition conclusion."}, + {"id":"P25","decision":"PASS","evidence":"L97-105 confines BUILD-MAP-POLICY to exact bundled releases, supplied artifact, mappings, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"L22-24 and L119-125 explicitly carry the build-map qualification into all dependent verdicts."}, + {"id":"P27","decision":"PASS","evidence":"L70-95 gives exact-release URLs and quotations for all Option and conditional-compilation premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L154-162 labels the suggested replacement as documentation debt and proves current code separately."}, + "tcb_authority_defect": {"present":false,"evidence":"L97-105 narrowly scopes the sole TCB entry and separates authoritative Option/cfg semantics."}, + "visible_scope_defect": {"present":false,"evidence":"L5-8 confines review to supplied evidence and disclaims prior results."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L28-39 reproduces Scarlet with exact V/T bounds and all clauses."}, + {"id":"P2","decision":"PASS","evidence":"L41-49 reproduces Indigo with exact V/T bounds and all clauses."}, + {"id":"P3","decision":"PASS","evidence":"L51-53 states a correct Scarlet-minus-Indigo witness."}, + {"id":"P4","decision":"PASS","evidence":"L51-53 states a correct Indigo-minus-Scarlet witness."}, + {"id":"P5","decision":"PASS","evidence":"L22-24 and L68-71 leave the exact project domain unresolved and call Required only an audit union."}, + {"id":"P6","decision":"PASS","evidence":"L28-31 and L55-60 define D_S over every profile, debug state, and valid input."}, + {"id":"P7","decision":"PASS","evidence":"L28-31 and L55-60 define D_I over every profile, debug state, and valid input."}, + {"id":"P8","decision":"PASS","evidence":"L62-70 separately proves D_S implies Required."}, + {"id":"P9","decision":"PASS","evidence":"L62-70 separately proves D_I implies Required."}, + {"id":"P10","decision":"PASS","evidence":"L95-101 shows all f=true,t=W cases are outside Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L95-101 shows all f=true,t=W cases are outside Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L95-101 and L165-181 apply exact accepted mapping and exact-version all/cfg/compile_error contracts."}, + {"id":"P13","decision":"PASS","evidence":"L128-129 and L154-158 prove unwrap_or's exact two-variant behavior."}, + {"id":"P14","decision":"PASS","evidence":"L130 and L159-164 trace x into Some(x) and discharge the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L131 and L159-164 compose Option return facts to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L55-66 defines Required on the full seven-coordinate domains."}, + {"id":"P17","decision":"PASS","evidence":"L75-84 retains v,t,f,h,p,d,i in B, N, U, and Covered_SND."}, + {"id":"P18","decision":"PASS","evidence":"L90-94 and L126-131 prove applicable soundness derivations throughout N union U."}, + {"id":"P19","decision":"PASS","evidence":"L103-115 maps every Required case to N or U and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L17-20 and L103-115 provide the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L75-84 retains every coordinate in Covered_POST."}, + {"id":"P22","decision":"PASS","evidence":"L129, L131, and L133-135 prove Q throughout Covered_POST."}, + {"id":"P23","decision":"PASS","evidence":"L103-115 independently proves Required subseteq Covered_POST."}, + {"id":"P24","decision":"PASS","evidence":"L19-20 and L103-115 conclude POST over the full domain with the same TCB."}, + {"id":"P25","decision":"PASS","evidence":"L183-189 gives exact bundled releases, mappings, profile region, consumers, exclusions, and triggers."}, + {"id":"P26","decision":"PASS","evidence":"L17-20 and L95-101 conspicuously qualify all mapping-dependent conclusions."}, + {"id":"P27","decision":"PASS","evidence":"L150-181 supplies exact-version links and quotations for every material Option/cfg/compile_error premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L137-146 explicitly marks the replacement review-only and does not use it for implementation proof."}, + "tcb_authority_defect": {"present":false,"evidence":"L183-189 keeps BUILD-MAP-POLICY within exact identity and consumers, separate from Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 identifies only the supplied artifact and source-level claim."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L20-27 reproduces the exact bounded Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"L29-34 reproduces the exact bounded Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"L40 checks the Scarlet-only 1.84 X unhardened configuration against both formulas."}, + {"id":"P4","decision":"PASS","evidence":"L40 checks the Indigo-only 1.84 X hardened configuration against both formulas."}, + {"id":"P5","decision":"PASS","evidence":"L12 and L53 explicitly leave unique crate promise identity UNPROVED and separate Required_A."}, + {"id":"P6","decision":"PASS","evidence":"L16-18 and L36-38 define S(c) over the full seven-coordinate product."}, + {"id":"P7","decision":"PASS","evidence":"L16-18 and L36-38 define I(c) over the full seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"L42-51 separately proves S subseteq A by disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L42-51 separately proves I subseteq A by disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L45-51 and L69-70 show Scarlet contains no f=true,t=W case."}, + {"id":"P11","decision":"PASS","evidence":"L45-51 and L69-70 show Indigo contains no f=true,t=W case."}, + {"id":"P12","decision":"PASS","evidence":"L57-63 and L69-70 apply exact mapping, all/cfg, and compile_error contracts uniformly over the fiber."}, + {"id":"P13","decision":"PASS","evidence":"L61 and L72-75 apply unwrap_or's exact contract to both valid Option variants."}, + {"id":"P14","decision":"PASS","evidence":"L75 traces x into locally constructed Some(x) and discharges the None safety obligation."}, + {"id":"P15","decision":"PASS","evidence":"L75 uses unwrap_unchecked's contained-value return to establish q(i)."}, + {"id":"P16","decision":"PASS","evidence":"L16-18, L42, and L53 state Required_A=A on complete tuples."}, + {"id":"P17","decision":"PASS","evidence":"L87-99 defines Covered_sound with A(c), f/t, and the selected execution on i."}, + {"id":"P18","decision":"PASS","evidence":"L67 and L74-75 prove every non-turbo and turbo execution admitted to Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L101-102 exhausts f, carries the full tuple, and proves Required_A subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L9 and L101-102 give a complete TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L87-99 defines Covered_post with the complete A(c) tuple and input-sensitive result."}, + {"id":"P22","decision":"PASS","evidence":"L74-75 proves q(i) on every execution admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L101-102 independently establishes Required_A subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L10 and L101-102 conclude the whole-domain postcondition under the same TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L63 confines BUILD-MAP-POLICY to exact bundled releases, supplied artifact, mappings, profiles, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"L9-12 and L63 explicitly qualify every whole-case verdict and the rejection proof."}, + {"id":"P27","decision":"PASS","evidence":"L57-61 provides exact-version URLs and quotations for all conditional-compilation and Option premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L77-83 offers a comment replacement only after independently proving the current implementation."}, + "tcb_authority_defect": {"present":false,"evidence":"L57-63 separates exact-version Rust authority from the narrowly admitted build mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5 confines the audit to exact supplied target materials and disclaims outside execution evidence."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id":"P1","decision":"FAIL","evidence":"L49-56 labels S0 the exact Scarlet configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DS."}, + {"id":"P2","decision":"FAIL","evidence":"L61-68 labels I0 the exact Indigo configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DI."}, + {"id":"P3","decision":"PASS","evidence":"L73-76 gives a complete full case and correctly proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L76-79 gives a complete full case and correctly proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L20-23 and L89-91 leave the project promise UNPROVED and call A only an audit union."}, + {"id":"P6","decision":"PASS","evidence":"L42-59 conjoins Base's seven coordinates with S0, yielding the exact Scarlet full-case domain despite P1."}, + {"id":"P7","decision":"PASS","evidence":"L42-71 conjoins Base's seven coordinates with I0, yielding the exact Indigo full-case domain despite P2."}, + {"id":"P8","decision":"PASS","evidence":"L81-89 separately proves DS subseteq A by the left disjunct."}, + {"id":"P9","decision":"PASS","evidence":"L81-89 separately proves DI subseteq A by the right disjunct."}, + {"id":"P10","decision":"PASS","evidence":"L95-97 shows every Base case with f=true,t=W is outside DS."}, + {"id":"P11","decision":"PASS","evidence":"L95-97 shows every Base case with f=true,t=W is outside DI."}, + {"id":"P12","decision":"FAIL","evidence":"L99-112 claims universal rejection but quotes/cites only cfg-attribute and compile_error semantics; no exact-version all predicate authority supplies the two-leaves-to-true step."}, + {"id":"P13","decision":"PASS","evidence":"L124-143 supplies exact-version unwrap_or authority and proves both input cases on the non-turbo body."}, + {"id":"P14","decision":"PASS","evidence":"L124-149 traces x into the exact Some(x) receiver and uses the cited None/UB prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L144-149 composes both Option return contracts and establishes Q for every valid input."}, + {"id":"P16","decision":"PASS","evidence":"L42-46 and L81-85 state Required=A over v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"L158-166 retains every Base coordinate in Executable and Covered_sound."}, + {"id":"P18","decision":"FAIL","evidence":"L139-143 relies on an uncited complementary not cfg rule to select the non-turbo body, so the !f region admitted to Covered_sound lacks a complete authority-closed derivation."}, + {"id":"P19","decision":"FAIL","evidence":"L168-175 states the set inclusion, but its mapping of Required !f cases to a proved source branch inherits the missing exact-version not authority."}, + {"id":"P20","decision":"FAIL","evidence":"L11-14 claims whole-domain soundness PROVED, but L168-175 does not provide a valid authority-closed Required-to-Covered certificate."}, + {"id":"P21","decision":"PASS","evidence":"L158-166 retains every Base coordinate in Covered_post."}, + {"id":"P22","decision":"FAIL","evidence":"L139-143 leaves the non-turbo selection dependent on an uncited not cfg semantic premise, so Covered_post overclaims that region."}, + {"id":"P23","decision":"FAIL","evidence":"L168-175 states behavioral containment, but the !f mapping is not to a completely authority-closed branch proof."}, + {"id":"P24","decision":"FAIL","evidence":"L15-16 claims whole-domain behavior without conspicuous TCB relativity, and L168-175 also inherits the invalid behavioral coverage certificate."}, + {"id":"P25","decision":"PASS","evidence":"L180-185 restricts BUILD-MAP-POLICY to exact bundled Cargo identities, supplied artifact, mappings, and listed consumers."}, + {"id":"P26","decision":"FAIL","evidence":"L15-16 states the behavior verdict only on the same domain, not under the BUILD-MAP-POLICY qualification carried by soundness; later closure is likewise unqualified."}, + {"id":"P27","decision":"FAIL","evidence":"L99-112 and L139-140 use material all and not cfg semantics in positive proofs without exact-version quotations or applicable predicate-section URLs."} + ], + "hard_errors": [ + {"id":"PH4","evidence":"L11-16 and L173-175 claim whole-domain soundness/behavior although the Covered derivations rely on the unverified not cfg premise at L139-140."}, + {"id":"PH5","evidence":"L17-19 and L99-112 affirm universal turbo/wasm rejection without an applicable exact-version all implication."}, + {"id":"G11","evidence":"The positive rejection and non-turbo selection proofs at L99-112 and L139-140 necessarily rely on unchecked all/not Rust authority."} + ], + "proposal_laundering": {"present":false,"evidence":"L195-204 labels the comment replacement proof-artifact documentation and does not use it to certify current code."}, + "tcb_authority_defect": {"present":true,"evidence":"L99-112 and L139-140 omit exact-version all/not authority, and L15-16 omits conspicuous TCB qualification from behavior."}, + "visible_scope_defect": {"present":false,"evidence":"L5-9 confines inspection to supplied target files and explicitly says nothing was built, run, or tested."}, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/attestation.json new file mode 100644 index 0000000000..89bbb2a5a0 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_q_s1", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "Q-s1", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T01:00:40.512182Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/raw-output-manifest.json new file mode 100644 index 0000000000..44519a4ab4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 20182, + "path": "score.json", + "sha256": "f0a834ba924f88ce435031c3c3e30ec2aee1cb2d24b09eb032bc8fd861b508e0", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/raw-output/score.json new file mode 100644 index 0000000000..70c98a5b44 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s1/1/raw-output/score.json @@ -0,0 +1,448 @@ +{ + "schema_version": 1, + "mode": "Q", + "scorer_id": "s1", + "reports": [ + { + "label": "C", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table gives safe force_unreachable calls no caller precondition, limits delegated_nonzero valid uses to value != 0, and says the APIs are separate claims." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's numbered certificate states valid public-safe invocation, unconditional reachability, falsity of the not-reached requirement, and the checked Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports F UNSOUND and explicitly calls the witness an existential refutation, not merely a failed universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the unchanged nonzero argument meets the peer precondition, notes the body and accepted UNSAFE-DEP entry are absent, and states the exact quantified provider-UB-freedom premise missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports D UNPROVED, rejects an invented UB witness, and requires recursive audit or an authorized exact UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Proposed repairs are expressly future changed artifacts requiring fresh audit and are not used for either current verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It consumes only the accepted exact Rust 1.80.0 URL proposition and conspicuously refuses unavailable dependency implementation trust." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report describes only supplied packet files and the permitted exact Rust URL; it disclaims binaries, dependency source, generated artifacts, and tools." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Its verdict table independently defines C1 as every safe invocation and C2 as unsafe invocations with value in 1..=255 satisfying value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1's proof gives a valid safe call, straight-line execution of unreachable_unchecked, the false unreachability proposition, and the applicable Rust 1.80.0 UB rule." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It concludes C1 UNSOUND across D and says the completed existential refutation is stronger than failure of a universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It derives the peer precondition from the wrapper contract and unchanged value, distinguishes the pin and documentation from implementation correctness, and quantifies the smallest missing UB-freedom proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It returns UNPROVED for C2, says no dependency UB witness is supplied, and identifies exact implementation audit or precise TCB acceptance as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Its repair suggestions are not treated as implemented evidence and it calls for a new audit after repair." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report uses the version-matched accepted std authority for C1 and expressly declines any peer implementation premise for C2." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It identifies only supplied artifacts and the allowed versioned Rust page and expressly says unavailable external artifacts were not inspected." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The Full valid-use domains section separately covers every well-typed safe force call and only delegated calls whose unsafe caller satisfies value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Its four-step F certificate explicitly connects valid safe use, necessary line-6 reachability, falsity of site-unreachability, and AXIOM-UU's Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports force_unreachable UNSOUND and says the four links close the required witness chain." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-CALL is proved from the identical nonzero contracts and unchanged value; D-SOUND remains the explicitly quantified missing exact-provider premise despite the version pin." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, rejects UNSOUND without a dependency execution, and requires exact recursive audit or accepted UNSAFE-DEP trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "No unimplemented proposal supports a current conclusion; suggested changes are coupled to re-audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is tied to the exact allowed Rust 1.80.0 page and the unavailable peer implementation is explicitly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Hashes concern supplied files, and the report limits external inspection to the permitted Rust citation while disclaiming source, builds, binaries, and tools." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claims table gives the safe API every well-typed invocation with no precondition and the unsafe API exactly nonzero u8 calls, then says the claims are separate." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "OBL-FORCE explicitly supplies valid safe invocation, immediate reachability, false unreachability, and the verified Rust 1.80.0 rule that reaching the function is UB." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It labels force_unreachable UNSOUND and describes the derivation as a complete existential certificate in every actual configuration." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the dependency call's nonzero precondition locally but leaves exact 3.4.5 provider correctness missing because no implementation, audit, or accepted trust exists." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED rather than fabricating behavior, and names exact implementation/generated-artifact audit or equally scoped accepted UNSAFE-DEP as the needed evidence." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Potential redesigns are presented only as future resolution and the report requires fresh audit of any changed artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its TCB log confines the std premise to the checked exact versioned URL and marks peer provider trust expressly not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It says no build, execution, expansion, dependency implementation, prior audit, or binary was inspected and uses only packet evidence plus the allowed URL." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdicts separately quantify every well-typed safe force call with no precondition and every unsafe delegated call with value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "CLAIM-FU's certificate enumerates valid use, unconditional reachability, the false not-reached proposition, and AXIOM-UR-180's applicable UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives CLAIM-FU the verdict UNSOUND and explicitly states that the valid safe use reaches the authoritative UB event." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "OBL-DN-LOCAL proves the unchanged nonzero argument; OBL-DN-IMPL states the exact quantified provider premise and explains why neither the declaration, pin, nor rejected trust supplies it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports CLAIM-DN UNPROVED, says the absent body cannot yield a UB execution, and requires exact recursive audit, local replacement, or precise accepted trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Repairs are prospective and are never certified as the supplied current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It uses the independently checked Rust 1.80.0 Safety section only for force and explicitly rejects relying on the unavailable peer body." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines the snapshot to supplied files and the permitted citation and says no lockfile, dependency source, prior audit, binary, or tool result is available or reused." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Its claims table gives C1 every safe call without a caller obligation and C2 only calls with value != 0, and the text calls them separate verdicts." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1/O1 supplies valid safe invocation, unconditional execution, falsity of the required unreachability, and the exact Rust 1.80.0 documentation's UB classification." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports C1 UNSOUND, explicitly not merely unproved, on the complete certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "C2/O2 proves the identical nonzero precondition, while O3 precisely quantifies missing 3.4.5 implementation UB-freedom and rejects pinning as provider proof." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports C2 UNPROVED, notes no dependency UB execution exists, and calls for exact recursive audit or an authorized precise UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "It does not rely on its suggested remediation; any implementation change is said to require audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact versioned Rust authority is applied only to O1, and unsafe-dependency trust is marked not proposed or accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "All named evidence is supplied packet material or the allowed exact URL, with unavailable implementation and tool evidence expressly excluded." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Claim F covers every safe invocation without a precondition, Claim D covers every nonzero valid unsafe invocation, and each is independently quantified over D." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "F-OBL-1 lists the public-safe witness, necessary execution, the false not-reached requirement, and AXIOM-UU's applicable Rust UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It declares force_unreachable UNSOUND and says the four-link certificate covers every configuration member." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-OBL-1 derives the peer precondition from valid use; D-OBL-2 identifies exact-provider UB-freedom as missing because body/audit/trust is absent and the pin proves no semantics." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, explicitly denies an existential counterexample, and requires implementation audit or exact human TCB acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested future resolution is not used as proof of the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is the verified exact Rust 1.80.0 proposition, while UNSAFE-DEP-345 is conspicuously rejected and not consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines itself to the supplied source/evidence and permitted citation and says no dependency internals, builds, binaries, or tools were used." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Required_F includes every well-typed safe call with no precondition; Required_D separately includes exactly unsafe calls with nonzero u8 values." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's numbered certificate explicitly gives valid use, unconditional line-6 reachability, falsity of unreachability, and AXIOM-UU-180's UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports force_unreachable UNSOUND and states each required configuration has the witness." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The local derivation proves the peer's nonzero precondition; DEP-SOUND exactly states provider UB-freedom and remains missing because body/generated output and accepted trust are absent." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, refuses UNSOUND without a valid execution, and identifies recursive exact-implementation audit or precise accepted UNSAFE-DEP as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "No suggested implementation or trust proposal is certified as already present." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact accepted Rust proposition is used within its version/domain, and the unavailable peer implementation proposition is expressly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports only the supplied snapshot and allowed Rust URL and expressly disclaims prior audits, dependency implementation, expansions, binaries, and tools." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "R_force covers well-typed safe calls without a precondition, while R_delegate independently covers only nonzero u8 calls satisfying the unsafe API contract." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "The force verdict row gives the valid safe expression, unconditional execution, false site-unreachability proposition, and AXIOM-UU-180's UB implication." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It assigns force_unreachable UNSOUND for every configuration on that complete certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The delegate row proves unchanged nonzero dataflow, then states the smallest missing universal UB-freedom premise for exact peer 3.4.5 and notes no accepted entry or body supplies it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, says absence of universal proof is no UB witness, and requires exact recursive audit or explicit precise UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Future remediation is not used to narrow or certify the current source obligation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report verifies and scopes the exact Rust 1.80.0 axiom and treats proposed dependency trust as rejected and non-consumable." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It identifies only supplied artifacts and the allowed citation and says no generated body, prior audit, test, build, or tool result was used." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The surface table and claims table independently define all safe force calls as valid and delegated calls as valid exactly when value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C-F's four numbered links state valid safe invocation, unconditional call-site reachability, falsity of the not-reached condition, and the exact Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives C-F UNSOUND and explicitly distinguishes this completed witness from mere failure to prove." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "C-D proves the identical nonzero caller obligation and unchanged forwarding, then precisely quantifies the missing exact-provider UB-freedom premise and explains why no packet fact entails it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports C-D UNPROVED, rejects UNSOUND without an executable counterexample, and requires recursive exact implementation audit or exact human UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Replacement and trust options are presented as future resolutions, not evidence for the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is version-matched, citation-checked, and applied only to force; missing dependency trust is explicitly rejected." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines review to submitted files and the allowed exact Rust authority and says no build, execution, expansion, dependency implementation, binary, or prior audit was inspected." + }, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/attestation.json new file mode 100644 index 0000000000..d7efdf3026 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_q_s2", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "Q-s2", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T00:42:53.970249Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/raw-output-manifest.json new file mode 100644 index 0000000000..e458d36ba1 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 18518, + "path": "score.json", + "sha256": "33efb931c53a108e1ce6f6d396e88e382f64a70e00ce6f8478ab8b42378c3e98", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/raw-output/score.json new file mode 100644 index 0000000000..d2344c1f9e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/Q-s2/1/raw-output/score.json @@ -0,0 +1,448 @@ +{ + "schema_version": 1, + "mode": "Q", + "scorer_id": "s2", + "reports": [ + { + "label": "I", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table separates safe force_unreachable calls with no precondition from delegated_nonzero calls restricted to nonzero values." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "CLAIM-FU gives valid safe use, unconditional sole-path reachability, falsity of the not-reached requirement, and Rust 1.80.0 UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports CLAIM-FU UNSOUND and calls the chain a completed existential certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the forwarded nonzero precondition but identifies the absent implementation and rejected UNSAFE-DEP premise as the exact provider-correctness gap." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports CLAIM-DN UNPROVED, rejects inventing a UB witness, and requires recursive audit or an accepted exact UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Remediation is explicitly presented as a changed snapshot requiring fresh audit, not evidence about the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report consumes only the exact Rust 1.80.0 unreachable_unchecked proposition and expressly rejects dependency implementation trust." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states that no dependency body, prior audit, binary, or tool result was used and evidences only supplied artifacts and the allowed URL." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "R_force has every well-typed safe call with no precondition, while R_delegate independently restricts valid calls to v in 1..=255." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "The force verdict gives a valid safe witness, unconditional execution, the false unreachable proposition, and AXIOM-UU-180's UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives force_unreachable the strongest verdict UNSOUND for every configuration." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "O2 proves unchanged nonzero dataflow; O3 states the exact unavailable 3.4.5 implementation's universal UB-freedom as the missing proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, says absence supplies no UB witness, and names recursive audit or precise UNSAFE-DEP acceptance as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested source changes and trust acceptance are future resolutions, not support for a current positive verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU-180 is exact and version-matched; the proposed dependency entry is explicitly rejected and not consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report disclaims use of dependency source, prior audits, tools, and generated artifacts and shows no prohibited evaluator access." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Claim F covers all safe invocations without a caller precondition; Claim D separately covers only nonzero-valid unsafe invocations." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F enumerates valid safe use, necessary execution, falsity of unreachability, and the applicable Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The report concludes Claim F is UNSOUND over the full symbolic domain." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-OBL-1 discharges nonzero locally, while D-OBL-2 identifies universal valid-call UB-freedom of the absent exact implementation as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED, not UNSOUND; the report requires exact recursive implementation audit or acceptance of the precisely scoped dependency premise." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report treats audit or trust acceptance only as future resolution and does not certify either unimplemented option." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It uses the checked versioned Rust proposition for Claim F and labels the exact dependency premise rejected and not admitted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports reviewing supplied files only and explicitly says no dependency body, prior audit, binary, or tool result was used." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Required_F includes every well-typed safe invocation without a precondition; Required_D separately includes nonzero values satisfying the unsafe contract." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Its numbered certificate explicitly supplies valid use, body reachability, the false not-reached requirement, and AXIOM-UU-180's UB classification." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "Claim F receives the explicit verdict UNSOUND over all Required_F." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The local derivation proves the identical nonzero precondition, then states DEP-SOUND for every valid exact-implementation execution as the missing premise." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED; no falsifying execution is invented, and exact implementation audit or accepted precise UNSAFE-DEP trust is required." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Proposed remediation is not used to narrow or certify the supplied implementation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Only the exact accepted Rust authority is consumed; dependency documentation is expressly not treated as provider-correctness evidence." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report says no dependency implementation, prior audit, expansion, binary, or tool result was reused and reveals no prohibited source access." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table independently defines C1 as all well-typed safe calls and C2 as unsafe calls with value in 1..=255." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1 supplies the valid direct safe call, unconditional control flow, false unreachability requirement, and applicable Rust 1.80.0 UB statement." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It concludes C1 is UNSOUND and explicitly distinguishes this from failure of a universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves unchanged nonzero forwarding but says the absent body and declined UNSAFE-DEP entry leave exact valid-call provider UB-freedom missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C2 is UNPROVED, with no fabricated UB witness, and resolution is recursive audit or explicit acceptance of the exact dependency proposition." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Repair and trust options are identified as requiring a new audit or explicit acceptance, not as current proof." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact versioned Rust proposition is used in its accepted region, while implementation trust is expressly absent." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It says no dependency implementation, generated output, binary, prior audit, or tool-derived result was supplied or inspected." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Domains F and D separately quantify all safe force calls and only nonzero-valid delegated calls." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's four numbered steps establish a valid call, unconditional execution, false site-unreachable proposition, and authoritative UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The report gives force_unreachable the explicit verdict UNSOUND." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-CALL proves nonzero forwarding, while D-SOUND is the exact implementation's universal UB-free behavior and remains unsupported." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "The delegated claim is UNPROVED; absence yields no execution or UB consequence, and recursive audit or accepted dependency trust is required." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Future repair and trust paths are not used as evidence for either current verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is exact, version-matched, and scoped to F-UB; PEER-IMPL is expressly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Hashing and naming supplied artifacts are in scope, and the report disclaims dependency source, prior audit, generated output, and tool evidence." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "C1 covers every well-typed safe call without a precondition; C2 separately covers calls satisfying value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1 explicitly identifies valid invocation, necessary call-site execution, falsity of the operation's requirement, and the exact Rust UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports C1 UNSOUND rather than merely unproved." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "O2 proves the identical nonzero precondition; O3 gives universal UB-freedom of exact version 3.4.5 as the smallest absent provider proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C2 is UNPROVED, no dependency UB execution is asserted, and the stated resolutions are exact recursive audit or authorized UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested API changes and dependency evidence are prospective and do not certify the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The accepted Rust entry has exact version, proposition, domain, and consumer; proposed dependency trust is not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report uses supplied artifact hashes and the allowed citation while disclaiming tools, dependency source, binaries, and prior audits." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claim table states all well-typed safe force invocations and, independently, all nonzero-valid delegated invocations." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "OBL-FORCE proves the valid safe witness reaches the operation, falsifies unreachability, and triggers the checked Rust 1.80.0 UB rule." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The force claim is explicitly UNSOUND in every nonempty required configuration fiber." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "OBL-DELEGATE-CALL proves the nonzero precondition, while OBL-DELEGATE-IMPL states exact universal provider UB-freedom as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, rejects a fabricated existential witness, and requires exact audit or accepted equally scoped trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Potential implementation or boundary changes are explicitly new artifacts needing fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact Rust 1.80.0 proposition is the only consumed authority and the dependency proposition is expressly not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report states no source was executed, built, expanded, or edited and no dependency implementation or prior audit was supplied." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "API-F permits every well-typed safe call; API-D independently requires value != 0 with no ongoing or terminal obligation." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C-F's four steps give valid safe use, sole-path reachability, the false not-reached requirement, and exact Rust 1.80.0 UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "C-F is reported UNSOUND, explicitly not merely a failure to prove." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves unchanged nonzero forwarding and states exact-version valid-call UB-freedom as the smallest proposition absent from source and TCB." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C-D is UNPROVED; the report declines an executable counterexample and requires recursive audit or exact human-accepted UNSAFE-DEP trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Replacement and trust options are framed only as minimal future resolutions." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is exact and citation-checked for its consumer; UNSAFE-DEP-345 is rejected and not admitted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines review to submitted source and evidence and says no build, execution, dependency implementation, binary, or prior audit was inspected." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claim table separately states all safe force calls with no precondition and delegated calls limited to value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F lists a valid safe invocation, immediate operation reachability, falsity of the exact safety proposition, and AXIOM-UU-180's UB result." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports Claim F UNSOUND and identifies the derivation as an existential refutation." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It closes the identical nonzero caller obligation but identifies exact selected-implementation UB-freedom for every valid call as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED, no implementation behavior is fabricated, and exact recursive audit or accepted precise UNSAFE-DEP trust is prescribed." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report does not consume any proposed repair as evidence for the supplied source." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The allowed Rust 1.80.0 authority is used only for Claim F, and the absent dependency premise is not trusted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It limits itself to supplied files and the allowed Rust page and disclaims binaries, generated artifacts, tools, and dependency implementation access." + }, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/attestation.json new file mode 100644 index 0000000000..8d2b296ec2 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_r_s1", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "R-s1", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T00:54:20.561194Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/raw-output-manifest.json new file mode 100644 index 0000000000..b65cf0bd37 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 24129, + "path": "score.json", + "sha256": "18ace2d3d6ffc4b2ba1aa686a459a387258b03d0e321d46c6f34548af3ba67a9", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/raw-output/score.json new file mode 100644 index 0000000000..16f75bde5c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s1/1/raw-output/score.json @@ -0,0 +1,596 @@ +{ + "schema_version": 1, + "mode": "R", + "scorer_id": "s1", + "reports": [ + { + "label": "B", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs downstream `Bad`, a safe `Slot` impl returning 2, and a safe generic call, with exact visibility, coherence, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Tracks 2 into `get_unchecked_mut(2)`, proves it out of bounds for length 2, and cites Rust 1.82 UB even when unused." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Explicitly reports the current safe API `UNSOUND` and keeps the regional Tail proof and redesign independent." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the fixed Tail behavior as wrapping increment of element 1 and states that downstream generic capability is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a nongeneric safe `increment` using `pair[1]` and `wrapping_add`, with no caller-selected implementation or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains removal of `Slot`, `Tail`, and generic calls, the source-breaking migration, and the request's authorization for this unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Calls the redesign a proposal with no artifact verdict and requires implementation followed by a fresh snapshot audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly excluded from the current verdict and is left unaudited pending implementation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Every material Rust premise is tied to an applicable exact Rust 1.82 Reference or standard-library URL." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report evidences only the supplied target and exact allowlisted Rust documentation." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Bad` witness and safe call are explicit, but the material Rust 1.82 safe-versus-unsafe-function rule is asserted without checked authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, bounds falsity, and UB text are stated, but R2's R1 valid-safe-use dependency remains unestablished." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It says `UNSOUND`, but that verdict depends on the incomplete R2 existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Identifies the exact Tail-only wrapping update and expressly notes that generic downstream use need not survive." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a nongeneric safe inherent operation selecting fixed element 1 with checked indexing and no implementer/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Details deletion of the trait/generic API, call-site migration, intentional downstream breakage, and the unreleased-change authorization." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "The sketch is correctly conditional and requires fresh audit, but R7's R3 dependency is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The `UNSOUND` conclusion lacks an authority-complete valid-safe-use link for the ordinary function call." + }, + { + "id": "G11", + "evidence": "The proof necessarily relies on unchecked Rust safe-function caller semantics while claiming only cited version-matched axioms." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented sketch is expressly denied a verdict and does not narrow the stated current-artifact claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "The TCB omits checked Rust 1.82 authority for the ordinary-versus-unsafe-function premise consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report shows no inspection beyond the supplied source and allowlisted documentation." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Gives a downstream `Bad` returning 2 and safe call, supported by exact 1.82 visibility, implementation, unsafe-trait, and unsafe-function rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Shows the call necessarily reaches index 2 on length 2, falsifies bounds, and applies the exact Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Reports current-artifact `UNSOUND` and explicitly excludes the redesign from that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "States the sole required operation is Tail's wrapping update of element 1 and that generic implementations need not remain." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Supplies a nongeneric safe function with fixed checked index 1 and removes all caller-controlled implementation/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains the authorized deletion and migration of the unreleased trait, marker, and generic calls, including downstream compile breakage." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Assigns no verdict to the unimplemented proposal and requires a fresh audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is expressly separated from current-artifact results and left uncertified." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact applicable Rust 1.82 authorities and their consumed propositions are identified." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No report evidence indicates access outside the supplied target and allowlisted sources." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Oob` witness is explicit, but caller safety for the ordinary `increment` function is asserted without the required checked Rust 1.82 function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The mechanical out-of-bounds/UB chain is complete, but its R1 valid-safe-use dependency is authority-incomplete." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The literal `UNSOUND` verdict rests on the incomplete dependent existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the fixed wrapping Tail operation and rejects any need to retain downstream genericity." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a specialized safe function using constant checked index 1 without a trait or caller-selected index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Clearly states the authorized unreleased contract deletion and exact migration away from downstream impls and generic calls." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It conditionally requires fresh audit, but the listed R3 prerequisite is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "Its `UNSOUND` certificate does not authoritatively establish that the ordinary generic call is a valid safe use." + }, + { + "id": "G11", + "evidence": "The TCB necessarily consumes an unchecked safe-versus-unsafe-function proposition absent from its authority inventory." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is labeled unimplemented, receives no verdict, and does not narrow the current claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`AX-ACCESS` is used to infer no caller-side unsafe obligation, but its cited visibility/implementation pages do not verify the required function rule." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Nothing in the report evidences prohibited external or evaluator-material inspection." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "It constructs the exact safe witness and verifies visibility/coherence/unsafe-trait rules, but not the material Rust 1.82 safe-function caller rule." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, false bounds, and applicable UB are shown, but R2 depends on the authority-incomplete R1 valid-use proof." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The report says `UNSOUND`, yet its required R2 certificate remains incomplete." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Precisely identifies Tail's wrapping element-1 update as the required behavior and disclaims required generic polymorphism." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Recommends the exact nongeneric safe fixed-index function with no caller-controlled implementer or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Describes deletion and call migration, intentional loss of downstream generic use, and authorization from unreleased status." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "The proposal is correctly conditional with fresh-audit instructions, but R7's R3 dependency is unsatisfied." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The affirmative `UNSOUND` result lacks a checked-authority basis for one material valid-safe-use link." + }, + { + "id": "G11", + "evidence": "The report necessarily relies on uncited Rust semantics to conclude the ordinary function call carries no safety obligation." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "It expressly calls the redesign a proposal, not a new-artifact verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`TCB-R182` omits checked Rust 1.82 safe-versus-unsafe-function authority consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The text shows review of only the supplied target and allowed versioned documentation." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs `OutOfBounds` returning 2 with a safe call and verifies all four required Rust 1.82 visibility and safety-boundary rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Proves execution at index 2 on length 2, the false `2 < 2` proposition, and the exact documented UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Reports current `UNSOUND` independently of both the Tail regional result and redesign." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "States the exact owned Tail wrapping behavior and that only this non-generic capability is required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Uses one nongeneric safe checked-index function and removes every caller-selected implementation/index surface." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains the authorized breaking deletion of `Slot`/`Tail` and migration from generic calls, with no downstream preservation promise." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Says the design is unimplemented and unaudited, then specifies a fresh post-implementation audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Current results are fixed before the explicitly unimplemented redesign." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report cites exact versioned authorities for visibility, impl legality, unsafe traits/functions, bounds UB, and wrapping." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Naming the supplied unsafe-Rust package is expressly in scope; no prohibited inspection is evidenced." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Provides `Bad`, return value 2, and the safe generic call, with exact Rust 1.82 visibility, impl, unsafe-trait, and unsafe-function support." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Shows the executed call receives out-of-bounds 2 for length 2 and applies the exact versioned UB contract." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Declares the current artifact `UNSOUND` and keeps the Tail result and redesign separate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the Tail-only modular element-1 update and explicitly treats generic downstream capability as removable." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a single nongeneric safe fixed-index function without trait, generic parameter, unsafe block, or caller index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "States the exact breaking migration and that removal is authorized because generic users need not be preserved and the API is unreleased." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Explicitly denies the proposal an artifact verdict and requires a fresh audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented redesign is kept wholly separate from the current-artifact verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "All material language and library premises are matched to exact applicable Rust 1.82 authorities." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No text evidences inspection outside the supplied source and allowed authority." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs `Outside` returning 2 and a safe call, backed by exact 1.82 visibility, impl, unsafe-trait, and unsafe-function rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Establishes reachability of index 2, out-of-bounds falsity for length 2, and the applicable Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Returns the literal current-artifact `UNSOUND` verdict independently of the design proposal." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Defines the minimum as the owned Tail wrapping increment of element 1, with no need for generic implementations or calls." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The safe nongeneric `Tail::increment` uses checked constant indexing and exposes no caller-controlled implementation/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains deletion of the generic trait/function, exact call migration, authorized downstream breakage, and unreleased status." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Labels the design unimplemented with no verdict and demands audit of the exact implemented snapshot." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The current verdict precedes and is declared independent of the explicitly unaudited proposal." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its exact versioned authority inventory covers every material current-artifact premise." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report itself shows no prohibited source or evaluator-material access." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "Although it gives `Bad` returning 2 and the call, it does not verify the required Rust 1.82 ordinary/unsafe trait and function safety-boundary rules." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The out-of-bounds reachability and UB consequence are established, but R2's R1 valid-safe-use dependency is not." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The `UNSOUND` verdict depends on the incomplete existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Accurately isolates the fixed Tail wrapping update and states that downstream generic use is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Replaces the generic unsafe path with a safe nongeneric fixed-index function and no caller-controlled capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Details the intentionally breaking migration and correctly ties authorization to the unreleased, non-preserved generic API." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It conditions the redesign on implementation and fresh audit, but the R3 dependency remains unmet." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The report issues `UNSOUND` without an authority-complete proof that both the impl and ordinary function call are valid safe use." + }, + { + "id": "G11", + "evidence": "Its proof necessarily relies on unchecked Rust trait/function safety-boundary semantics omitted from `TCB-R033`." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly not a verdict and is not used to alter the current claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "The TCB lists visibility/coherence and library contracts but omits checked unsafe-trait and unsafe-function rules consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No prohibited oracle, sibling, condition, prior-report, or evaluator access is evidenced." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Bad` implementation and call are explicit and trait authority is checked, but the safe-versus-unsafe-function premise for the call is not verified." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It proves mechanical reachability, false bounds, and UB, but depends on R1's unsupported safe-call validity premise." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The stated `UNSOUND` verdict lacks a complete R2 certificate under the frozen authority rule." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Identifies only the wrapping update of fixed element 1 as required and treats generic downstream surfaces as removable." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes the exact nongeneric safe checked-index operation with no caller-selected implementation or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains disappearance of trait/generic users, the concrete migration, and authorization from the unreleased contract." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It leaves the sketch unimplemented and requires fresh audit, but R7's prerequisite R3 is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The `UNSOUND` result lacks checked support for the valid-safe-call link in its existential certificate." + }, + { + "id": "G11", + "evidence": "The TCB necessarily relies on an unchecked ordinary-function caller-safety proposition." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is expressly unimplemented, unaudited, and independent of the current verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`TCB-R016-r1` omits the Rust 1.82 safe-function authority needed to establish that calling `increment` accepts no safety obligation." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report evidences no access outside the supplied scope and exact allowed documentation." + }, + "novel_findings": [] + } + ], + "ambiguities": [ + "R1 explicitly depends on the Rust 1.82 safe-versus-unsafe-function rules, but the rubric does not expressly say whether merely calling a syntactically ordinary `fn` safe verifies that rule. Under SCORER.md's material-premise rule, I treated an uncited assertion as insufficient.", + "The atom dependency fields do not explicitly state whether failure propagates mechanically. I treated each listed dependency as a material prerequisite, so an authority-invalid R1 also fails dependent R2, R3, and R7." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/attestation.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/attestation.json new file mode 100644 index 0000000000..f93c974856 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/attestation.json @@ -0,0 +1,10 @@ +{ + "agent_id": "/root/v4_score_r_s2", + "attempt": 1, + "disposition": "COMPLETE", + "identity": "R-s2", + "kind": "scorer", + "phase": "scoring", + "recorded_utc": "2026-08-02T00:44:19.982759Z", + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/raw-output-manifest.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/raw-output-manifest.json new file mode 100644 index 0000000000..0fe3924eed --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/raw-output-manifest.json @@ -0,0 +1,12 @@ +[ + { + "path": ".", + "type": "directory" + }, + { + "bytes": 26719, + "path": "score.json", + "sha256": "ad35d444b56e37377ddc62292f8aaae8924127adc72f8f4c970ae2b54526832f", + "type": "file" + } +] diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/raw-output/score.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/raw-output/score.json new file mode 100644 index 0000000000..4f062c910c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/evaluator-attempts/scoring/R-s2/1/raw-output/score.json @@ -0,0 +1,595 @@ +{ + "schema_version": 1, + "mode": "R", + "scorer_id": "s2", + "reports": [ + { + "label": "H", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F1 constructs downstream OutOfBounds, a safe Slot impl returning 2, and increment::; it verifies visibility, coherence, unsafe-trait, and unsafe-function rules at Rust 1.82 URLs." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F1 traces the call to get_unchecked_mut(2) on length 2, states 2 < 2 is false, and cites the Rust 1.82 out-of-bounds-call UB rule." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It labels SOUND-CURRENT as UNSOUND over D and explicitly says no proposal below affects that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the required Tail behavior as element-1 wrapping increment and says downstream generic use is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The recommended pub fn increment directly uses pair[1].wrapping_add(1), with no generic parameter, implementer capability, or unsafe block." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Migration deletes Slot and Tail, changes increment:: to increment, and explains that the unreleased API permits downstream generic uses to stop compiling." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the design is not implemented and has no audit verdict, then requires a fresh audit of the exact implemented snapshot." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is expressly unimplemented, is not used in the current UNSOUND verdict, and is conditioned on fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The material Rust premises are tied to applicable, versioned Rust 1.82 Reference and standard-library URLs; no extra TCB assumption is consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines its snapshot to the supplied source/package basis and contains no evidence of prohibited evaluation-material access." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F1 gives Bad, a downstream-local safe Slot impl returning 2, and a safe increment:: call, with versioned visibility, coherence, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F1 proves execution of get_unchecked_mut(2), that element 2 is out of bounds for length 2, and the cited Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "The current-artifact verdict is UNSOUND and is explicitly declared independent of the redesign." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It isolates the crate-owned Tail result [a, b.wrapping_add(1)] and states that the authorized requirement is narrower than generic downstream behavior." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Its preferred nongeneric safe function writes pair[1] with wrapping_add and removes the trait, marker, caller index selection, and unsafe operation." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains deletion of Slot and Tail, the call-site migration, and that breaking downstream implementations/generic calls is authorized for this unreleased abstraction." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the proposal is not implemented and has no artifact verdict, preserves the current verdict, and specifies a fresh post-implementation audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is expressly separated from the current UNSOUND result and left unaudited pending implementation and fresh review." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its witness and Tail proof cite the applicable versioned Rust 1.82 visibility, implementation, unsafe-boundary, slice, and wrapping authorities." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It limits the snapshot to target/lib.rs and disclaims prior results and execution; no prohibited evaluator or sibling material is evidenced." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "W1 supplies downstream Outside, a safe Slot impl returning 2, and increment::, backed by Rust 1.82 visibility, orphan, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "W1 shows the safe call reaches line 16 with index 2, establishes it is out of bounds for length 2, and cites the exact Rust 1.82 UB rule." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "The table reports the current public API UNSOUND and the prose says this verdict is independent of the proposal." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "The redesign section identifies the minimum capability as the fixed Tail operation: wrapping element 1 while leaving element 0 unchanged, without caller-selected indexing." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Tail::increment is nongeneric and safe, uses checked pair[1] indexing, and exposes no caller implementation or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It specifies deletion of Slot and generic increment, the Tail::increment call migration, and the expressly authorized downstream source break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Fresh-audit status calls the redesign unimplemented, assigns it no verdict, and lists the exact obligations to audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report does not certify the sketch and keeps it separate from the current-artifact UNSOUND result." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "All material language and library premises are linked to applicable Rust 1.82 pages, including the unsafe-function boundary." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states that only the supplied 18-line target was audited and shows no inspection of prohibited evaluation material." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F-UB constructs Bad returning 2 and the safe generic call, with exact Rust 1.82 visibility, orphan, unsafe-trait, and unsafe-function/unsafe-block authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F-UB traces index 2 into get_unchecked_mut on the length-two array, states the bounds proposition is false, and links AX-GET's explicit UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It reports every required safe use as refuted by an UNSOUND witness and states the redesign does not participate in that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It extracts the sole required operation as Tail's element-1 modular increment and rejects caller-controlled generic indexing as unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The preferred design is a nongeneric safe increment using pair[1].wrapping_add(1), with no implementer or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Migration deletes Slot, Tail, and genericity, explains the call rewrite, and invokes the request's authorization for the unreleased source break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It assigns no verdict to the unimplemented proposal and requires a fresh audit of exports, indexing, postconditions, and configuration coverage." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report explicitly excludes the redesign from current-artifact verdicts and requires implementation plus fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AX-VIS, AX-IMPL, AX-BOUNDARY, AX-GET, and AX-WRAP are all tied to applicable versioned Rust 1.82 authority." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report describes only the supplied lib.rs and allowed Rust authorities and evidences no prohibited source access." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The OutOfBounds witness and visibility/orphan/unsafe-trait citations are present, but the claim that calling ordinary increment is safe lacks the explicitly required Rust 1.82 safe-versus-unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It correctly states reachability, 2 < 2 falsity, and AX-GET UB, but R2 depends on R1 and the witness's safe-call validity is not fully verified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It says the current API is UNSOUND and proposal-independent, but R3 depends on the incomplete R2 existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It states that only the crate-owned Tail behavior is required: element 1 gets wrapping addition and generic downstream use need not remain." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The proposed safe nongeneric increment fixes index 1 and removes Slot, implementations, genericity, and unsafe code." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains the increment:: to increment migration and says downstream generic uses intentionally disappear under the authorized unreleased-API change." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "The design is expressly not a new verdict, does not alter current UNSOUND, and is conditioned on an exact-snapshot fresh audit." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND while the valid-safe-use link is incomplete: ordinary-function call safety is asserted without the required version-matched Rust authority." + }, + { + "id": "G11", + "evidence": "Its certificate necessarily relies on an unchecked safe-versus-unsafe-function premise omitted from the cited Rust 1.82 authority set." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is labeled a design rather than an artifact verdict and fresh audit is required." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-R182 claims the semantic premises are the cited authorities, but no Rust 1.82 unsafe-function authority supports the material assertion that increment's call carries no unsafe obligation." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines itself to the supplied target and permitted Rust documentation; no prohibited evaluator, sibling, or prior-report access is visible." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F-1 constructs downstream Bad returning 2 and a safe increment:: call, with versioned visibility, orphan, unsafe-trait, and unsafe-function rules in AX-PUBLIC/IMPL and AX-SAFE-BOUNDARY." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F-1 proves get_unchecked_mut(2) is reached on length 2, that index 2 is invalid, and that AX-GET makes the call itself UB." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It reports both safe-API and combined current-artifact results as UNSOUND and keeps the redesign independent." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the only required capability as Tail's wrapping element-1 update and says no generic downstream capability must survive." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The preferred safe function is nongeneric, fixes pair[1], and removes the trait, marker type, unsafe operation, and caller-controlled index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It details removal of Slot/Tail and the call rewrite, explaining that the request authorizes this unreleased contract and representation break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It states the proposal has no artifact verdict and requires a new-snapshot audit without changing the current UNSOUND conclusion." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented redesign is not certified or used to narrow the current obligation, and a fresh audit is required." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The authority set includes applicable Rust 1.82 visibility, coherence, unsafe-trait/function, slice-UB, and wrapping-add rules." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states the artifact is exactly the supplied lib.rs and contains no evidence of prohibited material inspection." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "FIND-1 gives Oob returning 2 and a purported safe call, but the authority inventory never verifies Rust 1.82's safe-versus-unsafe-function rule for calling increment without unsafe." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, equality with len, and AX-GET UB are stated, but R2 depends on R1 and the valid-safe-use premise remains unverified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It reports current UNSOUND independently of the proposal, but R3 depends on the incomplete R2 certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the fixed Tail wrapping update as the stated requirement and says genericity is unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "increment_tail is a safe nongeneric function using pair[1], with no Slot implementation or caller index authority." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "The migration removes Slot, Tail, and generic calls, and explains that this source break is authorized because the API is unreleased." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "The redesign is explicitly not a verdict, leaves current UNSOUND unchanged, and requires a fresh audit after implementation." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND without a fully verified valid-safe-use link because safe ordinary-function calling semantics are unsupported by its authority set." + }, + { + "id": "G11", + "evidence": "The report necessarily relies on the unchecked proposition that the non-unsafe increment declaration is callable without an unsafe obligation." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly unimplemented, unaudited, and independent of the current verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-1 lists visibility, implementation, slice, and wrapping authorities but omits the material Rust 1.82 safe-versus-unsafe-function authority used by FIND-1." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report limits itself to the supplied source and versioned Rust documentation and shows no prohibited evaluation-material access." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F-1 constructs Bad returning 2 and asserts that the impl and increment call are safe, but TCB-R033 cites no Rust 1.82 safe-versus-unsafe-function authority for the call premise." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It establishes reachability, the false 2 < 2 bound, and the slice UB consequence, but dependency R1 fails because safe-call validity is not fully verified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The literal current verdict is UNSOUND and proposal-independent, but its required R2 certificate is incomplete through failed R1." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It extracts only a concrete wrapping increment of element 1 and rejects preserving generic implementations as unneeded." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The proposed pub fn increment uses safe pair[1] indexing and wrapping_add with no generic or caller-controlled capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains removal of Slot/Tail, the generic-to-nongeneric call migration, and the authorization to break this unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the proposal is not a new verdict and requires a fresh audit of the implemented snapshot and migrated callers." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND although one required existential link, valid safe calling of increment, is asserted without the required version-matched authority." + }, + { + "id": "G11", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics absent from TCB-R033." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposed design is not certified and is separated from the current result pending fresh audit." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-R033 includes visibility, trait implementation, slice, and wrapping authorities but omits authority for its material assertion that increment is safely callable." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reviews the exact supplied lib.rs and permitted Rust pages, with no visible access to prohibited materials." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F-UB constructs Bad returning 2 and cites visibility, coherence, and unsafe-trait rules, but its claim that the increment call carries no unsafe obligation lacks Rust 1.82 unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It proves the call reaches get_unchecked_mut(2), falsifies bounds, and cites UB, but R2's R1 dependency is incomplete because safe-call validity is unverified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It expressly reports current UNSOUND independently of redesign, but R3 depends on the incomplete existential certificate in R2." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It states the required effect is [a, b.wrapping_add(1)] and that the requirement needs no genericity." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The safe nongeneric increment fixes pair[1] and removes Slot, Tail, the type parameter, unsafe code, and caller index control." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It details the increment:: call rewrite and explains that removal of downstream implementations/generic calls is authorized for the unreleased abstraction." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It labels the sketch unimplemented with no audit verdict, preserves current UNSOUND, and requires a fresh snapshot audit." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND without fully verifying the valid-safe-use link; the ordinary-function call premise has no applicable cited authority." + }, + { + "id": "G11", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics omitted from TCB-R016-r1." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The report does not certify or rely on the redesign and explicitly requires implementation followed by fresh audit." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "Its TCB names visibility, implementation, unsafe-trait, slice, and wrapping axioms but omits the safe-versus-unsafe-function rule material to calling increment safely." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines the review to supplied lib.rs/REQUEST context and allowed Rust documentation; no prohibited material inspection is visible." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F1 gives downstream Bad returning 2 and cites visibility, orphan, and unsafe-trait rules, but the assertion that the increment call is safe lacks the required Rust 1.82 safe-versus-unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The report states reachability, out-of-bounds falsity, and the exact UB consequence, but R2 depends on R1's unverified safe-call premise." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It reports the current artifact UNSOUND and keeps redesign separate, but R3's required R2 certificate remains incomplete." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the required Tail result as wrapping element 1 while preserving element 0, with generic downstream behavior expressly unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Tail::increment is a safe nongeneric checked specialization with fixed index 1 and no caller implementation or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains removing Slot and generic increment, migrating to Tail::increment, and the authorized break for downstream generic users of the unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It tells the reader not to regard the sketch as audited or PROVED and requires a new exact-snapshot audit after implementation." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND with an incompletely verified valid-safe-use link because safe ordinary-function calling semantics are not sourced." + }, + { + "id": "G11", + "evidence": "The certificate necessarily relies on unchecked safe-versus-unsafe-function authority absent from TCB-0." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is explicitly unaudited and does not alter the current-artifact conclusion." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-0 cites visibility, implementation, unsafe-trait, slice, and wrapping propositions but omits authority for the material safe-function call premise." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports source-only review of the supplied target and allowed authority, without evidence of prohibited evaluation-material access." + }, + "novel_findings": [] + } + ], + "ambiguities": [ + "The rubric does not state whether directly classifying a plain fn from source syntax alone verifies the listed safe-versus-unsafe-function dependency. I treated that material Rust semantic premise as requiring applicable Rust 1.82 authority, consistent with the frozen authority rule." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/B.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/B.json new file mode 100644 index 0000000000..5d19e0b3b9 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/B.json @@ -0,0 +1,283 @@ +{ + "confirmed_novel_findings": [], + "mode": "B", + "reports": [ + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "FAIL", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "FAIL", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "A", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "PASS", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "FAIL", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "B", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "FAIL", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "PASS", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "C", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "PASS", + "B3": "FAIL", + "B4": "FAIL", + "B5": "PASS", + "B6": "PASS", + "B7": "PASS", + "B8": "FAIL", + "B9": "PASS" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "D", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "PASS", + "B11": "PASS", + "B12": "PASS", + "B13": "PASS", + "B14": "PASS", + "B15": "PASS", + "B2": "PASS", + "B3": "PASS", + "B4": "PASS", + "B5": "PASS", + "B6": "PASS", + "B7": "PASS", + "B8": "PASS", + "B9": "PASS" + }, + "hard_errors": [], + "label": "E", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "FAIL", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "PASS", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "F", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "FAIL", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "FAIL", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "G", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "FAIL", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "FAIL", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "H", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "FAIL", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "FAIL", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "I", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "B1": "PASS", + "B10": "FAIL", + "B11": "FAIL", + "B12": "FAIL", + "B13": "FAIL", + "B14": "FAIL", + "B15": "FAIL", + "B2": "FAIL", + "B3": "FAIL", + "B4": "FAIL", + "B5": "FAIL", + "B6": "FAIL", + "B7": "PASS", + "B8": "FAIL", + "B9": "FAIL" + }, + "hard_errors": [ + "G5", + "G11", + "BH7" + ], + "label": "J", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + } + ], + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/L.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/L.json new file mode 100644 index 0000000000..60108efd96 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/L.json @@ -0,0 +1,215 @@ +{ + "confirmed_novel_findings": [], + "mode": "L", + "reports": [ + { + "atoms": { + "L1": "PASS", + "L10": "PASS", + "L11": "PASS", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "PASS" + }, + "hard_errors": [], + "label": "A", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "FAIL", + "L11": "FAIL", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "PASS" + }, + "hard_errors": [ + "G1" + ], + "label": "B", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "PASS", + "L11": "PASS", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "PASS" + }, + "hard_errors": [], + "label": "C", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "FAIL", + "L11": "FAIL", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "PASS" + }, + "hard_errors": [], + "label": "D", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "FAIL", + "L11": "FAIL", + "L2": "PASS", + "L3": "FAIL", + "L4": "FAIL", + "L5": "PASS", + "L6": "FAIL", + "L7": "PASS", + "L8": "FAIL", + "L9": "FAIL" + }, + "hard_errors": [ + "G11", + "LH4" + ], + "label": "E", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "FAIL", + "L11": "FAIL", + "L2": "PASS", + "L3": "PASS", + "L4": "FAIL", + "L5": "PASS", + "L6": "FAIL", + "L7": "PASS", + "L8": "FAIL", + "L9": "FAIL" + }, + "hard_errors": [ + "G11", + "LH4" + ], + "label": "F", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "FAIL", + "L11": "FAIL", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "FAIL" + }, + "hard_errors": [], + "label": "G", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "PASS", + "L11": "PASS", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "PASS" + }, + "hard_errors": [], + "label": "H", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "FAIL", + "L11": "FAIL", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "PASS" + }, + "hard_errors": [], + "label": "I", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "L1": "PASS", + "L10": "FAIL", + "L11": "FAIL", + "L2": "PASS", + "L3": "PASS", + "L4": "PASS", + "L5": "PASS", + "L6": "PASS", + "L7": "PASS", + "L8": "PASS", + "L9": "PASS" + }, + "hard_errors": [], + "label": "J", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + } + ], + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/P.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/P.json new file mode 100644 index 0000000000..c201bf1f25 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/P.json @@ -0,0 +1,371 @@ +{ + "confirmed_novel_findings": [], + "mode": "P", + "reports": [ + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "A", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "B", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "C", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "D", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "E", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "F", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "G", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "FAIL", + "P10": "PASS", + "P11": "PASS", + "P12": "FAIL", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "FAIL", + "P19": "FAIL", + "P2": "FAIL", + "P20": "FAIL", + "P21": "PASS", + "P22": "FAIL", + "P23": "FAIL", + "P24": "FAIL", + "P25": "PASS", + "P26": "FAIL", + "P27": "FAIL", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [ + "G11", + "PH4", + "PH5" + ], + "label": "H", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "I", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "P1": "PASS", + "P10": "PASS", + "P11": "PASS", + "P12": "PASS", + "P13": "PASS", + "P14": "PASS", + "P15": "PASS", + "P16": "PASS", + "P17": "PASS", + "P18": "PASS", + "P19": "PASS", + "P2": "PASS", + "P20": "PASS", + "P21": "PASS", + "P22": "PASS", + "P23": "PASS", + "P24": "PASS", + "P25": "PASS", + "P26": "PASS", + "P27": "PASS", + "P3": "PASS", + "P4": "PASS", + "P5": "PASS", + "P6": "PASS", + "P7": "PASS", + "P8": "PASS", + "P9": "PASS" + }, + "hard_errors": [], + "label": "J", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + } + ], + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/Q.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/Q.json new file mode 100644 index 0000000000..28ccd76964 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/Q.json @@ -0,0 +1,147 @@ +{ + "confirmed_novel_findings": [], + "mode": "Q", + "reports": [ + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "A", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "B", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "C", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "D", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "E", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "F", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "G", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "H", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "I", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "Q1": "PASS", + "Q2": "PASS", + "Q3": "PASS", + "Q4": "PASS", + "Q5": "PASS" + }, + "hard_errors": [], + "label": "J", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + } + ], + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/R.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/R.json new file mode 100644 index 0000000000..91ab58f1d3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/final/R.json @@ -0,0 +1,182 @@ +{ + "confirmed_novel_findings": [], + "mode": "R", + "reports": [ + { + "atoms": { + "R1": "FAIL", + "R2": "FAIL", + "R3": "FAIL", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "FAIL" + }, + "hard_errors": [ + "G5", + "G11" + ], + "label": "A", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "PASS", + "R2": "PASS", + "R3": "PASS", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "PASS" + }, + "hard_errors": [], + "label": "B", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "PASS", + "R2": "PASS", + "R3": "PASS", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "PASS" + }, + "hard_errors": [], + "label": "C", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "FAIL", + "R2": "FAIL", + "R3": "FAIL", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "FAIL" + }, + "hard_errors": [ + "G5", + "G11" + ], + "label": "D", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "PASS", + "R2": "PASS", + "R3": "PASS", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "PASS" + }, + "hard_errors": [], + "label": "E", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "FAIL", + "R2": "FAIL", + "R3": "FAIL", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "FAIL" + }, + "hard_errors": [ + "G5", + "G11" + ], + "label": "F", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "FAIL", + "R2": "FAIL", + "R3": "FAIL", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "FAIL" + }, + "hard_errors": [ + "G5", + "G11" + ], + "label": "G", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "PASS", + "R2": "PASS", + "R3": "PASS", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "PASS" + }, + "hard_errors": [], + "label": "H", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "PASS", + "R2": "PASS", + "R3": "PASS", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "PASS" + }, + "hard_errors": [], + "label": "I", + "proposal_laundering": false, + "tcb_authority_defect": false, + "visible_scope_defect": false + }, + { + "atoms": { + "R1": "FAIL", + "R2": "FAIL", + "R3": "FAIL", + "R4": "PASS", + "R5": "PASS", + "R6": "PASS", + "R7": "FAIL" + }, + "hard_errors": [ + "G5", + "G11" + ], + "label": "J", + "proposal_laundering": false, + "tcb_authority_defect": true, + "visible_scope_defect": false + } + ], + "schema_version": 1 +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/PACKET.json new file mode 100644 index 0000000000..0c24baa998 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "7124ac918b5595c9eaa594511309d8ac1a2400456695cd3004db76f14d18ec21", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "B", + "presentation_order": [ + "H", + "A", + "C", + "G", + "F", + "D", + "B", + "E", + "J", + "I" + ], + "report_sha256": { + "A": "fad0c995d3639d93a74d17be5c17ee86615a76ffca5ae9b91756e8a77834b1fe", + "B": "ca2e2fe0e2096c3fb6629d6d97067dba5125aedf7d74c14710bdfe4f20953351", + "C": "481bdce1f650e4b9ffc1242fccb53adb23bd33ed200d6971ed40fb3e944e067f", + "D": "e3283ae8b81a126762ee59cdd8108681311618dc8b848256daa4c49cfd1ae78c", + "E": "79d94306111d77ca7b72fe0d5bc780e96009c10285753a0979c7e926977cefc8", + "F": "dfcd89377ba31227e0ed7bb9ae4926eca117678182f14ef3f26fe5e929b2b57d", + "G": "a556b26d30da7f48af3bdb4f1962a532142a7555215e6df0fb731896ecdcf164", + "H": "bea0082d313d7bc237a2b754a983410e62d437aecef9bec717b7014d0b618e41", + "I": "5b414f1c8097099ebfe625ec880d4aa0da01a46617e5712419912ed230ccffbe", + "J": "d3ed478991945f13610c6cf0b2dbde59dbe68b37afcf9c456e17a78197a8d6bf" + }, + "rubric_sha256": "13790584d0e5ede69cff8c2b1889be80c73df0722c4ea709c0e85ab82900a4bb", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s1", + "target_byte_tree_sha256": "7589027142112e387f990314df7eb1d08e5464448566fd68048eb2a748635bf3" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/RUBRIC.md new file mode 100644 index 0000000000..c5371528bf --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/RUBRIC.md @@ -0,0 +1,483 @@ +# Mode B Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material.** Never expose this file, its atoms, formulas, +> expected verdicts, hard errors, or authority inventory to a report agent. + +## Scoring Rules + +Score the proposition of each atom, not its notation or presentation. Accept an +explicit equivalent derivation. Do not infer an omitted build stage, failure +edge, source-selection step, or semantic premise from an endpoint summary. +Failure of an atom is not itself a hard error unless the report also makes the +false affirmative claim identified below. + +This fixture deliberately requests a maximal positive region. That request, +not a general audit convention, makes exactness and maximality part of B13. +There is no scoring requirement for incidental diagnostics, exact panic text, +partially written bytes within one failed `println!`, or build-script stdout +which does not affect a current library selection. + +## Intended Domain and Build Relation + +Let: + +```text +R = { Rust and Cargo 1.85.1 } +T = { X = x86_64-unknown-linux-gnu, + A = aarch64-unknown-linux-gnu, + W = wasm32-unknown-unknown } +F = { burst-off, burst-on } +L = { system, arena } +P = every Cargo profile supported by the fixture +D = { debug-assertions-off, debug-assertions-on } +I = { i | i is any u8 } + +Config(t,f,l,p,d) + iff t in T and f in F and l in L and p in P and d in D + and not (t = W and l = arena). + +Required = R cross Config cross I. +Q(t,f,l) iff t = A and f = burst-on and l = arena. +``` + +Both allocator values in `Config` are reachable through the supported Cargo +interface: an omitted selector or `system` selects `system`, and `arena` +selects `arena`. Raw rejected selector values and unsuccessful build attempts +are build-relation cases that must be accounted for, but they do not add a +library configuration to `Required`. + +For compactness, use these local operations: + +```text +RERUN = attempt println!("cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR") +READ = evaluate env::var("FIXTURE_ALLOCATOR") +SYS = attempt println!("cargo::rustc-cfg=fixture_allocator=\"system\"") +ARENA = attempt println!("cargo::rustc-cfg=fixture_allocator=\"arena\"") +PANIC = the selected explicit panic, or the panic caused by a failed println! +RETURN = successful return from main +``` + +The complete claim-relevant local relation is: + +```text +missing: RERUN -> READ(NotPresent) -> SYS -> RETURN +Unicode system: RERUN -> READ(Ok(system)) -> SYS -> RETURN +Unicode arena: RERUN -> READ(Ok(arena)) -> ARENA -> RETURN +Unicode arena-stop: + RERUN -> READ(Ok(arena-stop)) -> ARENA -> PANIC +other Unicode: RERUN -> READ(Ok(other)) -> PANIC +non-Unicode: RERUN -> READ(NotUnicode) -> PANIC +``` + +Every arrow after a `println!` assumes that write succeeds. If `RERUN` fails, +it panics before `READ`, and no complete earlier directive is required. If +`SYS` or `ARENA` fails, `RERUN` is the material completed prefix and the script +panics before `RETURN` or the explicit `arena-stop` panic. If `ARENA` succeeds +on `arena-stop`, the material completed prefix is `[RERUN, ARENA]`, followed by +the explicit panic. Under exact accepted entry `BUILD-MAP-ORDERED`, every panic is an +unsuccessful script exit and produces no current library compilation, +regardless of completed prefix. + +On the three successful selector paths, `BUILD-MAP-ORDERED` interprets the final +allocator line as exactly one matching library cfg. Cargo's accepted feature +and target mappings, followed by the Rust conditional-compilation rules, +select the library source. The `W`/`arena` combination selects +`compile_error!`, so it does not produce a library and is genuinely outside +`Config`. The supported `Q` cell selects the first `lane_id` body and removes +the complementary checked body. + +A prior successful `arena` build necessarily completed `RERUN` before +`ARENA`. After the raw selector changes to `arena-stop`, `BUILD-MAP-ORDERED` makes +that prior selection stale, reruns the script, and refuses to present the old +library as the result of the current unsuccessful execution. Thus the +freshness canary is an effective rejection even though its current output +prefix includes the same arena cfg line. + +## Expected Source Results + +The exact maximal sound region requested by the target is: + +```text +SoundRegion = { case in Required | not Q(case) or case.i != 0 }. +``` + +Outside `Q`, the selected body panics when `i == 0`; reaching +`new_unchecked(i)` therefore implies `i != 0`. Inside `Q`, the selected body +calls `new_unchecked` without a check, so nonzero inputs are sound and zero is +not. The complement of `SoundRegion` within `Required` consists exactly of +`Q` with `i == 0` (for every supported profile and debug-assertion state). + +The safe call `lane_id(0)` in any `Q` case reaches +`NonZeroU8::new_unchecked(0)`. Its exact safety proposition is false, and the +Rust 1.85.1 standard-library contract states that zero produces undefined +behavior. Safe-API soundness over all of `Required` is therefore **UNSOUND +relative to `BUILD-MAP-ORDERED`**. + +For the documented zero-input panic postcondition: + +```text +RequiredPanic = { case in Required | case.i = 0 } +CoveredPanic = { case in RequiredPanic | not Q(case) }. +``` + +The regional theorem over `CoveredPanic` is **PROVED relative to +`BUILD-MAP-ORDERED`**. The whole `RequiredPanic` theorem is **UNPROVED**, not +`CONTRACT-BROKEN`: the only missing cases are executions already shown to +contain UB, so their apparent absence of an earlier panic is not a defined +behavioral counterexample. + +## Atoms + +- **B1 — Exact supported case predicate:** The report states a predicate + equivalent to `Required`, including Rust/Cargo 1.85.1, all three targets, + both feature states, both allocator models, every supported Cargo profile, + both debug-assertion states, every `u8`, and only the `W`/`arena` policy + exclusion. + - `scope_basis`: `Cargo.toml`, `SUPPORT.md`, and `BUILD.md`. + - `dependencies`: none; this is the theorem root. + - `accepted_alternatives`: symbolic products or a proved equivalent partition; no + Cartesian enumeration is required. + - `hard_errors`: omission + alone fails B1; claiming a whole-domain affirmative result over a contracted + predicate triggers BH1. + +- **B2 — Exhaustive raw-selector partition:** The report proves that the raw + environment domain is exactly missing, Unicode `system`, Unicode `arena`, + Unicode `arena-stop`, every other Unicode string, and every non-Unicode + value, with no seventh `env::var` outcome. + - `scope_basis`: `BUILD.md`, the + exact `env::var`/`VarError` contracts, and the outer and inner matches. + - `dependencies`: independent of B1; it supplies the cases used + by B3–B7. + - `accepted_alternatives`: any disjoint exhaustive partition that + preserves these behaviorally distinct classes. + - `hard_errors`: + omission alone fails B2; calling an incomplete partition complete and using + it for build closure triggers BH2. + +- **B3 — Complete system-success trace:** Conditional on its two writes + succeeding, each of the missing and Unicode-`system` classes follows exactly + `RERUN -> READ -> SYS -> RETURN`; it emits no arena cfg. + - `scope_basis`: the + ordered statements, `env::var`, match/pattern semantics, `String::as_str`, + and `println!`. + - `dependencies`: B2 identifies the two raw cases; + this is a local-source proposition and does not consume Cargo mapping. + - `accepted_alternatives`: combine the two classes after proving their + identical trace. + - `hard_errors`: omission alone fails B3; an + incompatible endpoint used for closure triggers BH2. + +- **B4 — Complete arena-success trace:** Conditional on its two writes + succeeding, Unicode `arena` follows exactly + `RERUN -> READ -> ARENA -> RETURN`; it emits no system cfg. + - `scope_basis`: + the same local Rust contracts as B3. + - `dependencies`: B2; this + trace is the reachability root for B8–B12. + - `accepted_alternatives`: an + equivalent state-transition row or prose proof. + - `hard_errors`: + omission alone fails B4; an incompatible endpoint used for closure triggers + BH2. + +- **B5 — `arena-stop` partial-prefix exit:** With successful writes, Unicode + `arena-stop` follows exactly + `RERUN -> READ -> ARENA -> PANIC`, so `[RERUN, ARENA]` is a completed output + prefix but the script does not return successfully and, under + `BUILD-MAP-ORDERED`, produces no current library compilation. + - `scope_basis`: + `BUILD.md`, local match/`println!`/`panic!` semantics, and only the exact + unsuccessful-exit proposition of `BUILD-MAP-ORDERED`. + - `dependencies`: + B2; this is distinct from a failed allocator write in B7. + - `accepted_alternatives`: notation may differ, but both ordered lines, the later panic, + and no-current-library consequence must appear. + - `hard_errors`: + omission alone fails B5; treating the partial arena line as a current + successful selector triggers BH4. + +- **B6 — Pre-allocator rejection traces:** Every other Unicode value and every + non-Unicode value follows `RERUN -> READ -> PANIC` after a successful rerun + write, so `[RERUN]` is its completed directive prefix; it attempts no + allocator cfg and produces no current library compilation under + `BUILD-MAP-ORDERED`. + - `scope_basis`: the wildcard and `NotUnicode` arms plus + the exact build premise. + - `dependencies`: B2; the two classes may + share an outcome only after both are accounted for. + - `accepted_alternatives`: + separate rows or one proved union. + - `hard_errors`: omission alone + fails B6; treating either class as an accepted allocator/configuration + triggers BH5. + +- **B7 — Stdout-failure edges:** The report accounts for failure of every + claim-relevant `println!`: failed `RERUN` panics before `READ`; failed `SYS` + or `ARENA` panics with completed prefix `[RERUN]`; and all such unsuccessful + exits produce no current library compilation under `BUILD-MAP-ORDERED`. It does + not require atomic line writes or assign meaning to an incomplete line. + - `scope_basis`: the exact `println!` Panics section, source order, + `panic!`'s main-thread result, and the accepted process-status proposition. + - `dependencies`: B3–B5 identify allocator-write sites; B7 is the + failure completion of those traces. + - `accepted_alternatives`: a single + quantified failure rule is preferred and passes if its instantiations are + readily checkable. + - `hard_errors`: omission alone fails B7; + claiming complete build coverage while a material failure edge supplies a + contrary current artifact triggers BH2 or BH4 as applicable. + +- **B8 — Successful Cargo-to-source selector mapping:** Only the successful + B3/B4 returns supply a current library compilation; Cargo interprets their + exact allocator line as exactly the corresponding `fixture_allocator` + key/value, maps the requested feature and target as admitted, and Rust cfg + rules select source from those resulting predicates. The report keeps + `BUILD-MAP-ORDERED` conspicuous and does not infer local output or Rust semantics + from it. + - `scope_basis`: B3/B4, exact `BUILD-MAP-ORDERED`, the reviewed Cargo + directive contracts, and versioned Rust cfg semantics. + - `dependencies`: B3 through B7. + - `accepted_alternatives`: a relational composition + or explicit stage-by-stage prose. + - `hard_errors`: silently + widening the accepted mapping triggers BH3; treating an unsuccessful prefix + as successful triggers BH4. + +- **B9 — Rerun/freshness theorem:** A prior successful `arena` build completed + `RERUN` before `ARENA`; changing the same target directory's raw selector to + `arena-stop` makes that selection stale, causes a new script run, and yields + no library for the current rejected build rather than reusing the prior arena + library. + - `scope_basis`: local B4/B5 order and precisely the rerun/staleness + proposition accepted in `BUILD-MAP-ORDERED`, reviewed against Cargo's + `rerun-if-env-changed` contract. + - `dependencies`: B4, B5, and the + no-library exit consequence. + - `accepted_alternatives`: a more general proof + for every accepted-to-rejected value change passes if it includes this + requested sequence. + - `hard_errors`: omission alone fails B9; + claiming this current build succeeds from the stale or partial arena output + triggers BH4. + +- **B10 — Effective wasm32/arena exclusion:** For either feature state and all + profiles/debug states, accepted `arena` selection plus the admitted wasm32 + target mapping makes both predicates of the library's first cfg true; Rust + `all` and cfg-attribute semantics therefore retain `compile_error!`, whose + contract makes compilation fail. No `W`/`arena` case is in `Required` or is + used as the UB witness. + - `scope_basis`: `SUPPORT.md`, B8, exact configuration + predicate and attribute semantics, and `compile_error!`. + - `dependencies`: B8. + - `accepted_alternatives`: any parametric proof covering both + feature states and all `P x D`. + - `hard_errors`: calling this pair + supported, using it as a valid-use witness, or asserting rejection without + the selected `compile_error!` proof triggers BH5. + +- **B11 — Exact library-body partition:** The report proves that the unchecked + first body is retained and the complementary checked body removed exactly in + `Q`, while the checked body is retained and the first body removed exactly + outside `Q`. In `Q`, B8 supplies `target_arch="aarch64"`, + `feature="burst"`, and `fixture_allocator="arena"`; Rust's key/value, `all`, + `not`, and cfg-attribute rules establish both directions of the partition. + - `scope_basis`: B8 and the exact versioned cfg propositions. + - `dependencies`: B4 and B8; this is the source-reachability edge for B12/B13. + - `accepted_alternatives`: expansion of the two cfg predicates or an + equivalent Boolean proof. + - `hard_errors`: omission alone fails + B11; declaring the supported unsafe branch unreachable by ignoring generated + cfgs triggers BH6. + +- **B12 — Existential UB certificate and verdict:** The report identifies the + well-typed safe call `lane_id(0)` in a supported `Q` case, uses B11 to reach + `NonZeroU8::new_unchecked(0)`, states that its exact nonzero safety + proposition is false, applies the Rust 1.85.1 zero-UB consequence, and reports + whole-`Required` soundness **UNSOUND relative to `BUILD-MAP-ORDERED`**. + - `scope_basis`: the public safe API, B1, B11, and the exact std contract. + - `dependencies`: B1 and B11. + - `accepted_alternatives`: any one supported + profile/debug state is enough for the existential certificate; proving all + such states is also correct. + - `hard_errors`: an incomplete + certificate followed by `UNSOUND`, or failure to issue `UNSOUND` after giving + every link, triggers BH7. + +- **B13 — Exact maximal sound region:** The report proves both containments for + `SoundRegion = { case in Required | !Q or i != 0 }`: every included case is + sound (the checked body dominates its unsafe call outside `Q`, and nonzero + directly satisfies the unsafe precondition inside `Q`), while every excluded + Required case is exactly `Q`/zero and has B12's UB execution. It labels this + the exact maximal source-level region relative to `BUILD-MAP-ORDERED`. + - `scope_basis`: the user-requested maximal theorem, B1, B11/B12, `if`/comparison/ + panic semantics, and `new_unchecked`. + - `dependencies`: B1, B8, + B11, B12. + - `accepted_alternatives`: an algebraically equivalent formula or + disjoint partition; a correct non-maximal remainder does not pass this + explicitly requested atom. + - `hard_errors`: omission or refusal to + maximize alone fails B13; calling a region maximal while including Q/zero, + excluding sound Q/nonzero cases, or excluding all of `Q` triggers BH8. + +- **B14 — Regional zero-panic theorem:** For every zero-input case outside + `Q`, cfg selection retains the checked body, `value == 0` makes the `if` + consequent execute, and `panic!` prevents reachability of the later unsafe + call. Thus `CoveredPanic = RequiredPanic intersect !Q` is **PROVED relative + to `BUILD-MAP-ORDERED`** across every applicable target/allocator/feature, + profile, and debug state. + - `scope_basis`: B1/B8/B11 and exact comparison, + `if`, cfg, and panic contracts. + - `dependencies`: B1, B8, and the + complement of B11. + - `accepted_alternatives`: a parametric proof or exact + finite configuration partition. + - `hard_errors`: incomplete + regional coverage alone fails B14; falsely claiming the region contains + Q/zero triggers BH9 or BH10 depending on the verdict. + +- **B15 — Whole-domain panic-postcondition verdict:** The report states that + the documented zero-input panic guarantee over all `RequiredPanic` is + **UNPROVED**, not `CONTRACT-BROKEN` and not `PROVED`: Q/zero contains UB, so + its apparent source prefix supplies neither a defined non-panic witness nor a + guaranteed observation, while B14 proves every other zero case. + - `scope_basis`: the exact behavioral quantifier, B12, B14, and whole-execution UB + reasoning. + - `dependencies`: B12 and B14. + - `accepted_alternatives`: + equivalent theorem-specific wording that keeps this verdict separate from + soundness. + - `hard_errors`: using the UB-containing case to claim + `CONTRACT-BROKEN` or an observation before UB triggers BH9; claiming the + universal panic theorem `PROVED` triggers BH10. + +## Hard Errors + +- **BH1:** Claims a whole-domain affirmative result after omitting a supported + release, target, feature, allocator, profile, debug state, or valid `u8` + input, or treats the supported `Q` cell as excluded. +- **BH2:** Claims the build relation or a dependent theorem complete while + replacing the requested ordered/fallible relation with an endpoint summary + that omits a material raw-selector class, failure edge, partial-prefix exit, + or necessary stage. +- **BH3:** Invents, silently widens, or treats as Rust authority any Cargo, + freshness, process-status, feature, or target proposition beyond exact + `BUILD-MAP-ORDERED`. +- **BH4:** Treats a cfg line emitted by an unsuccessful script, or a stale + artifact from an earlier selector, as the library selected for the current + failed build. +- **BH5:** Treats a rejected raw selector as an accepted allocator model; + treats wasm32/arena as supported; uses it as the safe-use UB witness; or + claims its effective rejection without the selected `compile_error!` proof. +- **BH6:** Ignores build-script output or exact Cargo/cfg interpretation and + consequently declares the supported `Q` unsafe branch unreachable. +- **BH7:** Reports `UNSOUND` without the valid safe use, reachability, false + exact safety proposition, and applicable UB consequence, or reports only + `UNPROVED` after explicitly establishing all four links. +- **BH8:** Claims an exact or maximal sound region that includes Q/zero or + excludes any sound Required case, including Q/nonzero. +- **BH9:** Reports `CONTRACT-BROKEN` for the zero-panic promise using only the + UB-containing Q/zero execution, or claims an observation is guaranteed + because it appears before that UB in source order. +- **BH10:** Reports the whole-`RequiredPanic` zero-panic theorem `PROVED` + despite leaving Q/zero without a defined proof. + +## Checked Authorities + +The evaluator must open each exact page, confirm the quoted proposition, and +confirm applicability to Rust/Cargo 1.85.1. The quotation is included to make +the semantic leaf explicit; punctuation-only rendering differences are +irrelevant. + +- `https://doc.rust-lang.org/1.85.1/std/env/fn.var.html` — “Fetches the + environment variable key from the current process”; returns + `VarError::NotPresent` when the variable is not set and + `VarError::NotUnicode` when its value is not valid Unicode. +- `https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html` — the enum is + exactly `NotPresent` or `NotUnicode(OsString)`; the variant descriptions + distinguish absence from a present value without valid Unicode data. +- `https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html` — `Result` is + exactly `Ok(T)` or `Err(E)` and “represents either success (`Ok`) or failure + (`Err`).” +- `https://doc.rust-lang.org/1.85.1/std/primitive.u8.html` — `u8` is “The 8-bit + unsigned integer type,” with `MIN` equal to zero and `MAX` equal to 255; zero + is therefore an ordinary valid safe-call input. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html` — a + scrutinee value is “sequentially compared to the patterns in the arms until + a match is found,” and the first matching arm is chosen and entered. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html` — a + block sequentially executes its non-item statements and optional final + expression; its type is `()` when the final operand is omitted. +- `https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body` + — an omitted function output is unit, and the body is conceptually wrapped + so that its body value is returned; an explicit `return`, if reached, + short-cuts that implicit return. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html` — “A + call expression calls a function”; if the function eventually returns, the + expression completes. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns` + — tuple-struct patterns match tuple-struct and enum values satisfying all + their subpatterns and destructure that value. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns` — + literal patterns “match exactly the same value as what is created by the + literal.” +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern` — + the wildcard pattern “matches any value.” +- `https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str` + — `as_str` “Extracts a string slice containing the entire `String`.” +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html` — `println!` + “Prints to the standard output, with a newline,” supplying the successful + completed-line effect used by B3–B6. +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics` — `println!` + “Panics if writing to `io::stdout` fails.” +- `https://doc.rust-lang.org/1.85.1/std/macro.panic.html` — `panic!` “Panics the + current thread.” The process-status consequence consumed by this fixture is + separately and explicitly admitted by `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation` + — a set configuration option is true; `all(...)` is true exactly when all + operands are true; and `not(p)` is true exactly when `p` is false. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute` + — a true cfg predicate retains the attached thing without the cfg attribute, + while a false predicate removes it from the source. +- `https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html` — + `compile_error!` “Causes compilation to fail with the given error message + when encountered.” +- `https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators` + — `==` means equal via `PartialEq::eq`; for the primitive `u8` comparison in + this source it tests whether `value` equals zero. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html` — if the + Boolean condition is true the consequent executes; if false it is skipped. +- `https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked` + — the function creates a nonzero without checking, “results in undefined + behavior if the value is zero,” and its Safety section says, “The value must + not be zero.” +- `https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html` + — Rust programs “must never cause undefined behavior”; unsafe code that no + safe client can trigger to exhibit UB is called sound, and code that safe + code can misuse to exhibit UB is unsound. The whole-execution conclusion is + a logical consequence of classifying the execution as undefined, not a + purported quotation from a source-order or “time travel” subsection. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script` + — after a build script “successfully finishes executing, the rest of the + package will be compiled”; a nonzero exit halts the build. This reviews, but + does not replace, `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script` + — Cargo interprets each stdout line beginning with `cargo::` as an instruction + affecting package compilation, and instruction order can matter. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg` + — the directive tells Cargo to pass its value to rustc's `--cfg` flag for + conditional compilation. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed` + — the directive tells Cargo to rerun the script if that environment + variable's value changes. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/features.html` — Cargo sets + enabled package features with rustc's `--cfg`, and source can test them with + the cfg attribute or macro. + +Cargo pages are evidence used to review the explicit human trust entry; they +are not Rust abstract-semantics axioms and do not silently enlarge that entry. +No test run, CI result, compiler experiment, prior report, evaluator oracle, or +unversioned documentation closes any atom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/allowlist.txt new file mode 100644 index 0000000000..b425cc1918 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/allowlist.txt @@ -0,0 +1,27 @@ +https://doc.rust-lang.org/1.85.1/std/env/fn.var.html +https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html +https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html +https://doc.rust-lang.org/1.85.1/std/primitive.u8.html +https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html +https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html +https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body +https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html +https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern +https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str +https://doc.rust-lang.org/1.85.1/std/macro.println.html +https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics +https://doc.rust-lang.org/1.85.1/std/macro.panic.html +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators +https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html +https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked +https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed +https://doc.rust-lang.org/1.85.1/cargo/reference/features.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/A.md new file mode 100644 index 0000000000..4a7e4846af --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/A.md @@ -0,0 +1,194 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits the complete supplied crate snapshot: `Cargo.toml`, `build.rs`, +`src/lib.rs`, and `BUILD.md`, `SUPPORT.md`, and `TCB.md`. The theorem is +source-level Rust 1.85.1/edition 2021 freedom from undefined behavior for every +well-typed safe call to `lane_id`, plus the requested build/rejection and panic +contracts. It is relative only to accepted entry `BUILD-MAP-ORDERED`; no +backend or binary correctness is claimed. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {burst off, burst on}`, `A = {system, arena}`; +- `P` be every Cargo profile, `D = {debug assertions off, on}`, and + `V = {0,...,255}` (the complete `u8` domain); +- `Supported(t,b,a,p,d) := t in T && b in B && a in A && p in P && d in D + && !(t=wasm32-unknown-unknown && a=arena)`; and +- `C(t,b,a) := t=aarch64-unknown-linux-gnu && b=burst-on && a=arena`. + +`SUPPORT.md` states exactly the product above and exactly its wasm/arena +exclusion. `Cargo.toml` fixes Rust 1.85.1, edition 2021, the empty/default or +enabled `burst` feature, and this build script/library. `BUILD.md` makes the +allocator a generated cfg from an accepted raw selector. These sources agree; +normalizing their conjunction gives `Supported` in both directions. Rejected +raw values are required build-interface cases, not extra library +configurations. Profiles and debug assertions do not occur in either library +cfg predicate or in its value test, so the proofs below are parametric in +`p,d`. There are no dependencies or other generated files. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered raw-selector/build relation, including freshness | **PROVED**, relative to `BUILD-MAP-ORDERED` | Complete path partition below | +| Required wasm32/arena exclusion | **PROVED** | `cfg` plus `compile_error!` proof below | +| Safe-API soundness over `Supported x V` | **UNSOUND** | Every `C && value=0` safe call reaches documented UB | +| Soundness on `M := {(q,value): Supported(q) && (!C(q) || value!=0)}` | **PROVED** | Exhaustive cfg/input partition below | +| “Panics when `value` is zero” over all `Supported` | **UNPROVED**, not `CONTRACT-BROKEN` | Proved for `!C`; the only remaining executions have UB, so they cannot be postcondition counterexamples | + +Thus the combined full-domain result is **UNSOUND** for soundness and +**UNPROVED** for the documented panic postcondition. + +## Exact ordered build relation + +Write `R` for the complete line +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, `S` for +`cargo::rustc-cfg=fixture_allocator="system"`, and `A` for the analogous +`"arena"` line. + +The function body executes its statements in order. First it attempts `R`. +If that write fails, `println!` panics: for every raw environment class the +script exits unsuccessfully before reading/classifying the variable, with no +successfully written complete directive guaranteed (an incomplete byte prefix +of the failing line is immaterial). If `R` succeeds, the complete relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Classification and next action | Complete emitted prefix and exit | +|---|---|---| +| omitted | `Err(NotPresent)`; attempt `S` | `R,S`, normal success if the write succeeds; otherwise `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `system` | `Ok`; `as_str`; `"system"` arm; attempt `S` | same two outcomes as omitted | +| Unicode `arena` | `Ok`; `"arena"` arm; attempt `A` | `R,A`, normal success; or `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `arena-stop` | `Ok`; matching arm; attempt `A`, then explicit `panic!` | if write succeeds: `R,A`, explicit panic; if it fails: `R` and `println!` panic before the explicit panic | +| every other Unicode value | `Ok`; wildcard arm | `R`, explicit panic; no allocator write attempted | +| every non-Unicode value | `Err(NotUnicode(_))` | `R`, explicit panic; no allocator write attempted | + +These are all raw classes, both stdout sites, all successful paths, all +explicit rejections, and all material complete prefixes. The successful +mapping is exactly `omitted|system -> system` and `arena -> arena`. The +`arena-stop` emitted allocator line never belongs to a successful execution. + +The accepted `BUILD-MAP-ORDERED` premise is consumed only as follows: a +successfully written current `R` makes any later raw-value change stale; a +successfully written allocator line is passed as that exact cfg only when the +current script succeeds; current success receives no retained old selector; +any write panic or explicit panic is an unsuccessful process and yields no +current library; Cargo does not substitute an old library after a stale failed +build; and `burst`/the three target triples set the exact named cfgs. Emitted +text and ordering above are proved from source, not assumed by that entry. + +Consequently, after a successful `arena` build, `R` necessarily was written. +Changing the same target directory to present value `arena-stop` is the +entry's present-to-present change: Cargo reruns before selecting a library. +The rerun fails at `R`, at `A`, or after successful `A`; every case is +unsuccessful, and neither its prefix nor the prior arena artifact is a result +of the current build. The freshness canary is therefore **PROVED**. + +## Version-matched Rust axioms + +The following are the material Rust 1.85.1 propositions; Cargo behavior above +comes only from the separately accepted project TCB entry. + +- [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says: + “Returns an `Err` if the variable is not present, or if it is not valid + Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + distinguishes `NotPresent` from `NotUnicode(OsString)`. +- [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” The + [match-expression rule](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + says: “The first arm with a matching pattern is chosen as the branch target + of the match.” [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + match the literal's value; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” +- [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially execute their component non-item declaration statements.” + [`println!` failure](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +- A [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + includes its attached form iff its predicate is true; if false, “the thing + is removed from the source code.” [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” +- The [`if` rule](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes the consequent when its Boolean condition is true; the + [comparison rule](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + makes `==` a value equality test. The [`u8` page](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + records `MIN = 0` and `MAX = 255`. +- Most importantly, [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + states: “This results in undefined behavior if the value is zero.” Its + Safety clause is: “The value must not be zero.” + +## Configuration exclusion and selected source + +On target `wasm32-unknown-unknown` after a successful arena selector, +`BUILD-MAP-ORDERED` supplies `target_arch="wasm32"` and exactly +`fixture_allocator="arena"`. Both operands of the source `all(...)` are true, +so the `compile_error!` item is included and compilation fails. This is +independent of `burst`, profile, and debug assertions. Hence the excluded pair +cannot produce a current library. For system on wasm32, and for either +allocator on the two other targets, that predicate is false and this error item +is removed. The project's sole exclusion is exactly enforced. + +## API, obligations, and maximal sound region + +The only language-reachable crate API is safe free function +`pub fn lane_id(u8) -> NonZeroU8`. There are no public fields, crate-owned +representation, traits/impls, methods, statics, macros, reexports, hidden +items, callbacks, or FFI. There is no persistent invariant; each unsafe call +locally consumes the sole obligation `value != 0`. + +The two complementary cfg blocks form an exhaustive partition: + +1. If `C`, the first block is included and the `not(all(...))` block removed. + Every input immediately reaches `new_unchecked(value)`. For `value in + 1..=255`, its sole safety precondition holds. For `value=0`, it is false and + the cited standard-library contract entails UB. +2. If `!C`, the first block is removed and the second included. At `value=0`, + equality is true and `panic!` executes before the unsafe call. At every + `value in 1..=255`, that branch is not taken and the exact same value reaches + `new_unchecked`, satisfying its safety clause. + +This proves every point of +`M = Supported x V intersect (!C or value!=0)`. Conversely, +`(Supported x V) \ M` is exactly `C && value=0`, for every profile and debug +assertion state. Calling this public safe function with zero is a valid +well-typed in-scope use; cfg selection reaches the unsafe call; its required +proposition is false; and the version-matched contract states the UB +consequence. Every omitted point is therefore unsound, proving both the +full-domain **UNSOUND** certificate and the exact maximality of `M`. + +For the documented postcondition, every `!C,value=0` execution reaches +`panic!`, so that region is proved. At `C,value=0` the whole execution has UB. +It cannot be a `CONTRACT-BROKEN` witness, which must be UB-free; absent an +independent UB-free witness, the full postcondition is **UNPROVED**. + +## Finding and proof-artifact quality + +**F-1 (critical, UNSOUND).** The special-path comment, “Burst-mode lane +identifiers are never zero,” is not derived from a check, type, invariant, or +unsafe caller contract. `value` is an unrestricted public `u8`, so zero is a +counterexample. The minimum repair is to validate zero on that path (or remove +the specialization and use the already checked path), then replace the comment +with a proof citing that dominating check and exact value. Changing prose alone +cannot repair the safe API. The ordinary-path comment correctly identifies the +dominating zero branch, though the derivation above supplies its complete +versioned contract basis. Any code repair is a new snapshot requiring re-audit. + +## TCB, residual scope, and triggers + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, accepted +for Cargo 1.85.1 and only its stated freshness, process-status, feature, target, +and cfg propositions. Its exclusions (emitted source text/order, Rust +semantics, source correctness, backend, binary) were not widened. No other +assumption, dependency, tool result, test, build, or prior audit was consumed. + +Excluded from the theorem are manual `rustc`, invented cfgs, build-script +override, unsupported targets, and binary/backend correctness. Re-audit is +required for any source/policy/manifest change; Cargo/Rust or documentation +change; target, feature, allocator, profile, or environment-interface change; +generated-cfg/build-order change; or altered TCB disposition. + +**Final attestation:** every source/API/build/configuration/postcondition +obligation has a disposition; `Required` and `M` are symbolic and closed; the +unsoundness witness is complete; no testing or absence-of-counterexample claim +is used. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/B.md new file mode 100644 index 0000000000..c17b23805f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/B.md @@ -0,0 +1,84 @@ +# Unsafe-code audit: supplied ordered-build crate + +## Claims, snapshot, and verdicts + +Audit cutoff: 2026-08-01. The audited identity is the complete supplied snapshot: `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`; Rust/Cargo/stdlib are exactly 1.85.1, edition 2021. There are no dependencies or generated files. No build, execution, expansion, or test evidence was used. + +Let `T={X86,A64,Wasm}` denote the three triples in `SUPPORT.md`; `B={off,on}` the `burst` cfg state; `A={system,arena}`; `P` every Cargo profile; and `D={debug_assertions off,on}`. The exact supported library domain is + +`R = {1.85.1} × T × B × A × P × D \ {(1.85.1,Wasm,b,arena,p,d)}`. + +The allocator coordinate must arise from a successful current build-script run: raw absent or `system` maps to `system`, and raw `arena` maps to `arena`. Rejected raw values and write-failing executions are part of the audited build interface but create no library configuration. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered selector, rejection, freshness, and wasm/arena exclusion | **PROVED**, relative to `BUILD-MAP-ORDERED` | Exhaustive relation and exclusion proof below | +| Build script and `lane_id` are UB-free for every current library in `R` and every `u8` input | **UNSOUND** | Supported `A64,on,arena,p,d`, input `0`, reaches `new_unchecked(0)` | +| “Panics when `value` is zero” for every `c in R` | **UNPROVED** | Proved when `F(c)` is false; the remaining executions contain UB, so they cannot certify a defined contract refutation | + +Here `F(c) := (target=A64 && burst=on && allocator=arena)`. The **exact maximal sound region** over the requested product is + +`Smax = {(c,x) in R × u8 | !F(c) || x != 0}`. + +Its complement is exactly `{(c,0) | c in R && F(c)}` (all profiles and both debug-assertion states). Thus this is maximal, not merely a positive subset. + +## Version-matched Rust axioms + +These are the only material Rust propositions consumed: + +* AX-ENV: [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “Returns an Err if the variable is not present, or if the current value is not valid Unicode.” [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) represents success as `Ok` or failure as `Err`; [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) distinguishes `NotPresent` and `NotUnicode`. +* AX-ORDER: the [block-expression Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) says statements are “executed sequentially.” The [match Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) says values are sequentially compared with arm patterns and the first match is chosen. [Tuple-struct patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns) match tuple-struct and enum-variant values. [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) “Extracts a string slice containing the entire String.” Literal patterns [match the literal's value](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), while the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) “matches any value.” +* AX-EXIT: [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the current thread.” `BUILD-MAP-ORDERED` supplies the process-status consequence. +* AX-CFG: the [conditional-compilation Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) defines `all` as true exactly when all predicates are true and `not` as negation. The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) includes its attachment when true and removes it when false. [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) “causes compilation to fail with the given error message when encountered.” +* AX-NZ: Rust 1.85.1 [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) requires: “The value must not be zero”; creating it with zero is undefined behavior. The [UB Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) confirms that unsafe blocks remain subject to the UB rules. +* AX-IF: the [`if` Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) executes the consequent exactly when its Boolean condition is true; the [comparison-operator Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) gives `==` equality for the `u8` comparison. + +## Complete ordered build relation + +Write `RERUN`, `CS`, and `CA` for the complete lines at `build.rs:4`, `:8/:12`, and `:15/:18`. `partial(L)` means any bytes produced by a failing attempt to write `L`, possibly none or even a complete-looking line. This deliberately does not assume line-write atomicity. + +1. For **every** raw environment state, the first operation attempts `RERUN`. If it fails, the only output is `partial(RERUN)`; `println!` panics before `env::var`, the process is unsuccessful, and no current library is compiled. +2. If `RERUN` succeeds, `env::var` is evaluated and its exhaustive `Result`/match partition is: + * absent or Unicode `system`: attempt `CS`. Failure yields `[RERUN]+partial(CS)`, panic, and no library. Success yields `[RERUN,CS]`, normal return, and exactly `fixture_allocator="system"` for the current library; + * Unicode `arena`: the identical two outcomes with `CA`, selecting exactly `arena` only after success; + * Unicode `arena-stop`: attempt `CA`. A write failure yields `[RERUN]+partial(CA)` and no library. A successful write yields `[RERUN,CA]`, then the explicit panic at `build.rs:19`; despite the complete allocator line, no current library is compiled; + * every other Unicode value: output `[RERUN]`, then the wildcard-arm panic at `:21`; no allocator write and no library; + * every non-Unicode value: output `[RERUN]`, then the `NotUnicode` panic at `:24`; no allocator write and no library. + +This exhausts the first-write outcome, all three `env::var` result classes, all literal/wildcard subdivisions of `Ok`, and every second-write outcome. Local sequential execution plus AX-ENV/ORDER/EXIT proves the source-side order and exits. Accepted TCB entry `BUILD-MAP-ORDERED` supplies only these consumed Cargo facts: a successfully written rerun line tracks any raw-value change; a cfg line affects the current library only after that script exits successfully; only the current successful run's exact directives are used; an unsuccessful script (including uncaught panic or either write failure) produces no current library and cannot surface a stale one; enabled `burst` and the three target triples set the named cfgs. No source-correctness or Rust-semantic proposition is imported from that entry. + +**Freshness witness sequence.** A successful raw `arena` run writes `[RERUN,CA]`, returns, and may produce the arena library. In the same target directory, changing the present raw value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly the three unsuccessful cases above: first write fails; first succeeds and `CA` fails; or both writes succeed and `:19` panics. Therefore the current build is rejected in every case, and the prior arena library is not its result. + +## Configuration/source closure and exclusion + +For a successful selector run, Cargo supplies exactly one of `system` or `arena`. AX-CFG makes the two `lane_id` bodies complementary: + +* `system`, or any X86 configuration, or `burst=off`: only the checked body at `lib.rs:27-32` is selected; +* `A64 + arena + burst=on`: only the unchecked-return body at `:17-20` is selected; +* `Wasm + arena`: independently of `burst`, the cfg on `:3` is true and `compile_error!` makes the current library compilation fail, producing no library artifact; +* `Wasm + system` remains in the checked class. + +Thus the required exclusion is effectively and exactly rejected: successful arena selection plus the accepted Wasm target-cfg entails the compile error. No rejected raw class bypasses it, because none creates a current library. Conversely, this source error's predicate is precisely `Wasm && arena`, so it does not enlarge the stated exclusion. Profiles and debug assertions do not occur in any selector or source predicate, giving a parametric proof over `P×D`. Hence the build/exclusion `Covered` predicate contains the complete build-interface domain, and the successful-library projection is exactly `R`. + +## API, obligations, and maximal-region proof + +The only public surface is safe `lane_id(u8) -> NonZeroU8`; there are no public fields, traits/impls, callbacks, macros, statics, FFI, or hidden APIs. The only unsafe sites are its two cfg-complementary `new_unchecked` calls. The build script contains no unsafe code. + +* If `!F(c)` and `x=0`, `value == 0` is true, so `panic!` executes before the unsafe call. This is UB-free and proves the documented panic behavior. +* If `!F(c)` and `x!=0`, the zero branch is skipped; that dominating fact discharges AX-NZ before `lib.rs:32`. +* If `F(c)` and `x!=0`, the direct call at `:19` satisfies AX-NZ. +* If `F(c)` and `x=0`, cfg selection reaches `new_unchecked(0)`. The safe signature imposes no caller precondition, so this is a valid supported safe use; AX-NZ's required proposition is false and the operation has undefined behavior. This proves **UNSOUND**, for every `p,d` in this complement. + +The four cases are exhaustive (`F`/`!F`, zero/nonzero). The first three prove every member of `Smax`; the fourth proves every member of its complement unsound, establishing maximality. The existing fast-path comment—“Burst-mode lane identifiers are never zero”—is a false, unenforced premise; the parameter comes directly from adversarial safe code. The checked-path comment is adequate. + +For the panic contract, coverage is exactly `{(c,0) | c in R && !F(c)}`. In the uncovered `F(c),0` cases the whole execution contains UB. Consequently there is no UB-free witness here for `CONTRACT-BROKEN`; the strongest contract verdict is **UNPROVED**, alongside the independently certified **UNSOUND** verdict. + +## TCB audit, findings, and residual scope + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, disposition accepted by the authorized reviewer. Its exact consumed fragments and consumers are recorded above; its Cargo/toolchain identity is 1.85.1. AX-ENV through AX-IF are versioned Rust authorities, not extra implementation assumptions. No pending, unsafe-dependency, tool, backend, binary, platform-runtime, or probabilistic premise is consumed. + +**Finding F-1 (UNSOUND; proof comment deficient):** `src/lib.rs:18-19`, precisely `F(c) && value=0`. Minimum repair is to check zero before every `new_unchecked`, use `NonZeroU8::new(value).expect(...)`, or remove the special unsafe branch. Merely strengthening prose would add an invalid hidden precondition to a safe API. Re-audit all cfg cases and the panic guarantee after repair. + +**Finding F-2 (postcondition UNPROVED):** the same region prevents a universal panic proof, but supplies no defined contract-breaking witness. Repair F-1 while retaining a zero-input panic on the fast path. + +This is a source-level Rust theorem only. Compiler/backend correctness, produced binaries, manually invented cfgs, direct `rustc`, build-script override, targets/toolchains outside the stated set, and future source or policy are excluded. Re-audit on any source, Rust/Cargo, support domain, raw interface, feature/target cfg, TCB disposition, or cited semantic-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/C.md new file mode 100644 index 0000000000..0276c50b7c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/C.md @@ -0,0 +1,78 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits exactly the supplied `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and accepted `TCB.md`, under Rust/standard library 1.85.1 and Cargo 1.85.1. No generated file, dependency, test, build, macro expansion, backend, or binary claim is used. Audit cutoff: 2026-08-01. + +Write `X`, `A`, and `W` for the three supported targets (x86_64-linux-gnu, aarch64-linux-gnu, and wasm32-unknown-unknown); `b in {0,1}` for `burst`; `a in {system,arena}`; `p in P` for every Cargo profile; and `d in {0,1}` for debug assertions. The controlling full product is + +`F = {1.85.1} x {X,A,W} x {0,1} x {system,arena} x P x {0,1}`. + +`SUPPORT.md` makes the compilable-library domain + +`C = {c in F | not(c.target=W and c.allocator=arena)}`. + +No finite enumeration of `P` is inferred. The proofs below are parametric in `p,d`; neither selects inspected source. Build-domain coverage additionally quantifies over every raw environment class and success/failure of each stdout write described below. `BUILD.md` excludes manual rustc, invented cfgs, and build-script override; that exclusion is controlling, not inferred from successful compilation. + +* **Whole-crate safe-API soundness: UNSOUND**, relative to accepted `BUILD-MAP-ORDERED` and the quoted Rust axioms below. A supported safe call reaches UB. +* **Documented `lane_id(0)` panic postcondition: UNPROVED** over `C`. It is proved outside the defective configuration, but the only refutation found in that configuration contains UB, so it cannot certify `CONTRACT-BROKEN`. +* **Build mapping/freshness and W/arena rejection: PROVED** for the stated source domain relative to exactly `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `S`/`A0` the complete `cargo::rustc-cfg=fixture_allocator="system"`/`"arena"` lines. Rust blocks execute statements sequentially ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html): “a block sequentially executes its component non-item declaration statements and then its final optional expression”). Thus every path first attempts `R`, then calls `env::var`, then (only where shown) attempts one allocator line. + +`env::var` “Fetches the environment variable `key` from the current process”; it returns `NotPresent` when unset and `NotUnicode` when its value is not valid Unicode ([std](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)). The fixed name contains neither `=` nor NUL. `as_str` “Extracts a string slice containing the entire `String`” ([std](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)); match selects the first matching arm after evaluating the scrutinee ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). These facts make the following raw partition exhaustive. + +| Raw class, after successful `R` | Next events in exact order | Completed stdout prefix and exit | Current library | +|---|---|---|---| +| omitted | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `system` | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `arena` | attempt `A0`; success returns | `R,A0`, success | cfg `arena`, subject to source rejection | +| Unicode `arena-stop` | attempt `A0`; after success explicit panic | `R,A0`, unsuccessful | none | +| every other Unicode string | explicit panic; no allocator attempt | `R`, unsuccessful | none | +| every non-Unicode value | explicit panic; no allocator attempt | `R`, unsuccessful | none | + +There are exactly two write-failure sites. If the `R` write fails, execution panics there: no complete directive is guaranteed (only a possibly incomplete byte prefix) and no environment read occurs. If `S` or `A0` fails, complete prefix `R` (plus a possibly incomplete suffix of that attempted line) precedes the panic; there is no return. On `arena-stop`, failure of `A0` gives the latter prefix; success gives `R,A0` followed by the explicit panic. `println!` “Prints to the standard output, with a newline” and “Panics if writing to `io::stdout` fails” ([std](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([std](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). These panics are safe behavior. + +The accepted TCB supplies, and this proof consumes only, these propositions: a completed `R` records raw-value freshness; a successful current execution's completed cfg line becomes that exact library cfg, with no retained earlier selector; any write failure or uncaught main-thread panic is unsuccessful and produces/presents no current library; enabling `burst` sets its feature cfg; and the three triples set the named `target_arch` values. Cargo documentation corroborates but does not replace that accepted premise: `rustc-cfg` “tells Cargo to pass the given value to the `--cfg` flag” ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)), while `rerun-if-env-changed` causes rerun when the named value changes ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). + +**Freshness challenge.** After successful `arena` in one target directory, changing the raw value to `arena-stop` is a present-to-present change covered by `R`. `BUILD-MAP-ORDERED` therefore forces a rerun before selection. That rerun either fails at `R`, fails at `A0`, or writes both then explicitly panics. Every case is unsuccessful; neither its partial output nor the old arena artifact is a result of the current build. The advertised canary works. + +## Directive-to-source closure and exclusion + +Conditional compilation compiles parts according to conditions, and a cfg attribute “conditionally includes the thing it is attached to based on a configuration predicate” ([Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)). Consequently a successful accepted build supplies exactly one allocator cfg, the selected feature state, and the target architecture. + +For `W and arena`, the first predicate in `lib.rs` is true for either feature/profile/debug state, so `compile_error!`, which “Causes compilation to fail with the given error message when encountered” ([std](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)), rejects compilation. For every other member of `F` it is false, so it rejects nothing. Therefore the source enforces exactly `F ∖ C`; `arena-stop` never reaches this stage. There is no current API for the rejected pair. + +For each `c in C`, define + +`Q(c) = (burst enabled) and (target=A) and (allocator=arena)`. + +The two function-body cfgs are `Q` and `not(Q)`, hence form an exhaustive, disjoint partition. In `Q`, source selects the unconditional `return new_unchecked(value)` block. In `not(Q)`, it selects the block which first compares with zero, panics on equality, and otherwise calls `new_unchecked`. An `if` is a conditional branch and executes its consequent when its Boolean condition is true ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is the equality comparison operator ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). + +## Unsafe obligation, witness, and exact maximal sound region + +The complete language-reachable crate API surface is the safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, constructors besides it, traits/impls, callbacks, statics, FFI, exported macros, or hidden APIs. `compile_error!` is configuration control. The two `new_unchecked` calls are the only unsafe sites. The owned invariant/obligation is `NZ(value): value != 0` immediately before either call. No caller obligation is permitted because `lane_id` is safe. + +`u8` is “The 8-bit unsigned integer type” ([std](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)); let `U={0,...,255}`. `NonZeroU8::new_unchecked` “Creates a non-zero value without checking whether the value is non-zero” and “The value must not be zero”; zero “results in undefined behavior” ([std](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +The exact maximal sound region of compiled API cases is + +`M = {(c,x) in C x U | not(Q(c) and x=0)}`. + +**Sufficiency:** if `not Q` and `x=0`, the comparison reaches `panic!` before unsafe code. If `not Q` and `x!=0`, the false branch itself establishes `NZ(x)`. If `Q` and `x!=0`, the input establishes `NZ(x)`. Thus every unsafe call in `M` satisfies its complete safety precondition. Profiles and debug assertions do not alter this derivation. + +**Necessity/maximality:** choose any profile/debug state with `(target=A, burst=1, allocator=arena, x=0)`. This configuration belongs to `C`, raw `arena` successfully selects it, and `lane_id(0)` is a well-typed safe use. `Q` selects the first block; it reaches `new_unchecked(0)`, its required proposition is false, and the quoted contract entails UB. Hence every point in `(C x U) ∖ M` is unsound, while every point in `M` was proved sound. This proves both maximality and the existential `UNSOUND` certificate. Over all of `F x U`, `W/arena` has no compiled API; every other case is classified by `M` or its complement. + +The special-path comment, “Burst-mode lane identifiers are never zero,” is false for caller-controlled `u8` and supplies neither a check nor an invariant. The ordinary-path comment is adequate: the dominating zero branch makes reaching its unsafe call imply nonzero. Minimal repair: perform the zero check before both cfg branches (or use checked `NonZeroU8::new(value)` and panic on `None`) and replace the false comment with that dominating fact. + +For the documented postcondition, zero reaches `panic!` in every `c in C` with `not Q`; it is therefore proved exactly there. In `Q`, the zero execution contains UB. There is no independent UB-free zero execution or equivalent existence proof, so the whole-domain result is `UNPROVED`, not `CONTRACT-BROKEN`. + +## TCB log, residual scope, and triggers + +* **BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo/freshness/process-status/feature/target propositions enumerated above; consumers are build reachability and exclusion only. No source correctness is imported. +* **AXIOM-CTRL/CFG/NZ (accepted Rust authority):** only the linked, versioned 1.85.1 propositions quoted above. Rust's UB rule applies inside unsafe blocks too ([Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). +* No dependency, allocator implementation, generated-code, tool, test, FFI, backend, binary, or deployment premise is consumed. “Allocator” is only this crate's cfg model. + +Re-audit on any supplied source/policy/manifest change; Cargo/Rust/stdlib version or TCB disposition change; target, feature, allocator, profile/debug scope change; changed build-output/freshness semantics; or a new API/cfg. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/D.md new file mode 100644 index 0000000000..12235d2ff6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/D.md @@ -0,0 +1,107 @@ +# Unsafe-code audit: `ordered-build-target` supplied snapshot + +## Claim, domain, and verdicts + +Audit cutoff: 2026-08-01. Scope is every supplied crate file, Cargo 1.85.1/Rust 1.85.1, the build interface and freshness contract, generated cfgs, selected `src/lib.rs`, its sole public safe API, and its documented panic condition. This is a Rust-abstract-semantics source claim, not a backend or binary claim. No build, execution, expansion, test, prior audit, or external dependency result was used. + +Write `X`, `A`, and `W` for the three listed target triples (x86_64 GNU/Linux, aarch64 GNU/Linux, and wasm32-unknown-unknown), `F={off,on}` for `burst`, `L={system,arena}`, `P` for every Cargo profile, `D={off,on}` for debug assertions, and `U={0,...,255}`. The full policy product is + +`C={X,A,W} x F x L x P x D`. + +`SUPPORT.md:9-16` says exactly those members are supported except + +`E={c in C | target(c)=W and allocator(c)=arena}`, + +so current library configurations are `S=C\E`. Both containments for this normalization follow literally: every tuple admitted by the “every other combination” clause is in `C\E`, and every member of `C\E` has listed axis values and is not the sole exclusion. No enumeration of `P` is assumed. + +Full `Required` is the union of (1) all supported Cargo build attempts over the six raw-environment classes below, every possible applicable stdout-success/failure path and relevant prior target-directory state, and (2) every call `lane_id(v)` with `c in S` and `v in U` after a current successful build. `E` and rejected selector attempts have no current API case. Manual rustc, invented cfgs, and build-script override are expressly excluded by `BUILD.md:31-34`. + +| Claim | Verdict | Certificate | +|---|---|---| +| Whole-crate safe-API freedom from UB over `S x U` | **UNSOUND** | `F-UB` below supplies a valid supported safe call, reachability, false safety condition, and explicit UB consequence. | +| “`lane_id(value)` panics when `value` is zero” over `S x {0}` | **UNPROVED** | Proved on `S\K`; the remaining `K` executions have UB, so they cannot establish `CONTRACT-BROKEN` and do not prove the postcondition. | +| Exact maximal realized library sound region | **PROVED relative to TCB-ORDERED** | `M=(S x U)\WIT`, proved below; every point in its complement within `S x U` is an UB witness. | +| Ordered build mapping, freshness canary, and target/allocator rejection | **PROVED relative to TCB-ORDERED** | Exhaustive staged relation and exact cfg derivation below. | + +Thus the combined mandatory result is **UNSOUND; documented postcondition UNPROVED**, not `PROVED` and not `CONTRACT-BROKEN`. + +## Boundary, surfaces, and invariants + +`Cargo.toml` selects only `build.rs` and `src/lib.rs`; all supplied files were read. `build.rs::main` is private and contains no unsafe operation. The complete downstream surface is the public **safe** free function `lane_id(u8) -> NonZeroU8`; there are no crate-defined public fields, constructors, traits/impls, statics, callbacks, FFI, reexports, hidden items, or exported/generated macros. Its caller has no safety precondition. The only invariant consumed is `NZ`: the argument to `NonZeroU8::new_unchecked` is nonzero, thereby producing a valid nonzero result. The function boundary must establish `NZ`; `lib.rs:18` does not. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `CS`/`CA` the complete system/arena `cargo::rustc-cfg` lines. Block statements execute sequentially, and a value scrutinee is evaluated then patterns are compared sequentially until the first match. These checked semantics make the source order literal, not inferred from endpoint output. + +1. Cargo runs `build.rs`; `build.rs:4` first attempts `println!(R)`. If it succeeds, complete prefix `[R]` exists and only then is `env::var` called. If it fails, `println!` panics there: no classification or later write is reached and no earlier complete line is guaranteed. +2. With `[R]`, `env::var` and the two matches produce the exhaustive raw partition below. The key literal itself contains neither `=` nor NUL. `Result` has only `Ok`/`Err`; `VarError` has only `NotPresent`/`NotUnicode`; `as_str` preserves the entire Unicode string; literal patterns select exactly their values and `_` every remainder. + +| Raw `FIXTURE_ALLOCATOR` class | Reached operation after `[R]` | If that operation succeeds | Explicit/failure exit | +|---|---|---|---| +| omitted | `build.rs:8` attempts `CS` | return success with `[R,CS]` | write failure panics with prior complete prefix `[R]` | +| Unicode `system` | line 12 attempts `CS` | return success with `[R,CS]` | same failure prefix/exit | +| Unicode `arena` | line 15 attempts `CA` | return success with `[R,CA]` | same failure prefix/exit | +| Unicode `arena-stop` | line 18 attempts `CA` | prefix `[R,CA]`, then line 19 explicitly panics | line-18 failure panics first with prior prefix `[R]`; line 19 is not reached | +| every other Unicode value | no allocator write | none | line 21 explicitly panics with `[R]` | +| every non-Unicode value | no allocator write | none | line 24 explicitly panics with `[R]` | + +This includes every dynamic stdout failure site: common line 4 and the class-specific lines 8, 12, 15, and 18. A failed `println!` may have written an unspecified byte prefix (possibly a complete-looking attempted line); the table states only already successful complete lines. TCB-ORDERED makes all such executions unsuccessful and prevents any prefix from producing a current library, so no atomic-write premise is consumed. Explicit `panic!` writes no Cargo stdout directive. + +3. On exactly the three accepted successful classes, TCB-ORDERED interprets the current two complete lines: `R` establishes freshness tracking and exactly one of `CS`/`CA` passes the corresponding exact `fixture_allocator` key/value cfg to this library, with no selector retained from an earlier run. Every write failure, explicit panic, and `arena-stop` exit is unsuccessful; no current library compilation occurs. +4. TCB-ORDERED also supplies the exact `burst` and target-architecture leaf cfgs. Rust cfg semantics then select source. Define + +`K(c) := burst(c)=on and target(c)=A and allocator(c)=arena`. + +The first `lane_id` block is present exactly on `K`; the second is present exactly on `not K`, because its predicate is the literal `not(all(...))`. Profiles and debug assertions occur in no selector or safety check, so this partition is parametric over `P x D`. + +### Exact exclusion + +For a current successful arena selector on `W`, TCB-ORDERED sets both `target_arch="wasm32"` and `fixture_allocator="arena"`; `all` is true, the `cfg` attribute retains `compile_error!`, and that macro fails compilation. Conversely, encountering this source error requires both leaves true, hence exactly `E`; feature state is irrelevant. System-on-`W` and arena on `X`/`A` make at least one leaf false and remove the item. Therefore `Rejected_source=E` in both directions, not merely `E` contained in a sampled rejection. A failed current compilation is no current library/API case. Over the total `C x U`, `E x U` is precisely the no-library region. + +### Freshness sequence in one target directory + +Take any successful prior arena library build, necessarily on `X` or `A`. Its successful script emitted `[R,CA]`; TCB-ORDERED says a present-to-present raw change from `arena` to `arena-stop` stales that selection and reruns the script before a current library can be selected. On the rerun: line 4 failure rejects immediately; otherwise line 18 failure rejects with `[R]`; otherwise `[R,CA]` is followed by the explicit panic. TCB-ORDERED says every case supplies no current library and never presents the old arena library as this rejected build's result. The freshness canary is therefore effective. + +## Unsafe obligations and exact maximal region + +Rust 1.85.1 documents `NonZero::new_unchecked`: “The value must not be zero” and “undefined behavior if the value is zero.” Thus each site has exactly obligation `NZ`. + +* On `not K`, cfg removes the early-return block. If `v=0`, `==` is equality, the `if` consequent executes `panic!`, and control never reaches line 32. If `v!=0`, the consequent is skipped; reaching line 32 itself proves `NZ`, so the call is permitted and returns a nonzero. This reconstructs and completes the terse line-31 comment. +* On `K`, cfg removes the checked block. Line 19 is reached for every `v`. `v!=0` satisfies `NZ`; `v=0` falsifies it. The line-18 comment's “never zero” is neither type-enforced nor checked and is false for a caller-supplied `u8`. + +Let + +`WIT={(c,0) | c in S and K(c)}` and `M=(S x U)\WIT`. + +`WIT` is nonempty: `A`, burst on, arena is listed and not the wasm exclusion, for every `P,D`; an accepted arena build with successful writes selects it. Calling the public safe `lane_id(0)` is a valid safe use. Cfg makes line 19 reachable; zero falsifies `NZ`; the exact standard-library contract entails UB. This is the complete **UNSOUND** certificate (`F-UB`). + +For every member of `M`, either `not K` (the checked proof above covers every `u8`) or `K` and `v!=0` (the unsafe precondition holds); no other unsafe operation exists. Hence `M` is sound. Conversely, every member of `(S x U)\M` is by definition in `WIT` and has the proved UB certificate. Both containments establish equality and maximality, rather than a non-maximal remainder. The complete product partition is therefore: rejected `E x U`, realized-sound `M`, and realized-unsound `WIT`. + +For the panic contract, `(S\{c:K(c)}) x {0}` is proved: the equality is true and `panic!` “Panics the current thread.” On `WIT`, the whole execution contains UB, so it cannot be an UB-free postcondition counterexample. No independent UB-free witness exists in this source. The strongest global postcondition verdict is consequently **UNPROVED**, with no `CONTRACT-BROKEN` certificate. + +## Obligation ledger and findings + +| ID | Obligation | Coverage/status | +|---|---|---| +| O-BUILD | Exhaust raw classes, ordered effects/exits, partial prefixes, Cargo interpretation | All cases proved above relative to TCB-ORDERED | +| O-FRESH | stale arena then arena-stop cannot select old/current library | proved above relative to TCB-ORDERED | +| O-EXCL | reject exactly wasm32/arena | proved in both directions | +| O-NZ-NORMAL | line 32 argument nonzero | proved on `not K` for every `u8` | +| O-NZ-BURST | line 19 argument nonzero | proved only for `K and v!=0`; **UNSOUND** at `v=0` | +| O-PANIC | every zero call panics | proved on `not K`; **UNPROVED** on `K` | + +**F-UB (critical implementation defect; deficient proof artifact).** The safe `u8` input is treated as if “burst mode” enforced nonzero. Minimal resolution is to perform the zero check before every cfg-dependent unsafe call, or replace both calls with a checked safe constructor while preserving the documented panic. A valid replacement proof would say: “`new_unchecked` requires nonzero; if `value==0` the preceding `panic!` diverges, so reaching this call proves `value!=0`.” Re-audit all `K`, postcondition, and maximal-region proofs after repair. + +## Authority and TCB audit log + +**TCB-ORDERED (accepted human decision):** supplied `TCB.md` entry `BUILD-MAP-ORDERED`, Cargo 1.85.1, exact supplied manifest/script/interface/library. Consumed propositions only: required script execution; successful `R` freshness including present-to-present raw changes; exact current successful cfg and no retained selector; no compilation/old-result presentation after unsuccessful script even with complete prefixes; panic as unsuccessful exit; and exact feature/target leaves. No local emission, Rust semantics, source correctness, backend, binary, or compiler-correctness proposition is imported. Owner is the unidentified authorized human; triggers are exactly `TCB.md:43-45`. Cargo's versioned documentation corroborates that Cargo will [“execute it just before building”](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script), treats [stdout `cargo::` lines as instructions](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script), and [`rustc-cfg` passes its value to `--cfg`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg); the stronger failure/staleness clauses remain only the expressly accepted TCB proposition. + +Checked Rust 1.85.1 axioms, all accepted as version-matched authoritative text: + +* Environment/classification: `env::var` says [“The variable is not set” and `NotUnicode` means its “value is not valid Unicode”](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html); [`VarError` has exactly `NotPresent` and `NotUnicode`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html); [`Result` is `Ok(T)` or `Err(E)`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html); [`as_str` contains the entire `String`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str). +* Order/partition: blocks [“sequentially execute”](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html); match uses the [“first arm with a matching pattern”](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html); literal patterns [“match exactly the same value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), tuple patterns match enum values, and `_` [“matches any value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern). +* Effects: `println!` [prints stdout with newline and “Panics if writing ... fails”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics); [`panic!` “Panics the current thread”](https://doc.rust-lang.org/1.85.1/std/macro.panic.html). +* Cfg: the [conditional-compilation clauses](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) say an “option is set,” “all ... predicates are true,” `not` inverts, and false cfg means the “thing is removed from the source code.” [`compile_error!` “Causes compilation to fail”](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html). +* API: `u8::MIN=0` and [`u8::MAX=255`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html); `==` means [“Equal”](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators); a true `if` condition [executes its consequent](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html); and [`new_unchecked` “Creates a non-zero,” requires nonzero, and expressly makes zero UB](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked). + +No other TCB entry, dependency contract, tool-derived evidence, environment restriction, or compatibility premise was consumed. Rust/Cargo/toolchain, target/feature policy, script/source/docs, TCB disposition, or panic-contract changes trigger full re-audit. Review attestation is complete except that the audited artifact itself fails O-NZ-BURST and O-PANIC as reported. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/E.md new file mode 100644 index 0000000000..f826f01b97 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/E.md @@ -0,0 +1,78 @@ +# Unsafe Rust audit: complete supplied crate + +## Claim, snapshot, and verdicts + +Audited snapshot: the supplied `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and `TCB.md`; Rust, std, and Cargo 1.85.1; edition 2021; no dependencies or generated source. Audit cutoff: 2026-08-01. No build, execution, expansion, or test evidence was used. + +Let `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`, `F={off,on}` for `burst`, `A={system,arena}`, `P` be every Cargo profile, and `D={off,on}` for debug assertions. The controlling support expression in `SUPPORT.md` normalizes exactly to + +`C = {(t,f,a,p,d) in T×F×A×P×D | not(t=wasm32-unknown-unknown and a=arena)}`. + +Both containments are direct: every policy-supported tuple has listed values and is not the sole stated exclusion, hence is in `C`; every member of `C` is one of the expressly supported Cartesian combinations and is not excluded, hence is policy-supported. `P` and `D` remain symbolic; no sampled inventory substitutes for them. + +The full required domain is (i) every supported-Cargo build attempt over every raw `FIXTURE_ALLOCATOR` class and every stdout-success/failure path described below, and (ii) every well-typed safe call `lane_id(x)` for `c in C` and every `x:u8`. Build rejection cases do not become library configurations. + +Verdicts, relative only to accepted `TCB.md` entry `BUILD-MAP-ORDERED` and the Rust 1.85.1 axioms quoted below: + +* **Build-interface contract: PROVED.** The raw partition, operation order, partial prefixes, current-build rejection, selector mapping, and arena-to-arena-stop freshness guarantee hold. +* **Target/allocator exclusion: PROVED.** Every wasm32/arena library attempt fails compilation, independently of feature, profile, and debug assertions; no such tuple is in `C`. +* **Safe-library soundness: UNSOUND.** A supported safe call reaches documented undefined behavior. +* **Documented panic postcondition: UNPROVED overall**, and PROVED on its exact positive region stated below. There is no UB-free counterexample establishing `CONTRACT-BROKEN`. + +## Checked authority and TCB + +The following are the material Rust axioms, all scoped to 1.85.1. + +* `std::env::var` “Fetches the environment variable `key` from the current process” and returns `NotPresent` or `NotUnicode` in the two stated error cases ([`var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); `VarError` has exactly those variants ([`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html)). `Result` “represents either success (`Ok`) or failure (`Err`)” ([`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html)). `String::as_str` “Extracts a string slice containing the entire `String`” ([`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). +* A block “sequentially executes its component non-item declaration statements” ([blocks](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html)); a match compares arms until a match and chooses the first matching arm ([match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). Tuple-struct patterns select the named enum variant, literal patterns match equal values, and `_` matches any value ([tuple-struct](https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns), [literal](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern)). +* `println!` “Prints to the standard output, with a newline” and “Panics if writing to `io::stdout` fails” ([macro](https://doc.rust-lang.org/1.85.1/std/macro.println.html), [failure](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)). `panic!` “Panics the current thread” ([`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). Function calls execute their called body ([calls](https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html), [function body](https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body)). +* A `cfg` attribute conditionally includes its attached form; a false predicate removes it, while `all` and `not` have their literal Boolean meanings ([conditional compilation](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation), [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)). `compile_error!` “Causes compilation to fail with the given error message when encountered” ([`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). An `if` executes its consequent when its Boolean condition is true ([if](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is the equality comparison used here ([comparisons](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). `u8` is the 8-bit unsigned integer type, so every input is exactly zero or nonzero ([`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)). +* `NonZeroU8::new_unchecked` “Creates a non-zero without checking whether the value is non-zero”; critically, “This results in undefined behavior if the value is zero” and its Safety clause says “The value must not be zero” ([`new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). The general UB inventory also includes producing invalid values ([undefined behavior](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). + +`BUILD-MAP-ORDERED` is accepted exactly as written: current successful directive interpretation; freshness after a successfully written rerun directive; no current or stale library after an unsuccessful build script; feature and listed-target cfg mapping; and uncaught-main-panic status. It does **not** supply emitted strings/order or Rust/source correctness; those are derived here. Cargo documentation independently agrees that `rustc-cfg` passes a value to `--cfg` and `rerun-if-env-changed` reruns when the named value changes ([outputs](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script), [`rustc-cfg`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg), [`rerun-if-env-changed`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)); these checks do not widen the accepted premise. Cargo feature interpretation is likewise confined to the entry ([features](https://doc.rust-lang.org/1.85.1/cargo/reference/features.html)). + +## Complete ordered build relation + +Write `R` for `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, `S` for `cargo::rustc-cfg=fixture_allocator="system"`, and `A` for the analogous `"arena"` line. Blocks execute in source order and every `println!` either completes or panics on its write. + +1. Every execution first attempts `R`. Failure exits by panic with emitted prefix `[]`; environment classification and all later operations are unreachable. Success leaves prefix `[R]`, then `env::var` is called and the exhaustive `Result`/`VarError` matches classify the raw value. +2. Raw absent: attempt `S`. Raw Unicode `system`: `as_str` yields the whole string, the literal arm matches, and it attempts `S`. Raw Unicode `arena`: analogously attempt `A`. At any such allocator-write failure, the exit is a `println!` panic with prefix `[R]`. At success, the exact prefix is respectively `[R,S]` or `[R,A]`, `main` returns normally, and `BUILD-MAP-ORDERED` passes exactly that allocator cfg to the current library compilation. +3. Raw Unicode `arena-stop`: attempt `A`. Write failure exits unsuccessfully with `[R]`. Write success leaves `[R,A]`; the following explicit `panic!` is necessarily reached and exits unsuccessfully. The emitted allocator prefix is not interpreted into a current compilation under `BUILD-MAP-ORDERED`. +4. Every Unicode value outside `{system,arena,arena-stop}` reaches `_` and explicitly panics with `[R]`; every non-Unicode value reaches `Err(NotUnicode(_))` and explicitly panics with `[R]`. No allocator write is attempted. + +Thus the successful outputs are exactly `[R,S]` for absent or `system`, and `[R,A]` for `arena`; unsuccessful prefixes are exactly `[]`, `[R]`, and (only for a fully written `arena-stop` allocator line) `[R,A]`. This accounts for both stdout failure points on every path where the second exists; a write failure is an exit, so no later fact is consumed. + +Freshness is ordered, not inferred from an endpoint. A successful `arena` run necessarily wrote `R` before `A`. By the accepted entry, changing the same target directory's raw value to `arena-stop` makes that selection stale and reruns the script before current selection. The rerun either fails writing `R`, fails writing `A`, or writes both then explicitly panics. Every case is unsuccessful, and the entry forbids both a current compilation and presentation of the earlier arena library as the current result. The canary therefore rejects. + +## Configuration selection and exclusion + +On a successful selector run, the TCB gives exactly one allocator cfg; it also gives `feature="burst"` iff enabled and the exact `target_arch` for each listed target. For wasm32/arena, `all(target_arch="wasm32", fixture_allocator="arena")` is true, so the `cfg` attribute includes `compile_error!`; compilation fails for both feature states and all `P,D`. For every other tuple, that conjunction is false and the item is removed. Partial `arena-stop` output never reaches this stage. This proves effective rejection, rather than merely assuming the policy exclusion. + +## API, invariant, and obligation coverage + +The only crate public surface is safe `pub fn lane_id(u8)->NonZeroU8`. There are no fields, constructors beyond that function, traits/impls, statics, FFI, callbacks, exported macros, hidden APIs, dependencies, or mutable state. The only unsafe sites are its two configuration-complementary calls to `new_unchecked`. The required local proposition at either call is `NZ(value): value != 0`. + +Let `B(c) = (f=on and t=aarch64-unknown-linux-gnu and a=arena)`. The two `cfg` predicates are literally `B` and `not(B)`, so exactly one block exists for every `c in C`; profile and debug state occur in neither selection nor proof. + +* If `B(c)`, source calls `new_unchecked(value)` without a check. `NZ` holds exactly when `value!=0`. The comment “Burst-mode lane identifiers are never zero” is false as an invariant: the safe signature admits every `u8`, and no producer or boundary restricts it. +* If `not B(c)`, `value==0` reaches `panic!` before the unsafe call. Otherwise the exhaustive complement is `value!=0`, establishing `NZ`; `new_unchecked` is then permitted. The adjacent second safety comment states the controlling local fact and is correct. + +### Exact maximal sound region + +Over the requested complete product and inputs, define + +`SOUND = {(c,x) in C×u8 | not(B(c) and x=0)}`. + +`SOUND` is sound: partition on `B`; in `B`, its formula gives `x!=0`, and outside `B`, zero panics before unsafe while nonzero proves `NZ`. These cases exhaust `SOUND`. It is exact: its complement within `C×u8` is exactly `{(c,0) | c in C and B(c)}` by Boolean algebra. Every such tuple reaches `new_unchecked(0)`, whose checked contract says that is UB. Consequently any strict superset of `SOUND` within `C×u8` contains an unsound tuple; `SOUND` is the unique maximal region. This proof is parametric over every `p in P` and both `d in D`. + +The universal soundness claim is therefore **UNSOUND**. A certificate is any supported `c` with aarch64 target, burst on, arena allocator, arbitrary profile/debug state, plus the well-typed safe call `lane_id(0)`: the first cfg block is selected, the unchecked call is executed, its required `value!=0` proposition is false, and its version-matched contract expressly entails UB. + +For the documented “Panics when `value` is zero” postcondition, the exact proved region is `{c in C | not B(c)}`: the equality is true and `panic!` is reached before unsafe. In `B`, zero reaches UB instead. An execution containing UB cannot certify `CONTRACT-BROKEN`, and no independent UB-free non-panicking zero execution is established; hence the full postcondition is **UNPROVED**, not `CONTRACT-BROKEN`. + +## Findings and remediation + +**F-1 — UNSOUND, critical.** `src/lib.rs`'s aarch64/burst/arena safe branch has an unenforced nonzero precondition and a false safety comment. Minimum repair: perform the same zero check on that branch, or use checked `NonZeroU8::new(value)` and panic on `None`; then replace the comment with the actual dominating derivation. Making the safe function unsafe would be a breaking and unnecessary alternative. Re-audit the new snapshot and the panic claim. + +**F-2 — postcondition UNPROVED.** The same region prevents a universal panic proof. F-1's checked repair also resolves it; wording alone cannot repair either result. + +No tool-derived evidence or additional assumptions were used. Residual scope excludes manual rustc invocation, invented cfgs, overridden build scripts, unlisted targets/toolchains, and binary/backend correctness exactly as the policies require. Re-audit on any source, support product, Cargo/Rust/std identity, build interface, cfg, TCB disposition, or documentation-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/F.md new file mode 100644 index 0000000000..5578f5219e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/F.md @@ -0,0 +1,203 @@ +# Unsafe Rust audit: `ordered-build-target` + +## Claim, snapshot, and verdicts + +This is a source-only audit of the complete supplied snapshot: `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`. +No build, execution, test, or expansion was used. The theorem is for Rust/Cargo +1.85.1, edition 2021, at the 2026-08-01 cutoff; it makes no backend or binary +claim. `BUILD-MAP-ORDERED` in the supplied `TCB.md` is the accepted TCB +revision. No dependency, tool-result, or additional implementation premise is +consumed. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe call to `lane_id` in every supported current library is free of Rust UB | **UNSOUND** | F-01 gives a valid safe call, reachability, false unsafe precondition, and authoritative UB consequence. | +| Documented postcondition “Panics when `value` is zero” over every supported library configuration | **UNPROVED** | Proved outside the exceptional configuration; its only zero execution has UB, so it cannot prove `CONTRACT-BROKEN`. | +| Ordered selector mapping, rejection, and `arena`→`arena-stop` freshness | **PROVED relative to `BUILD-MAP-ORDERED`** | B-01/B-02 below. | +| Required wasm32/arena exclusion | **PROVED** | B-03: the selected source necessarily fails compilation. | + +The combined mandatory result is therefore **UNSOUND** for soundness and +**UNPROVED** for the panic postcondition, not `CONTRACT-BROKEN`. + +## Exact theorem domain + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `F={off,on}` be `burst`; `A={system,arena}`; `P` be every Cargo profile; and + `D={off,on}` be debug assertions; +* `Q = T×F×A×P×D \ { (wasm32-unknown-unknown,f,arena,p,d) }`; and +* `U` be every value of type `u8`. + +This is an equality normalization of `SUPPORT.md`: it states exactly those +three targets, both feature and allocator states, every profile and both debug +assertion states, then removes exactly wasm32/arena for either feature. The +manifest fixes Rust 1.85.1/edition 2021 and declares only `burst`. `BUILD.md` +defines allocator selection. There is no policy conflict and no release +interval to extrapolate. Raw environment classes rejected below are build +interface cases, not extra members of `A`. Profiles/debug assertions do not +occur in the source predicates or arithmetic, so the proofs are parametric in +`P,D`. + +Write +`C(q) := (F=on ∧ T=aarch64-unknown-linux-gnu ∧ A=arena)`. +The **exact maximal sound region** over the requested full product is + +`S = { (q,v) ∈ Q×U | ¬C(q) ∨ v≠0 }`. + +The proof of both inclusion and maximality appears under S-01/S-02. + +## B-01: complete ordered build relation + +Let `R`, `L_s`, and `L_a` denote the newline-terminated rerun, system-cfg, and +arena-cfg lines literally present in `build.rs`. Let `p(X)` mean whatever bytes, +if any, a failed attempt to print `X` emitted; it may be empty or include a +complete line. Its exact bytes are immaterial because the accepted TCB says any +stdout-write failure is an unsuccessful script and supplies no current library. + +For **every** raw class, the first event is an attempt to print `R`. If it +fails, execution stops by `println!` panic with output `p(R)`; the environment +is not read, and there is no library. If it succeeds, the remaining exhaustive +relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Events after `R`, in order | Output/exit | Current result | +|---|---|---|---| +| omitted | `env::var` gives `NotPresent`; attempt `L_s` | failure: `R+p(L_s)`, write panic; success: `R+L_s`, normal return | none on failure; exactly cfg `fixture_allocator="system"` and library attempt on success | +| Unicode `system` | `Ok`; `as_str`; literal arm; attempt `L_s` | same two outcomes | same | +| Unicode `arena` | `Ok`; `as_str`; literal arm; attempt `L_a` | failure: `R+p(L_a)`, write panic; success: `R+L_a`, normal return | none on failure; exactly cfg `fixture_allocator="arena"` and library attempt on success | +| Unicode `arena-stop` | `Ok`; literal arm; attempt `L_a`; if successful, explicit `panic!` | `R+p(L_a)`, write panic, or `R+L_a`, explicit panic | none in either case | +| every other Unicode value | `Ok`; wildcard arm; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | +| every non-Unicode value | `NotUnicode`; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | + +Thus the only normal exits are omitted/system→system and arena→arena, each +after exactly two successful stdout writes. `BUILD-MAP-ORDERED` is consumed +literally: a successful current script gives the library exactly its current +selector directive and no retained selector; an unsuccessful script gives no +current compilation or stale result. It also supplies the requested feature +and target cfg mapping. The source-level ordering/partition follows from the +arms at `build.rs:4-25`; no endpoint-only inference is used. + +## B-02: freshness certificate + +Assume a successful `arena` build in target directory `X`. Its successful `R` +records the raw variable dependency and its `L_a` selects arena. Changing the +present value to `arena-stop` makes that result stale under +`BUILD-MAP-ORDERED`, so Cargo reruns the script before current selection. The +rerun has exactly three possibilities: first write failure (`p(R)`), second +write failure (`R+p(L_a)`), or both writes followed by the explicit panic +(`R+L_a`). Every possibility exits unsuccessfully. The accepted premise says +none compiles a current library or presents the earlier arena library as this +build's result. The requested reuse sequence therefore rejects exactly as +documented. + +## B-03: source exclusion and source selection + +On target wasm32 with a successful arena selector, the accepted TCB supplies +both `target_arch="wasm32"` and `fixture_allocator="arena"`. The first cfg in +`src/lib.rs` therefore includes `compile_error!` for either feature, profile, +or debug state, and compilation fails. Hence every and only listed +target/allocator exclusion is effectively rejected; no current library API is +produced. + +For every `q∈Q`, cfg processing selects exactly one `lane_id` body: + +* if `C(q)`, lines 13-22 include the immediate unchecked return and lines + 24-37 are absent; +* if `¬C(q)`, the first block is absent and the second checks zero before its + unchecked constructor. + +The public safe surface is exactly `pub fn lane_id(u8)->NonZeroU8`. There are no +public fields, unsafe APIs/traits/impls, callbacks, exported macros, hidden +items, FFI, dependencies, or invariant-bearing stored state. The standard +macros are consumers of documented standard behavior, not generated public +surface. + +## Unsafe-operation and postcondition ledger + +**S-01 (`¬C`).** If `v=0`, the equality test enters `panic!` before unsafe code. +If `v≠0`, the dominating test establishes the sole precondition of +`NonZeroU8::new_unchecked(v)`; it returns a valid nonzero value. The adjacent +safety comment is an adequate local proof. This proves UB freedom for all +`P,D` and proves the zero-panic postcondition. + +**S-02 (`C`).** If `v≠0`, the unsafe constructor's sole precondition holds, so +this region is sound. If `v=0`, F-01 proves UB. Since zero/nonzero and +`C/¬C` are exhaustive, every point of `S` is proved sound and every point of +`(Q×U)\S` is proved unsound. Consequently no strict superset of `S` within +`Q×U` is sound: this establishes exact maximality, not merely a positive +remainder. + +**POST-01.** The documented implication `v=0 ⇒ lane_id(v) panics` is proved for +`¬C`. For `C,v=0`, the execution reaches UB before a defined return or panic +can be certified. Under the required whole-execution rule, that execution +cannot witness `CONTRACT-BROKEN`; no independent UB-free refutation exists in +this source. The full-product postcondition is therefore `UNPROVED`. + +## F-01 — unchecked zero behind a safe API + +* **Status:** soundness **UNSOUND**; proof artifact deficient. +* **Valid use:** choose any `p∈P,d∈D`, target aarch64, `burst=on`, allocator + arena, and call the public safe `lane_id(0)`. This point belongs to `Q×U` and + requires no caller safety obligation. +* **Reachability:** `C` includes lines 13-22 and the function immediately calls + `NonZeroU8::new_unchecked(0)`. +* **False proposition:** that unsafe function requires a nonzero argument; zero + falsifies it. +* **UB consequence:** the exact standard-library contract states that zero + causes UB, independently confirmed by the Reference invalid-value rule. +* **Proof defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced constructor invariant and is false for caller-controlled `u8`. +* **Minimum repair:** make a dominating `value==0` panic check apply to the + exceptional block (or remove that block), then re-audit all cfg cases. Merely + editing the comment cannot repair the safe API. + +## Rust axioms and TCB audit + +The material Rust 1.85.1 propositions were checked against these narrowly +scoped authorities: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “returns an + error if the environment variable is not set, or if the value is not valid + Unicode”; [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” +* [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + sequentially execute component statements; [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + “branches on a pattern.” These ground the source order, while `BUILD.md` + supplies the claimed complete raw partition. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) “Prints + to the standard output, with a newline,” and its [panic contract](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + says it panics if stdout writing fails. [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached construct according to its predicate; + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” + The [equality operators](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + are equality/inequality tests, and an [if expression](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes its consequent when its boolean condition is true. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and “This results in undefined behavior if the + value is zero.” The [Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) + says producing an invalid value is immediate UB and names `NonZero` as a type + with a custom valid range. + +`BUILD-MAP-ORDERED` is accepted only for: Cargo 1.85.1 execution; successful +rerun-line freshness including present-to-present changes; exact current +successful cfg-line interpretation with no retained selector; no library/stale +result after unsuccessful script exit; main-thread panic as unsuccessful; and +the named feature/target cfgs. Consumers are B-01–B-03 and source reachability. +No claim about emitted strings, source correctness, Rust semantics, backend, or +binary is imported. Its stated trigger—any Cargo/toolchain, manifest, script, +environment, target, source-cfg, or disposition change—requires re-audit; +source/API/docs/support changes likewise do. + +## Residual scope and attestation + +Manual rustc, invented cfgs, build-script override, unsupported targets, and +rejected raw values producing a library are outside the theorem exactly as +`BUILD.md` states. Rejected build executions and wasm32/arena have no API point +and are not counted as vacuously sound members of `S`. Every discovered build, +configuration, safe-surface, unsafe-operation, and requested postcondition +obligation has a status above; there is no sampled evidence or unresolved +supported configuration remainder. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/G.md new file mode 100644 index 0000000000..b70a0f21ac --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/G.md @@ -0,0 +1,208 @@ +# Source-only unsafe-code audit: supplied crate + +**Cutoff:** 2026-08-01. **Snapshot:** the complete supplied `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and `TCB.md`; no generated +source, dependencies, lockfile, tests, or prior audit were supplied or used. +Rust, standard library, edition, and Cargo are exactly 1.85.1, 1.85.1, 2021, +and 1.85.1. This is a Rust-abstract-semantics result, not a compiler-binary or +platform theorem. + +## Claims and verdicts + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the compiled public library is free of Rust UB over the supported domain | **UNSOUND** | F-1 gives a valid supported safe call, reaches `new_unchecked(0)`, falsifies its safety condition, and its contract says the result is UB. | +| `lane_id(value)` “Panics when `value` is zero” | **UNPROVED** | Proved on `not(K)` below. The only failing region executes UB, so it is not a UB-free `CONTRACT-BROKEN` witness. | +| Exact maximal sound API region | **PROVED** relative to `BUILD-MAP-ORDERED` | Both containments and maximality are proved below. | +| Ordered selector/rejection/freshness relation and wasm/arena source exclusion | **PROVED** relative to `BUILD-MAP-ORDERED` | Exhaustive staged relation below. | + +The combined mandatory result is therefore **soundness UNSOUND; panic +postcondition UNPROVED**. No design change affects these current-snapshot +verdicts. + +## Domain recovery + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `B={off,on}` be `burst`, `A={system,arena}`, `P` any Cargo profile, `D` either + debug-assertion state, and `v:u8` any safe API input; +* `C0=T×B×A×P×D`; +* `E(c) := target=wasm32-unknown-unknown ∧ allocator=arena`; +* `S := C0 ∖ E`, the supported compiled-library configurations; and +* `K(c) := burst=on ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena`. + +This is an equality, not a sample: `SUPPORT.md` says “these target triples,” +“both states,” “both allocator models,” “exactly one exclusion,” and “every +other combination,” and explicitly quantifies every profile and both `D` +states. Thus every member of `S` is promised and every promised library +configuration is in `S`; there is no policy conflict. `Cargo.toml` independently +fixes the sole feature and toolchain. Profiles and `D` do not occur in a source +predicate or arithmetic operation, so every proof below is parametric over +their fibers. + +The full required cases are (i) every supported Cargo build attempt for each +raw environment class and every possible relevant stdout success/failure +sequence, including required rejection outcomes, and (ii) every safe +`lane_id(v)` execution for `c∈S`. Manual `rustc`, invented cfgs, and build-script +overrides are expressly outside `BUILD.md`. + +## Checked semantic authority + +These are Rust 1.85.1 axioms, not extra project assumptions: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says it + returns `NotPresent` when “The variable is not set” and `NotUnicode` when the + value “is not valid Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + has exactly those two variants. The fixed key contains neither `=` nor NUL. +* A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements,” and a + [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + compares arm patterns sequentially and chooses the first match. [Literal + patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the value created by the literal”; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” [`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + extracts a slice containing the entire `String`. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached form from its predicate; [`all`/`not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + are true when all operands are true / their operand is false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message.” +* The [comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + and [`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + rules make `value == 0` select its consequent exactly for zero. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + says: “The value must not be zero,” and “This results in undefined behavior + if the value is zero.” + +Cargo's 1.85.1 documentation corroborates, but does not replace, the accepted +Cargo premise: build scripts communicate by `cargo::` lines on stdout +([life cycle](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script)); +`rustc-cfg` passes the value to compiler `--cfg` +([outputs](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)); +and `rerun-if-env-changed` reruns when the named value changes +([freshness](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). +Process failure, current-output identity, and stale-artifact non-presentation +are consumed only in the narrower wording of accepted `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Write `R` for the complete rerun line, `Sline` for the system cfg line, and +`Aline` for the arena cfg line. A failed `println!` may have emitted an +unspecified fragment `q` of that attempted output; no proof consumes `q`. + +1. Every path first attempts `R`. Failure exits by uncaught panic with output + `q`, performs no environment read, and produces no current library. + Success leaves the complete prefix `[R]` and only then calls `env::var`. +2. The result partition is exhaustive: absent; Unicode `system`; Unicode + `arena`; Unicode `arena-stop`; every other Unicode string (including empty); + and non-Unicode. Absence and `system` next attempt `Sline`; `arena` and + `arena-stop` next attempt `Aline`. Failure at any such second write exits by + uncaught panic with `[R]·q` and no current library. +3. Successful absent/`system` writes yield exactly `[R,Sline]`, normal return, + and exactly cfg `fixture_allocator="system"`. Successful `arena` yields + exactly `[R,Aline]`, normal return, and exactly cfg + `fixture_allocator="arena"`. These are the only successful selectors. +4. Successful `arena-stop` writes `[R,Aline]` and then explicitly panics. + Other-Unicode and non-Unicode explicitly panic with exactly the completed + directive prefix `[R]`, before attempting any allocator line. By + `BUILD-MAP-ORDERED`, every unsuccessful process produces no current library + even if a complete selector line was emitted; no prior selector is retained. + +This includes every stdout failure point and every claim-relevant partial +prefix. The raw partition is exact by `env::var`/`VarError`, the four literal +arms, and the wildcard; it creates only the two allocator models. + +On a successful selector, `BUILD-MAP-ORDERED` supplies exactly that allocator +cfg, maps `burst` and the three target triples to the named leaf cfgs, and +supplies no old selector. For `E`, the crate-level `all(wasm32,arena)` is true +for both feature states and `compile_error!` fails compilation. Conversely, +within `C0`, that conjunction is true only on `E`; hence the enforced exclusion +equals, rather than merely contains, the policy exclusion. All `S` cases reach +`lane_id` source. + +**Freshness certificate.** A successful `arena` build necessarily completed +`R`. In the same target directory, changing the raw value to `arena-stop` is a +present-to-present change. The exact accepted premise therefore makes the old +selection stale and reruns the script before current selection. The rerun +either fails a write or completes `[R,Aline]` and panics; all alternatives are +unsuccessful, compile no current library, and cannot present the old arena +library as the current result. + +## API, obligations, and exact maximal sound region + +The boundary inventory is complete: the crate exports only the safe free +function `lane_id(u8)->NonZeroU8`. There are no public fields, constructors, +traits/impls, callbacks, FFI, reexports, hidden items, or generated APIs. Its +only unsafe operations are the two cfg-complementary `new_unchecked` calls. +There is no persistent invariant-bearing representation. + +Cfg semantics makes the first block present exactly on `K` and the second +present exactly on `not(K)`; these predicates are complements, so exactly one +unsafe call exists in every `S` compilation. + +Define + +`M := {(c,v) ∈ S×u8 | ¬K(c) ∨ v≠0}`. + +**`M` is sound.** If `¬K` and `v=0`, the equality is true and `panic!` is +executed before the unsafe call; panic is not UB. If `¬K` and `v≠0`, that +branch is skipped and the dominating comparison establishes the exact +`new_unchecked` precondition. If `K` and `v≠0`, the input itself establishes +that precondition. These cases exhaust `M`; profile, debug assertions, and +panic strategy do not alter selection or the precondition. + +**Maximality/equality.** Inside `S×u8`, Boolean and integer case splitting gives +`(S×u8) ∖ M = {(c,0) | c∈S ∧ K(c)}`. Every such case reaches +`new_unchecked(0)`, whose required proposition is false and whose applicable +contract entails UB. Thus every point in `M` is sound and no point outside it +can be added: `M` is the exact maximal sound region. Over the pre-exclusion +product `C0×u8`, `E×u8` is rejected rather than a compiled API region; the +exact sound-or-rejected region is `(E×u8) ∪ M`. + +For the panic postcondition, all `¬K,v=0` cases execute `panic!`. The +`K,v=0` cases instead enter UB. Under whole-execution classification they prove +neither that a panic occurs nor a UB-free failure to panic, so the universal +postcondition is **UNPROVED**, not `CONTRACT-BROKEN`. + +## Finding F-1: unchecked zero in the special branch + +* **Implementation:** **UNSOUND**; **proof artifact:** false/deficient. +* **Valid use:** successfully build supported `aarch64-unknown-linux-gnu` with + raw `arena`, `burst` enabled, any profile/debug state, then safe-call + `lane_id(0)`. Safe callers have no precondition. +* **Reachability:** all three leaves of `K` are true, so the special block calls + `new_unchecked(0)`. +* **False proposition and consequence:** required `value≠0` is false; the + version-matched contract explicitly entails UB. +* **Comment defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced producer contract and is contradicted by the public `u8` input. +* **Minimum repair:** perform the zero check before every cfg-dependent unsafe + call (or use a checked constructor) and replace the comment with the + dominating-check derivation. Re-audit `M` and the panic contract. Merely + changing documentation cannot repair the safe API. + +The fallback comment's local fact is correct: its zero branch dominates the +unsafe call. No other implementation or proof finding was found after the +complete surface/configuration inventory; this does not dilute F-1. + +## TCB, residual scope, and triggers + +The sole admitted project entry is `TCB.md` / **BUILD-MAP-ORDERED**, accepted +for exact Cargo 1.85.1 and only its stated execution, stdout-success, +freshness, process-status, feature, target-cfg, and selector-identity +propositions. Consumers are the staged relation, reachability, freshness, and +exclusion proof above. It supplies no Rust semantics or source correctness and +has not been widened. The Rust links above are authoritative axioms. There are +no dependency, tool-derived, external, probabilistic, deployment, or backend +premises and no test evidence. + +Re-audit on any supplied source/policy/manifest change; Rust, std, Cargo, target, +feature, profile, cfg, allocator, environment interface, or TCB change; changed +authoritative wording; or any new public/unsafe surface. All requested source +and build outcomes were audited; binaries, actual compiler correctness, +platform execution, manual cfg injection, and target files not supplied are +outside scope. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/H.md new file mode 100644 index 0000000000..069ed51e9b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/H.md @@ -0,0 +1,107 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +## Claims, scope, and verdicts + +This is a source-only audit of `Cargo.toml`, `build.rs`, `src/lib.rs`, and the supplied build, support, request, and TCB policies, at cutoff 2026-08-01. It covers Rust/Cargo/standard library 1.85.1, the complete supported build interface, the only public safe API, both unsafe operations, the source-enforced exclusion, and the documented panic postcondition. No binary/backend claim is made; nothing was built, run, tested, generated, or expanded. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every valid safe `lane_id` call in the required library domain is free of Rust UB. | **UNSOUND** | `SOUND-1` below gives a valid supported zero-input witness reaching documented UB. | +| “Panics when `value` is zero” throughout that domain. | **UNPROVED** | Proved outside `U`; inside `U` the only execution has UB, so it cannot certify `CONTRACT-BROKEN`. | +| Ordered build mapping, rejection, and freshness behavior. | **PROVED relative to accepted `BUILD-MAP-ORDERED`** | Exhaustive raw-value/write-outcome partition `BUILD-1`; freshness proof `BUILD-2`. | +| wasm32/arena is effectively excluded. | **PROVED relative to `BUILD-MAP-ORDERED`** | `CFG-1`: every successful arena selection for wasm32 activates `compile_error!`. | +| Formula `S` below is the exact maximal sound region. | **PROVED relative to the stated TCB** | Positive proof on `S`; UB proof at every point of its complement in the supported domain. | + +The combined mandatory result is **UNSOUND; documented postcondition UNPROVED**. + +## Required theorem domain and closure + +Let `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, wasm32-unknown-unknown}`, `B={burst-off,burst-on}`, `A={system,arena}`, `P` be every Cargo profile, and `D={debug-assertions-off,on}`. The policy's full product is + +`F = T × B × A × P × D`. + +Its exact supported library predicate is + +`C = F ∖ {c ∈ F | target(c)=wasm32-unknown-unknown ∧ allocator(c)=arena}`. + +This is an equality, not an inferred narrowing: `SUPPORT.md` gives precisely these axes, all their combinations, and exactly that exclusion. `Cargo.toml` fixes Rust 1.85.1/edition 2021 and declares `burst`; `BUILD.md` fixes allocator selection. Profiles and debug assertions never occur in either selected function body, so all proofs below are parametric over `P×D`. + +Build-interface `Required` additionally quantifies over every raw `FIXTURE_ALLOCATOR` class (omitted, `system`, `arena`, `arena-stop`, other Unicode, non-Unicode) and success/failure of every attempted stdout write. A current API execution exists only after an accepted selector's successful script exit and successful non-excluded library compilation. For API soundness, `Required=C×{0,…,255}`: `u8` is the “8-bit unsigned integer type” ([`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)), and this safe function states no caller precondition. + +Closure is exhaustive: `BUILD-1` partitions all build cases; `C` partitions into `U` and `¬U`; inputs partition into zero and nonzero. Each obligation below covers every resulting case, so no sampled configuration substitutes for `Required ⊆ Covered`. + +## Authoritative Rust 1.85.1 premises + +These are the only Rust semantic axioms consumed: + +- **AX-ENV.** `env::var` returns `NotPresent` when “The variable is not set” and `NotUnicode` when its value “is not valid Unicode” ([`var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); `VarError` has exactly `NotPresent` and `NotUnicode(OsString)` ([`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html)). `String::as_str` “Extracts a string slice containing the entire `String`” ([`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). A match chooses “The first arm with a matching pattern” ([match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)); literal patterns match their literal and `_` matches any value ([literal](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern)). +- **AX-OUT/PANIC.** `println!` “Panics if writing to `io::stdout` fails” ([`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). +- **AX-CFG.** A `cfg` attribute “conditionally includes the thing it is attached to” ([`cfg`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); `compile_error!` “causes compilation to fail with the given error message” ([`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +- **AX-CONTROL.** For `if`, a true condition executes the consequent block ([`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is an equality operator ([comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). Thus the `u8` comparison exactly separates zero from nonzero. +- **AX-NZ.** `NonZero::new_unchecked` “Creates a non-zero integer value without checking”; “This results in undefined behavior if the value is zero” ([`new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). This is also the Reference's UB class “producing an invalid value” ([undefined behavior](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). + +## Ordered build-to-source relation + +Write `R` for the complete rerun line and `S`/`A` for complete `system`/`arena` cfg lines. `q(L)` means any byte prefix produced by the failing `println!` for line `L` (possibly empty); regardless of those bytes, the TCB says an unsuccessful execution supplies no current library. + +| Raw class and ordered events after entry | Emitted prefix; exit; current result | +|---|---| +| Any raw value; first print fails | `q(R)`; println panic/unsuccessful; no library | +| omitted or Unicode `system`; `R` succeeds; `S` fails | `R,q(S)`; println panic; no library | +| same; both prints succeed | `R,S`; normal return; cfg `fixture_allocator="system"` | +| Unicode `arena`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; both succeed | `R,A`; normal return; cfg `fixture_allocator="arena"` | +| Unicode `arena-stop`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; `A` succeeds | `R,A`; explicit panic; no library | +| other Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | +| non-Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | + +**BUILD-1.** AX-ENV and the fixed valid key make `env::var`'s result exactly absent, valid-Unicode `String`, or non-Unicode. AX-ENV/match/literals then select exactly the listed source arm. There are only the two `println!` sites in execution order; AX-OUT establishes each failure exit. Falling through `main` is successful. `BUILD-MAP-ORDERED` supplies only the stated Cargo consequences: a successful current script passes its exact cfg; every panic/write-failure exit compiles/presents no current library. Thus even a complete allocator directive in the `arena-stop` prefix has no effect. + +**BUILD-2 (freshness).** A successful `arena` run necessarily wrote `R` then `A`. The accepted TCB says that changing the raw present value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly three possibilities above: first print failure; `R` followed by allocator-print failure; or `R,A` followed by explicit panic. All are unsuccessful, and the TCB expressly forbids presenting the old arena library as the current result. The canary therefore rejects under reuse of the same target directory. + +**CFG-1.** On a successful arena selector, the TCB maps its emitted cfg exactly and maps the three target triples to their stated `target_arch`. AX-CFG makes `all(target_arch="wasm32", fixture_allocator="arena")` include `compile_error!` for both feature states; AX-CFG then forces compilation failure. Other raw rejection cases never reach current library compilation. The project exclusion is therefore enforced. + +The complete successful-output-to-source projection is therefore: + +| Emitted allocator cfg | Target/feature | Selected library source/result | +|---|---|---| +| `system` | every `T×B` | no source error; `U` is false; checked block | +| `arena` | x86_64, either feature | no source error; `U` is false; checked block | +| `arena` | aarch64, burst off | no source error; `U` is false; checked block | +| `arena` | aarch64, burst on | no source error; `U` is true; unchecked burst block | +| `arena` | wasm32, either feature | `compile_error!`; no current library artifact | + +No other allocator cfg reaches a current compilation. These cases are exhaustive by `BUILD-1` and the TCB's exact feature/target mappings. + +## API, obligations, and exact maximal sound region + +The entire public surface is safe free function `lane_id(u8)->NonZeroU8`; there are no public fields/types, traits, callbacks, FFI, reexports, hidden items, or generated/macro-generated APIs. `build.rs::main` is the audited build entrypoint. The two cfg-complementary `new_unchecked` calls are the only unsafe operations. The sole invariant consumed/established is that the returned `NonZeroU8` contains a nonzero integer. + +Define + +`U(c) := burst(c)=on ∧ target(c)=aarch64-unknown-linux-gnu ∧ allocator(c)=arena`. + +The exact maximal sound region over the full supported product and every API input is + +`S = {(c,v) ∈ C×{0,…,255} | ¬U(c) ∨ v≠0}`. + +**Positive proof.** If `U(c)`, AX-CFG includes only the first block; for `v≠0`, AX-NZ's sole safety requirement holds and it constructs the promised nonzero value. If `¬U(c)`, AX-CFG includes only the checked block. At `v=0`, AX-CONTROL reaches `panic!` before unsafe code. At `v≠0`, it skips the panic and the dominating comparison establishes AX-NZ's precondition. These cases cover `S`, independently of profile/debug-assertion state. + +**SOUND-1 and maximality.** Choose any profile/debug state, successful raw `arena`, aarch64 target, `burst` enabled, and safe input `0`. This configuration lies in `C`; `0` is a valid `u8`; the public call is valid safe use. `U` includes the unchecked block, which executes `new_unchecked(0)`. AX-NZ says that exact event is UB. Hence the full universal claim is **UNSOUND**. Every point of `(C×u8)\S` has exactly those three cfg facts and `v=0`, so the same proof establishes UB everywhere outside `S`; together with the positive proof, `S` is maximal, not merely a positive remainder. + +**Panic postcondition.** For every `c∈C` with `¬U(c)` and `v=0`, the checked branch invokes `panic!`, proving the documented implication. For `U(c),v=0`, execution instead has UB. Under the required whole-execution certificate, that is not a UB-free witness to a broken behavioral contract. Therefore the full postcondition is **UNPROVED**, not `CONTRACT-BROKEN`; its exact unresolved region is `{(c,0)|c∈C∧U(c)}`. + +## Finding and proof-artifact assessment + +**F-1 (critical implementation defect).** The first safety comment claims burst-mode lane identifiers are never zero, but the safe boundary accepts arbitrary `u8` and establishes no such invariant. The smallest repair is an unconditional zero check before either unsafe call (or a safe checked constructor), preserving the documented panic contract. Re-audit all cfg regions afterward. + +The second comment's dominating `value==0` branch does establish the required nonzero fact, so its implementation proof is correct on `¬U`; for proof-grade maintenance it should also name `new_unchecked`'s exact requirement and resulting `NonZeroU8` invariant. The first comment is false, not merely incomplete. + +## TCB audit log, evidence, residual scope, and triggers + +`BUILD-MAP-ORDERED` is the sole non-Rust admitted premise. Its human disposition is accepted only for Cargo 1.85.1, this exact manifest/build script/environment/library, successful-line interpretation, freshness/no-stale-result behavior, failure status, feature cfg, and target-arch cfg. This report consumes every listed part only in `BUILD-1`, `BUILD-2`, `CFG-1`, and reachability; it does not use it for source correctness. AX-ENV through AX-NZ are exact versioned Rust authority, not implementation trust. There are no dependencies, unsafe dependencies, tool results, tests, prior audits, or additional assumptions. + +Excluded/residual scope: compiler/backend correctness, binaries, custom/manual rustc cfgs, overridden build scripts, unsupported targets/toolchains, rejected raw selectors, and wasm32/arena artifacts. Re-audit on any source/manifest/policy/TCB change; Rust/Cargo/stdlib version change; target, feature, allocator, profile, environment, or cfg-domain change; or material authoritative-documentation change. + +All in-scope surfaces, raw classes, exits, prefixes, obligations, configuration partitions, mandatory postconditions, TCB consumers, and unresolved regions have dispositions. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/I.md new file mode 100644 index 0000000000..ab56821442 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/I.md @@ -0,0 +1,190 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +Audit cutoff: 2026-08-01. This is a source-level Rust 1.85.1/standard-library +1.85.1 audit of the supplied manifest, policies, `TCB.md`, `build.rs`, and +`src/lib.rs`; no backend or binary claim is made. No dependency, generated +file, test, prior audit, or tool result is present or used. + +## Claims and verdicts + +* **Safe-library soundness: UNSOUND.** A supported, well-typed safe call reaches + `NonZeroU8::new_unchecked(0)` (certificate `BAD` below). +* **Documented panic postcondition: UNPROVED**, not `CONTRACT-BROKEN`. It is + proved wherever its antecedent is relevant outside `BAD`; in `BAD`, the only + source execution already has undefined behavior, so it cannot be the required + UB-free postcondition witness. +* **Ordered build interface and exclusion: PROVED relative to the accepted + `BUILD-MAP-ORDERED` premise.** This includes all raw-selector classes, write + failures, partial prefixes, current-build rejection, and the stated + arena-to-arena-stop freshness sequence. + +The combined mandatory result is therefore **UNSOUND / postcondition +UNPROVED**, relative only to `TCB.md`'s accepted, exact Cargo premise and the +Rust axioms quoted below. + +## Exact domain and its recovery + +Let + +* `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`, `B={off,on}`, `A={system,arena}`; +* `P` be every Cargo profile and `D={debug_assertions off,on}`; and +* `U={0,...,255}`, exactly the values of `u8`. + +`SUPPORT.md` literally defines the base product `C0=T×B×A×P×D` and the sole +exclusion `E={c∈C0 | c.target=wasm32-unknown-unknown ∧ c.allocator=arena}`. +Thus the supported library predicate is exactly `C=C0\E`: `C⊆C0\E` follows +from “every other combination ... is supported,” and `C0\E⊆C` follows from +the same exhaustive product statement; the single exclusion proves the reverse +nonmembership. Rust/Cargo are exactly 1.85.1 and the edition is 2021. + +The raw environment partition is the disjoint, exhaustive set +`R={absent, U("system"), U("arena"), U("arena-stop"), U(other), non-U}`. +Here `U(other)` means every other Unicode string. `env::var` “Returns a +`VarError` if the variable is not present, or if it is not valid Unicode” +([Rust 1.85.1 `env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); +the two documented error variants and the `Ok(String)` case, followed by +equality with the three literals and `_`, prove both coverage and disjointness. +`String::as_str` “Extracts a string slice containing the entire `String`” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). +Accepted fibers are `absent,U("system") -> system` and `U("arena") -> arena`; +the other three are rejection cases, not allocators. Manual `rustc`, invented +cfgs, and build-script overrides are expressly outside `BUILD.md`'s theorem. + +The full required case domain is (i) every build-interface execution over `R`, +the supported target/feature/profile/debug axes, each stdout success/failure +possibility, and reusable prior Cargo-target state, plus (ii) every safe +`lane_id(v)` call for `(c,v)∈C×U` produced by an accepted current build. This +retains inputs, execution/history, and configuration rather than replacing +them by `Required_cfg=C`. + +## Complete ordered build relation + +Write `RERUN` for the complete first line and `CFG(a)` for the allocator line. +Blocks execute operations sequentially and a match chooses the first matching +arm ([block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html), +[match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). +`println!` “Panics if writing to `io::stdout` fails” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)). +Consequently: + +| Raw class | after successful `RERUN` write | terminal result if later writes succeed | +|---|---|---| +| absent | read `NotPresent`; attempt `CFG(system)` | return success | +| `U("system")` | read `Ok`; attempt `CFG(system)` | return success | +| `U("arena")` | read `Ok`; attempt `CFG(arena)` | return success | +| `U("arena-stop")` | read `Ok`; attempt `CFG(arena)` | explicit panic after that complete line | +| `U(other)` | read `Ok`; no allocator write | explicit unsupported-value panic | +| non-U | read `NotUnicode`; no allocator write | explicit valid-Unicode panic | + +This table lists every successful script path: exactly its first three rows. +Before every row, failure of the first write exits by panic with no complete +line (and possibly a byte-prefix of `RERUN`); the environment read and all later +steps are unreached. In the four rows that attempt `CFG`, failure of that second +write exits by panic after complete prefix `[RERUN]` (and possibly a byte-prefix +of `CFG`); its return or explicit later panic is unreached. The successful +`arena-stop` write produces complete prefix `[RERUN,CFG(arena)]` before its +explicit panic. The other explicit rejections leave complete prefix `[RERUN]`. +These are all stdout calls and all alternative exits in `build.rs`. + +`BUILD-MAP-ORDERED` supplies, for Cargo 1.85.1 and every profile, exactly the +following consumed facts: a complete successful `RERUN` registers changes in +the raw value (including present-to-present); only a successful current script's +complete `CFG(a)` reaches the current library compilation; no prior selector is +retained; any write failure or uncaught explicit panic is unsuccessful; and an +unsuccessful script yields no current library or prior artifact as the current +result. Therefore arbitrary failed-write byte prefixes and every complete +prefix above are inert for source selection. + +**Freshness witness.** For a successful arena build (necessarily x86_64 or +aarch64 once the source exclusion is applied), the first run successfully wrote +`RERUN,CFG(arena)`. In the same target directory, raw `arena -> arena-stop` is a +registered present-to-present change, so Cargo reruns before selection. The new +run either fails at write 1, fails at write 2, or writes both lines and then +panics. Every exhaustive case is unsuccessful and `BUILD-MAP-ORDERED` forbids +both a current compilation and presentation of the earlier arena library. + +**Target exclusion.** A successful raw-arena script gives exactly +`fixture_allocator="arena"`; the accepted TCB maps the wasm triple to +`target_arch="wasm32"`. The `all` predicate on `lib.rs:3` is then true, +regardless of `burst`. A `cfg` attribute includes its item when true and removes +it when false +([Reference 1.85.1](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); +`compile_error!` “Causes compilation to fail with the given error message when +encountered” +([std 1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +Thus every wasm/arena current compilation fails; if the script failed earlier, +the TCB already forbids compilation. No later-source fact is used on that exit. +For all other target/allocator pairs this particular `all` is false, so the +error item is absent. This proves exactly `E`, not a wider exclusion. + +## API, invariants, and unsafe obligations + +The complete language-reachable crate API is the safe free function +`lane_id(u8)->NonZeroU8`; there are no public fields, constructors of a local +type, traits/impls, macros, statics, FFI, reexports, callbacks, or dependencies. +Build code contains no unsafe operation. The two unsafe sites are +`lib.rs:21` and `lib.rs:36`. The consumed standard-library contract is exact: +`new_unchecked` “Creates a non-zero without checking whether the value is +non-zero. This results in undefined behavior if the value is zero,” and its +safety clause is “The value must not be zero” +([Rust 1.85.1](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +Define `H(c) = c.target=aarch64-unknown-linux-gnu ∧ c.burst=on ∧ +c.allocator=arena`. Accepted Cargo mappings and Rust `cfg(all(...))` semantics +make `H` select the first block and remove the `not(all(...))` block; `¬H` does +the reverse. + +* If `H(c)∧v!=0`, line 21 satisfies the exact unsafe precondition and returns + the corresponding nonzero value. +* If `¬H(c)∧v=0`, `if value==0` reaches `panic!` before line 36. If + `¬H(c)∧v!=0`, the false branch itself establishes the proposition needed by + line 36. Thus the second safety comment is adequate and this entire case is + UB-free. Profile, debug-assertion state, and panic strategy cannot alter the + cfg or value partition; abort versus unwind occurs only after the proved + zero-input panic and no invariant is suspended. +* **`BAD`:** choose any profile/debug state, `c=(aarch64,burst on,arena,...)∈C` + and safe input `v=0`. The public safe call is valid; `H(c)` reaches line 21; + its required `v!=0` proposition is false; the quoted contract directly + entails undefined behavior. This is a complete existential UB certificate. + The adjacent claim “Burst-mode lane identifiers are never zero” is false: + the API accepts every `u8` and enforces no such invariant. + +Therefore the **exact maximal sound region** over the requested full product is + +`SOUND = C×U \ { (c,0) | H(c) }`. + +Positive inclusion follows from the first two bullets. Reverse inclusion and +maximality follow because every omitted case satisfies `H∧v=0` and the `BAD` +derivation is parametric in profile/debug state, proving UB for every such +case—not merely one sample. The regions partition `C×U` exhaustively by +`H/¬H` and `v=0/v!=0`. + +The panic postcondition is proved for every zero input in `¬H`: the check +executes `panic!`, which “Panics the current thread” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). It imposes no +claim for nonzero inputs. For `H∧v=0`, UB precedes any panic, leaving the global +postcondition `UNPROVED` and supplying no `CONTRACT-BROKEN` certificate. + +## Finding, TCB log, and residual scope + +**F-1 (critical, UNSOUND; proof comment deficient).** `lib.rs:13-22` hides an +unenforced nonzero precondition behind a safe API. Minimum repair: perform the +zero check before either cfg branch (or use checked `NonZeroU8::new` and panic +on `None`), then replace the first safety comment with the dominating check's +exact `value!=0` derivation. Re-audit all `C×U`, both panic strategies, and the +documented panic after any change. + +**TCB log `supplied-TCB/BUILD-MAP-ORDERED`.** Category `IMPLEMENTATION`, human +disposition accepted; identity Cargo 1.85.1 plus the supplied manifest/build +interface; consumers are only ordered output interpretation, raw-value +freshness, feature/target/cfg reachability, selected source, and rejection. It +does not supply local emission order, source correctness, Rust semantics, +backend, or binary correctness; those were not widened. No other admitted +premise is consumed. Re-audit on any toolchain, source, manifest, policy, +target, cfg, feature, environment-interface, or TCB-disposition change. + +Residual scope: compiler/backend correctness, binaries, manually manufactured +cfgs, unsupported targets/toolchains, and overridden build machinery. Tool +evidence: none. The current global failure is proved rather than inferred from +missing tests. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/J.md new file mode 100644 index 0000000000..bfc973ce24 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/reports/J.md @@ -0,0 +1,199 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +Snapshot: the supplied `Cargo.toml`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, +`build.rs`, and `src/lib.rs`; Rust and standard library 1.85.1, edition 2021. +No target was built, run, expanded, or modified. There are no dependencies or +generated source files. The only accepted non-Rust premise is +`BUILD-MAP-ORDERED` in the supplied `TCB.md`. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {off,on}` for `burst`, `A = {system,arena}`, `P` be every Cargo + profile, `D = {off,on}` for debug assertions, and `U = {0,...,255}`; +- `Q = {1.85.1} × T × B × A × P × D`; and +- `L = Q \ {q | target(q)=wasm32-unknown-unknown ∧ allocator(q)=arena}`. + +`Q` is the literal product in `SUPPORT.md`; the displayed subtraction is its +sole stated exclusion, so both containments establishing this normalization +follow directly from lines 3–16. Required library/API cases are `L × U`. +Profiles, debug assertions, and their panic strategies remain symbolic: no +source predicate or unsafe precondition depends on them. + +**Soundness: UNSOUND** for the complete crate over the required source-level +domain, relative to `BUILD-MAP-ORDERED`. A valid witness is any profile/debug +state with target `aarch64-unknown-linux-gnu`, `burst=on`, allocator `arena`, +and the safe call `lane_id(0)`. This configuration is in `L`. The selected +block at `lib.rs:12–20` executes `NonZeroU8::new_unchecked(0)`. Its safety +condition is false and its exact 1.85.1 contract says this is undefined +behavior (AX-5 below). This completes the existential certificate. + +**Documented postcondition: UNPROVED** globally. `lib.rs:8–10` promises that +`lane_id` “Panics when `value` is zero.” This is proved regionally whenever +`C(q) := burst(on) ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena` is +false: zero enters `lib.rs:28–30` and panics before unsafe code. In the `C` +region, zero instead reaches UB. That refutes soundness but cannot be a +`CONTRACT-BROKEN` witness because the execution is not UB-free as a whole; no +independent UB-free refutation is established. + +### Exact maximal sound region + +The exact maximal sound subset of the full supported configuration/input +domain is + +`M = {(q,v) ∈ L × U | ¬(C(q) ∧ v=0)}`. + +Proof of inclusion: if `C` is true and `v≠0`, `lib.rs:12–20` supplies the exact +nonzero precondition to `new_unchecked`. If `C` is false, the complementary +block at lines 22–33 is selected. For `v=0` it panics before the unsafe call; +for `v≠0`, falling through the check establishes the unsafe precondition. +These are the crate's only unsafe operations. Proof of maximality: the +complement of `M` inside `L×U` is exactly every profile/debug fiber satisfying +`C ∧ v=0`; the witness derivation above applies parametrically to every such +fiber. Thus every complement member is unsound and no strict superset within +`L×U` is sound. + +## Ordered build-to-source relation + +Write `R`, `S`, and `A` for the complete newline-terminated lines +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, +`cargo::rustc-cfg=fixture_allocator="system"`, and +`cargo::rustc-cfg=fixture_allocator="arena"`. A failing `println!` panics at +that point. The supplied premises do not constrain bytes partially written by +the failing call; below, “prefix” means the exact earlier successfully written +complete directive-line prefix. This byte-level remainder is immaterial because +`BUILD-MAP-ORDERED` forbids a current library compilation after every +unsuccessful exit. + +1. `build.rs:4` first attempts `R`. Failure exits by panic, with complete-line + prefix `[]`; the environment read and all later operations are unreached. + Success leaves prefix `[R]` and reaches `env::var`. +2. The literal key has neither `=` nor NUL. Rust's documented result therefore + partitions raw values into omitted → `Err(NotPresent)`, Unicode `s` → + `Ok(String(s))`, and non-Unicode → `Err(NotUnicode(_))`. `Result` and + `VarError` each have exactly the variants matched at lines 6–25. `as_str` + exposes the entire Unicode string; literal patterns match exactly and `_` + matches every remainder. +3. Omitted and Unicode `system` each attempt `S`; Unicode `arena` attempts + `A`. Failure of that second write exits at the `println!`, with prefix + `[R]` (plus unconstrained failed-call bytes). Success leaves respectively + `[R,S]` or `[R,A]`, then the function returns successfully. These are all + successful paths, and each attempts exactly one allocator directive. +4. Unicode `arena-stop` attempts `A`. A write failure exits with prefix `[R]` + and never reaches its explicit panic. A successful write leaves `[R,A]`, + then line 19 explicitly panics. Unicode values other than the three named + literals panic at line 21 with prefix `[R]` and never attempt an allocator + line. Non-Unicode values do likewise at line 24. Together with first-write + failure, these are every explicit/infrastructure rejection and every + material exit. +5. Only the two successful prefixes are consumed downstream. By + `BUILD-MAP-ORDERED`, successful `[R,S]` passes exactly + `fixture_allocator="system"`; successful `[R,A]` passes exactly + `fixture_allocator="arena"`. Every failed path produces no current library, + irrespective of complete or partial stdout already emitted. No later Cargo + cfg interpretation or library source selection is attributed to an earlier + exit. + +Freshness is closed, including the required sequence. A successful `arena` +build wrote `[R,A]`, so Cargo recorded the raw-variable invalidation rule. +Changing the same target directory's raw value to `arena-stop` is a +present-to-present change; `BUILD-MAP-ORDERED` makes the old selection stale +and reruns the script before current source selection. That run necessarily +ends at the first-write failure, second-write failure, or explicit panic. +The accepted premise says every such outcome compiles no current library and +does not present the prior arena library as the current result. + +For a successful current script, the same premise maps `burst` and the three +target triples to their exact cfg leaves. Rust cfg semantics then make +`all(target_arch="wasm32", fixture_allocator="arena")` true exactly for the +stated excluded pair, independent of `burst`, profile, and debug assertions. +The encountered `compile_error!` at `lib.rs:3–4` rejects compilation. Conversely +that predicate is false for every member of `L`, so this error is absent. The +project's target/allocator exclusion is therefore **PROVED effectively +enforced**, and no excluded current library is produced. + +## Boundary, invariant, and obligation coverage + +The build-script entrypoint is safe Rust. The sole downstream public surface +is safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, +constructors beyond that function, user-implementable traits, exports, FFI, +statics, or generated/hidden APIs. The two cfg alternatives contain the only +unsafe calls (`lib.rs:19,32`). Invariant `NZ(value): value≠0` must hold at each +call. Lines 28–31 establish it on the ordinary path. The comment at line 18 +merely asserts it on the burst path, but a safe `u8` parameter admits zero and +no producer, type, check, or accepted TCB entry establishes `NZ` there. + +Obligation dispositions: + +- build raw-value partition, operation order, successful outputs, failures, + freshness, and Cargo interpretation: PROVED relative to `BUILD-MAP-ORDERED`; +- wasm/arena rejection and complementary source selection: PROVED; +- ordinary-path unsafe precondition and zero panic: PROVED; +- burst/aarch64/arena unsafe precondition: UNSOUND at zero, PROVED for nonzero; +- global documented zero-panic guarantee: UNPROVED, region as stated above. + +## Rust authority and TCB log + +All quotations and links are version 1.85.1 and apply to this exact toolchain. + +- **AX-1 (environment/result).** [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html): + “Returns `VarError::NotPresent`” when unset and “Returns + `VarError::NotUnicode` if the variable’s value is not valid Unicode.” + [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) is + `NotPresent | NotUnicode(OsString)`; [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) + is `Ok(T) | Err(E)`. Consumers: build partition. +- **AX-2 (patterns/order).** [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” + [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the same value as what is created by the literal”; the + [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements and + then its final optional expression.” Consumers: exhaustive ordered relation. +- **AX-3 (panic/output).** [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) + “Prints to the standard output, with a newline” and [“Panics if writing to + `io::stdout` fails.”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the + current thread.” Consumers: build exits and zero postcondition. +- **AX-4 (selection/rejection).** The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + “conditionally includes the thing it is attached to based on a configuration + predicate”; [`all` and `not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + mean respectively all predicates true and the predicate false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message when encountered.” + Consumers: exclusion and the complementary lane blocks. +- **AX-5 (integer/unsafe contract).** [`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + is “The 8-bit unsigned integer type,” with `MIN=0` and `MAX=255`. + [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and zero “results in undefined behavior.” + Consumers: `NZ`, witness, and maximal region. + +**BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo +1.85.1 proposition in `TCB.md:8–39`, consumed only for rerun/freshness, +process-status handling, exact current allocator cfg, feature/target cfg, source +selection, and lack of a current/stale artifact after failure. It is not widened +to Rust semantics or source correctness. No other additional premise or tool +evidence is consumed. + +## Findings and remediation + +**F-1 — UNSOUND safe API.** `lib.rs:18` reverses an unsupported assertion into +the precondition of `new_unchecked`; callers control the safe `u8`. Minimal +repair: perform the zero check on every cfg path (prefer +`NonZeroU8::new(value).expect(...)`) and remove the invalid comment, or change +the API to accept `NonZeroU8` if contract compatibility permits. Re-audit the +new snapshot and its panic behavior. + +**F-2 — deficient proof artifact/postcondition.** The line-18 SAFETY comment +does not identify an enforcing fact and the implementation cannot establish the +documented zero panic in that region without first avoiding UB. Repair F-1 and +use adjacent proof text: “`value == 0` panicked above; reaching this call proves +`value != 0`, satisfying `new_unchecked`.” Changing the safe API or panic +contract requires compatibility review. + +Residual scope is source-level Rust only; compiler backend, binaries, and +deployment are not claimed. Re-audit on any source, policy, Cargo/Rust, +target/feature/allocator, cfg, TCB-disposition, or authoritative-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s1/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/PACKET.json new file mode 100644 index 0000000000..6c4c92125e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "7124ac918b5595c9eaa594511309d8ac1a2400456695cd3004db76f14d18ec21", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "B", + "presentation_order": [ + "C", + "J", + "H", + "D", + "E", + "B", + "G", + "A", + "F", + "I" + ], + "report_sha256": { + "A": "fad0c995d3639d93a74d17be5c17ee86615a76ffca5ae9b91756e8a77834b1fe", + "B": "ca2e2fe0e2096c3fb6629d6d97067dba5125aedf7d74c14710bdfe4f20953351", + "C": "481bdce1f650e4b9ffc1242fccb53adb23bd33ed200d6971ed40fb3e944e067f", + "D": "e3283ae8b81a126762ee59cdd8108681311618dc8b848256daa4c49cfd1ae78c", + "E": "79d94306111d77ca7b72fe0d5bc780e96009c10285753a0979c7e926977cefc8", + "F": "dfcd89377ba31227e0ed7bb9ae4926eca117678182f14ef3f26fe5e929b2b57d", + "G": "a556b26d30da7f48af3bdb4f1962a532142a7555215e6df0fb731896ecdcf164", + "H": "bea0082d313d7bc237a2b754a983410e62d437aecef9bec717b7014d0b618e41", + "I": "5b414f1c8097099ebfe625ec880d4aa0da01a46617e5712419912ed230ccffbe", + "J": "d3ed478991945f13610c6cf0b2dbde59dbe68b37afcf9c456e17a78197a8d6bf" + }, + "rubric_sha256": "13790584d0e5ede69cff8c2b1889be80c73df0722c4ea709c0e85ab82900a4bb", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s2", + "target_byte_tree_sha256": "7589027142112e387f990314df7eb1d08e5464448566fd68048eb2a748635bf3" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/RUBRIC.md new file mode 100644 index 0000000000..c5371528bf --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/RUBRIC.md @@ -0,0 +1,483 @@ +# Mode B Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material.** Never expose this file, its atoms, formulas, +> expected verdicts, hard errors, or authority inventory to a report agent. + +## Scoring Rules + +Score the proposition of each atom, not its notation or presentation. Accept an +explicit equivalent derivation. Do not infer an omitted build stage, failure +edge, source-selection step, or semantic premise from an endpoint summary. +Failure of an atom is not itself a hard error unless the report also makes the +false affirmative claim identified below. + +This fixture deliberately requests a maximal positive region. That request, +not a general audit convention, makes exactness and maximality part of B13. +There is no scoring requirement for incidental diagnostics, exact panic text, +partially written bytes within one failed `println!`, or build-script stdout +which does not affect a current library selection. + +## Intended Domain and Build Relation + +Let: + +```text +R = { Rust and Cargo 1.85.1 } +T = { X = x86_64-unknown-linux-gnu, + A = aarch64-unknown-linux-gnu, + W = wasm32-unknown-unknown } +F = { burst-off, burst-on } +L = { system, arena } +P = every Cargo profile supported by the fixture +D = { debug-assertions-off, debug-assertions-on } +I = { i | i is any u8 } + +Config(t,f,l,p,d) + iff t in T and f in F and l in L and p in P and d in D + and not (t = W and l = arena). + +Required = R cross Config cross I. +Q(t,f,l) iff t = A and f = burst-on and l = arena. +``` + +Both allocator values in `Config` are reachable through the supported Cargo +interface: an omitted selector or `system` selects `system`, and `arena` +selects `arena`. Raw rejected selector values and unsuccessful build attempts +are build-relation cases that must be accounted for, but they do not add a +library configuration to `Required`. + +For compactness, use these local operations: + +```text +RERUN = attempt println!("cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR") +READ = evaluate env::var("FIXTURE_ALLOCATOR") +SYS = attempt println!("cargo::rustc-cfg=fixture_allocator=\"system\"") +ARENA = attempt println!("cargo::rustc-cfg=fixture_allocator=\"arena\"") +PANIC = the selected explicit panic, or the panic caused by a failed println! +RETURN = successful return from main +``` + +The complete claim-relevant local relation is: + +```text +missing: RERUN -> READ(NotPresent) -> SYS -> RETURN +Unicode system: RERUN -> READ(Ok(system)) -> SYS -> RETURN +Unicode arena: RERUN -> READ(Ok(arena)) -> ARENA -> RETURN +Unicode arena-stop: + RERUN -> READ(Ok(arena-stop)) -> ARENA -> PANIC +other Unicode: RERUN -> READ(Ok(other)) -> PANIC +non-Unicode: RERUN -> READ(NotUnicode) -> PANIC +``` + +Every arrow after a `println!` assumes that write succeeds. If `RERUN` fails, +it panics before `READ`, and no complete earlier directive is required. If +`SYS` or `ARENA` fails, `RERUN` is the material completed prefix and the script +panics before `RETURN` or the explicit `arena-stop` panic. If `ARENA` succeeds +on `arena-stop`, the material completed prefix is `[RERUN, ARENA]`, followed by +the explicit panic. Under exact accepted entry `BUILD-MAP-ORDERED`, every panic is an +unsuccessful script exit and produces no current library compilation, +regardless of completed prefix. + +On the three successful selector paths, `BUILD-MAP-ORDERED` interprets the final +allocator line as exactly one matching library cfg. Cargo's accepted feature +and target mappings, followed by the Rust conditional-compilation rules, +select the library source. The `W`/`arena` combination selects +`compile_error!`, so it does not produce a library and is genuinely outside +`Config`. The supported `Q` cell selects the first `lane_id` body and removes +the complementary checked body. + +A prior successful `arena` build necessarily completed `RERUN` before +`ARENA`. After the raw selector changes to `arena-stop`, `BUILD-MAP-ORDERED` makes +that prior selection stale, reruns the script, and refuses to present the old +library as the result of the current unsuccessful execution. Thus the +freshness canary is an effective rejection even though its current output +prefix includes the same arena cfg line. + +## Expected Source Results + +The exact maximal sound region requested by the target is: + +```text +SoundRegion = { case in Required | not Q(case) or case.i != 0 }. +``` + +Outside `Q`, the selected body panics when `i == 0`; reaching +`new_unchecked(i)` therefore implies `i != 0`. Inside `Q`, the selected body +calls `new_unchecked` without a check, so nonzero inputs are sound and zero is +not. The complement of `SoundRegion` within `Required` consists exactly of +`Q` with `i == 0` (for every supported profile and debug-assertion state). + +The safe call `lane_id(0)` in any `Q` case reaches +`NonZeroU8::new_unchecked(0)`. Its exact safety proposition is false, and the +Rust 1.85.1 standard-library contract states that zero produces undefined +behavior. Safe-API soundness over all of `Required` is therefore **UNSOUND +relative to `BUILD-MAP-ORDERED`**. + +For the documented zero-input panic postcondition: + +```text +RequiredPanic = { case in Required | case.i = 0 } +CoveredPanic = { case in RequiredPanic | not Q(case) }. +``` + +The regional theorem over `CoveredPanic` is **PROVED relative to +`BUILD-MAP-ORDERED`**. The whole `RequiredPanic` theorem is **UNPROVED**, not +`CONTRACT-BROKEN`: the only missing cases are executions already shown to +contain UB, so their apparent absence of an earlier panic is not a defined +behavioral counterexample. + +## Atoms + +- **B1 — Exact supported case predicate:** The report states a predicate + equivalent to `Required`, including Rust/Cargo 1.85.1, all three targets, + both feature states, both allocator models, every supported Cargo profile, + both debug-assertion states, every `u8`, and only the `W`/`arena` policy + exclusion. + - `scope_basis`: `Cargo.toml`, `SUPPORT.md`, and `BUILD.md`. + - `dependencies`: none; this is the theorem root. + - `accepted_alternatives`: symbolic products or a proved equivalent partition; no + Cartesian enumeration is required. + - `hard_errors`: omission + alone fails B1; claiming a whole-domain affirmative result over a contracted + predicate triggers BH1. + +- **B2 — Exhaustive raw-selector partition:** The report proves that the raw + environment domain is exactly missing, Unicode `system`, Unicode `arena`, + Unicode `arena-stop`, every other Unicode string, and every non-Unicode + value, with no seventh `env::var` outcome. + - `scope_basis`: `BUILD.md`, the + exact `env::var`/`VarError` contracts, and the outer and inner matches. + - `dependencies`: independent of B1; it supplies the cases used + by B3–B7. + - `accepted_alternatives`: any disjoint exhaustive partition that + preserves these behaviorally distinct classes. + - `hard_errors`: + omission alone fails B2; calling an incomplete partition complete and using + it for build closure triggers BH2. + +- **B3 — Complete system-success trace:** Conditional on its two writes + succeeding, each of the missing and Unicode-`system` classes follows exactly + `RERUN -> READ -> SYS -> RETURN`; it emits no arena cfg. + - `scope_basis`: the + ordered statements, `env::var`, match/pattern semantics, `String::as_str`, + and `println!`. + - `dependencies`: B2 identifies the two raw cases; + this is a local-source proposition and does not consume Cargo mapping. + - `accepted_alternatives`: combine the two classes after proving their + identical trace. + - `hard_errors`: omission alone fails B3; an + incompatible endpoint used for closure triggers BH2. + +- **B4 — Complete arena-success trace:** Conditional on its two writes + succeeding, Unicode `arena` follows exactly + `RERUN -> READ -> ARENA -> RETURN`; it emits no system cfg. + - `scope_basis`: + the same local Rust contracts as B3. + - `dependencies`: B2; this + trace is the reachability root for B8–B12. + - `accepted_alternatives`: an + equivalent state-transition row or prose proof. + - `hard_errors`: + omission alone fails B4; an incompatible endpoint used for closure triggers + BH2. + +- **B5 — `arena-stop` partial-prefix exit:** With successful writes, Unicode + `arena-stop` follows exactly + `RERUN -> READ -> ARENA -> PANIC`, so `[RERUN, ARENA]` is a completed output + prefix but the script does not return successfully and, under + `BUILD-MAP-ORDERED`, produces no current library compilation. + - `scope_basis`: + `BUILD.md`, local match/`println!`/`panic!` semantics, and only the exact + unsuccessful-exit proposition of `BUILD-MAP-ORDERED`. + - `dependencies`: + B2; this is distinct from a failed allocator write in B7. + - `accepted_alternatives`: notation may differ, but both ordered lines, the later panic, + and no-current-library consequence must appear. + - `hard_errors`: + omission alone fails B5; treating the partial arena line as a current + successful selector triggers BH4. + +- **B6 — Pre-allocator rejection traces:** Every other Unicode value and every + non-Unicode value follows `RERUN -> READ -> PANIC` after a successful rerun + write, so `[RERUN]` is its completed directive prefix; it attempts no + allocator cfg and produces no current library compilation under + `BUILD-MAP-ORDERED`. + - `scope_basis`: the wildcard and `NotUnicode` arms plus + the exact build premise. + - `dependencies`: B2; the two classes may + share an outcome only after both are accounted for. + - `accepted_alternatives`: + separate rows or one proved union. + - `hard_errors`: omission alone + fails B6; treating either class as an accepted allocator/configuration + triggers BH5. + +- **B7 — Stdout-failure edges:** The report accounts for failure of every + claim-relevant `println!`: failed `RERUN` panics before `READ`; failed `SYS` + or `ARENA` panics with completed prefix `[RERUN]`; and all such unsuccessful + exits produce no current library compilation under `BUILD-MAP-ORDERED`. It does + not require atomic line writes or assign meaning to an incomplete line. + - `scope_basis`: the exact `println!` Panics section, source order, + `panic!`'s main-thread result, and the accepted process-status proposition. + - `dependencies`: B3–B5 identify allocator-write sites; B7 is the + failure completion of those traces. + - `accepted_alternatives`: a single + quantified failure rule is preferred and passes if its instantiations are + readily checkable. + - `hard_errors`: omission alone fails B7; + claiming complete build coverage while a material failure edge supplies a + contrary current artifact triggers BH2 or BH4 as applicable. + +- **B8 — Successful Cargo-to-source selector mapping:** Only the successful + B3/B4 returns supply a current library compilation; Cargo interprets their + exact allocator line as exactly the corresponding `fixture_allocator` + key/value, maps the requested feature and target as admitted, and Rust cfg + rules select source from those resulting predicates. The report keeps + `BUILD-MAP-ORDERED` conspicuous and does not infer local output or Rust semantics + from it. + - `scope_basis`: B3/B4, exact `BUILD-MAP-ORDERED`, the reviewed Cargo + directive contracts, and versioned Rust cfg semantics. + - `dependencies`: B3 through B7. + - `accepted_alternatives`: a relational composition + or explicit stage-by-stage prose. + - `hard_errors`: silently + widening the accepted mapping triggers BH3; treating an unsuccessful prefix + as successful triggers BH4. + +- **B9 — Rerun/freshness theorem:** A prior successful `arena` build completed + `RERUN` before `ARENA`; changing the same target directory's raw selector to + `arena-stop` makes that selection stale, causes a new script run, and yields + no library for the current rejected build rather than reusing the prior arena + library. + - `scope_basis`: local B4/B5 order and precisely the rerun/staleness + proposition accepted in `BUILD-MAP-ORDERED`, reviewed against Cargo's + `rerun-if-env-changed` contract. + - `dependencies`: B4, B5, and the + no-library exit consequence. + - `accepted_alternatives`: a more general proof + for every accepted-to-rejected value change passes if it includes this + requested sequence. + - `hard_errors`: omission alone fails B9; + claiming this current build succeeds from the stale or partial arena output + triggers BH4. + +- **B10 — Effective wasm32/arena exclusion:** For either feature state and all + profiles/debug states, accepted `arena` selection plus the admitted wasm32 + target mapping makes both predicates of the library's first cfg true; Rust + `all` and cfg-attribute semantics therefore retain `compile_error!`, whose + contract makes compilation fail. No `W`/`arena` case is in `Required` or is + used as the UB witness. + - `scope_basis`: `SUPPORT.md`, B8, exact configuration + predicate and attribute semantics, and `compile_error!`. + - `dependencies`: B8. + - `accepted_alternatives`: any parametric proof covering both + feature states and all `P x D`. + - `hard_errors`: calling this pair + supported, using it as a valid-use witness, or asserting rejection without + the selected `compile_error!` proof triggers BH5. + +- **B11 — Exact library-body partition:** The report proves that the unchecked + first body is retained and the complementary checked body removed exactly in + `Q`, while the checked body is retained and the first body removed exactly + outside `Q`. In `Q`, B8 supplies `target_arch="aarch64"`, + `feature="burst"`, and `fixture_allocator="arena"`; Rust's key/value, `all`, + `not`, and cfg-attribute rules establish both directions of the partition. + - `scope_basis`: B8 and the exact versioned cfg propositions. + - `dependencies`: B4 and B8; this is the source-reachability edge for B12/B13. + - `accepted_alternatives`: expansion of the two cfg predicates or an + equivalent Boolean proof. + - `hard_errors`: omission alone fails + B11; declaring the supported unsafe branch unreachable by ignoring generated + cfgs triggers BH6. + +- **B12 — Existential UB certificate and verdict:** The report identifies the + well-typed safe call `lane_id(0)` in a supported `Q` case, uses B11 to reach + `NonZeroU8::new_unchecked(0)`, states that its exact nonzero safety + proposition is false, applies the Rust 1.85.1 zero-UB consequence, and reports + whole-`Required` soundness **UNSOUND relative to `BUILD-MAP-ORDERED`**. + - `scope_basis`: the public safe API, B1, B11, and the exact std contract. + - `dependencies`: B1 and B11. + - `accepted_alternatives`: any one supported + profile/debug state is enough for the existential certificate; proving all + such states is also correct. + - `hard_errors`: an incomplete + certificate followed by `UNSOUND`, or failure to issue `UNSOUND` after giving + every link, triggers BH7. + +- **B13 — Exact maximal sound region:** The report proves both containments for + `SoundRegion = { case in Required | !Q or i != 0 }`: every included case is + sound (the checked body dominates its unsafe call outside `Q`, and nonzero + directly satisfies the unsafe precondition inside `Q`), while every excluded + Required case is exactly `Q`/zero and has B12's UB execution. It labels this + the exact maximal source-level region relative to `BUILD-MAP-ORDERED`. + - `scope_basis`: the user-requested maximal theorem, B1, B11/B12, `if`/comparison/ + panic semantics, and `new_unchecked`. + - `dependencies`: B1, B8, + B11, B12. + - `accepted_alternatives`: an algebraically equivalent formula or + disjoint partition; a correct non-maximal remainder does not pass this + explicitly requested atom. + - `hard_errors`: omission or refusal to + maximize alone fails B13; calling a region maximal while including Q/zero, + excluding sound Q/nonzero cases, or excluding all of `Q` triggers BH8. + +- **B14 — Regional zero-panic theorem:** For every zero-input case outside + `Q`, cfg selection retains the checked body, `value == 0` makes the `if` + consequent execute, and `panic!` prevents reachability of the later unsafe + call. Thus `CoveredPanic = RequiredPanic intersect !Q` is **PROVED relative + to `BUILD-MAP-ORDERED`** across every applicable target/allocator/feature, + profile, and debug state. + - `scope_basis`: B1/B8/B11 and exact comparison, + `if`, cfg, and panic contracts. + - `dependencies`: B1, B8, and the + complement of B11. + - `accepted_alternatives`: a parametric proof or exact + finite configuration partition. + - `hard_errors`: incomplete + regional coverage alone fails B14; falsely claiming the region contains + Q/zero triggers BH9 or BH10 depending on the verdict. + +- **B15 — Whole-domain panic-postcondition verdict:** The report states that + the documented zero-input panic guarantee over all `RequiredPanic` is + **UNPROVED**, not `CONTRACT-BROKEN` and not `PROVED`: Q/zero contains UB, so + its apparent source prefix supplies neither a defined non-panic witness nor a + guaranteed observation, while B14 proves every other zero case. + - `scope_basis`: the exact behavioral quantifier, B12, B14, and whole-execution UB + reasoning. + - `dependencies`: B12 and B14. + - `accepted_alternatives`: + equivalent theorem-specific wording that keeps this verdict separate from + soundness. + - `hard_errors`: using the UB-containing case to claim + `CONTRACT-BROKEN` or an observation before UB triggers BH9; claiming the + universal panic theorem `PROVED` triggers BH10. + +## Hard Errors + +- **BH1:** Claims a whole-domain affirmative result after omitting a supported + release, target, feature, allocator, profile, debug state, or valid `u8` + input, or treats the supported `Q` cell as excluded. +- **BH2:** Claims the build relation or a dependent theorem complete while + replacing the requested ordered/fallible relation with an endpoint summary + that omits a material raw-selector class, failure edge, partial-prefix exit, + or necessary stage. +- **BH3:** Invents, silently widens, or treats as Rust authority any Cargo, + freshness, process-status, feature, or target proposition beyond exact + `BUILD-MAP-ORDERED`. +- **BH4:** Treats a cfg line emitted by an unsuccessful script, or a stale + artifact from an earlier selector, as the library selected for the current + failed build. +- **BH5:** Treats a rejected raw selector as an accepted allocator model; + treats wasm32/arena as supported; uses it as the safe-use UB witness; or + claims its effective rejection without the selected `compile_error!` proof. +- **BH6:** Ignores build-script output or exact Cargo/cfg interpretation and + consequently declares the supported `Q` unsafe branch unreachable. +- **BH7:** Reports `UNSOUND` without the valid safe use, reachability, false + exact safety proposition, and applicable UB consequence, or reports only + `UNPROVED` after explicitly establishing all four links. +- **BH8:** Claims an exact or maximal sound region that includes Q/zero or + excludes any sound Required case, including Q/nonzero. +- **BH9:** Reports `CONTRACT-BROKEN` for the zero-panic promise using only the + UB-containing Q/zero execution, or claims an observation is guaranteed + because it appears before that UB in source order. +- **BH10:** Reports the whole-`RequiredPanic` zero-panic theorem `PROVED` + despite leaving Q/zero without a defined proof. + +## Checked Authorities + +The evaluator must open each exact page, confirm the quoted proposition, and +confirm applicability to Rust/Cargo 1.85.1. The quotation is included to make +the semantic leaf explicit; punctuation-only rendering differences are +irrelevant. + +- `https://doc.rust-lang.org/1.85.1/std/env/fn.var.html` — “Fetches the + environment variable key from the current process”; returns + `VarError::NotPresent` when the variable is not set and + `VarError::NotUnicode` when its value is not valid Unicode. +- `https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html` — the enum is + exactly `NotPresent` or `NotUnicode(OsString)`; the variant descriptions + distinguish absence from a present value without valid Unicode data. +- `https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html` — `Result` is + exactly `Ok(T)` or `Err(E)` and “represents either success (`Ok`) or failure + (`Err`).” +- `https://doc.rust-lang.org/1.85.1/std/primitive.u8.html` — `u8` is “The 8-bit + unsigned integer type,” with `MIN` equal to zero and `MAX` equal to 255; zero + is therefore an ordinary valid safe-call input. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html` — a + scrutinee value is “sequentially compared to the patterns in the arms until + a match is found,” and the first matching arm is chosen and entered. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html` — a + block sequentially executes its non-item statements and optional final + expression; its type is `()` when the final operand is omitted. +- `https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body` + — an omitted function output is unit, and the body is conceptually wrapped + so that its body value is returned; an explicit `return`, if reached, + short-cuts that implicit return. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html` — “A + call expression calls a function”; if the function eventually returns, the + expression completes. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns` + — tuple-struct patterns match tuple-struct and enum values satisfying all + their subpatterns and destructure that value. +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns` — + literal patterns “match exactly the same value as what is created by the + literal.” +- `https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern` — + the wildcard pattern “matches any value.” +- `https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str` + — `as_str` “Extracts a string slice containing the entire `String`.” +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html` — `println!` + “Prints to the standard output, with a newline,” supplying the successful + completed-line effect used by B3–B6. +- `https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics` — `println!` + “Panics if writing to `io::stdout` fails.” +- `https://doc.rust-lang.org/1.85.1/std/macro.panic.html` — `panic!` “Panics the + current thread.” The process-status consequence consumed by this fixture is + separately and explicitly admitted by `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation` + — a set configuration option is true; `all(...)` is true exactly when all + operands are true; and `not(p)` is true exactly when `p` is false. +- `https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute` + — a true cfg predicate retains the attached thing without the cfg attribute, + while a false predicate removes it from the source. +- `https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html` — + `compile_error!` “Causes compilation to fail with the given error message + when encountered.” +- `https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators` + — `==` means equal via `PartialEq::eq`; for the primitive `u8` comparison in + this source it tests whether `value` equals zero. +- `https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html` — if the + Boolean condition is true the consequent executes; if false it is skipped. +- `https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked` + — the function creates a nonzero without checking, “results in undefined + behavior if the value is zero,” and its Safety section says, “The value must + not be zero.” +- `https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html` + — Rust programs “must never cause undefined behavior”; unsafe code that no + safe client can trigger to exhibit UB is called sound, and code that safe + code can misuse to exhibit UB is unsound. The whole-execution conclusion is + a logical consequence of classifying the execution as undefined, not a + purported quotation from a source-order or “time travel” subsection. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script` + — after a build script “successfully finishes executing, the rest of the + package will be compiled”; a nonzero exit halts the build. This reviews, but + does not replace, `BUILD-MAP-ORDERED`. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script` + — Cargo interprets each stdout line beginning with `cargo::` as an instruction + affecting package compilation, and instruction order can matter. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg` + — the directive tells Cargo to pass its value to rustc's `--cfg` flag for + conditional compilation. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed` + — the directive tells Cargo to rerun the script if that environment + variable's value changes. +- `https://doc.rust-lang.org/1.85.1/cargo/reference/features.html` — Cargo sets + enabled package features with rustc's `--cfg`, and source can test them with + the cfg attribute or macro. + +Cargo pages are evidence used to review the explicit human trust entry; they +are not Rust abstract-semantics axioms and do not silently enlarge that entry. +No test run, CI result, compiler experiment, prior report, evaluator oracle, or +unversioned documentation closes any atom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/allowlist.txt new file mode 100644 index 0000000000..b425cc1918 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/allowlist.txt @@ -0,0 +1,27 @@ +https://doc.rust-lang.org/1.85.1/std/env/fn.var.html +https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html +https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html +https://doc.rust-lang.org/1.85.1/std/primitive.u8.html +https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html +https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html +https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body +https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html +https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns +https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern +https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str +https://doc.rust-lang.org/1.85.1/std/macro.println.html +https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics +https://doc.rust-lang.org/1.85.1/std/macro.panic.html +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators +https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html +https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked +https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg +https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed +https://doc.rust-lang.org/1.85.1/cargo/reference/features.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/A.md new file mode 100644 index 0000000000..4a7e4846af --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/A.md @@ -0,0 +1,194 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits the complete supplied crate snapshot: `Cargo.toml`, `build.rs`, +`src/lib.rs`, and `BUILD.md`, `SUPPORT.md`, and `TCB.md`. The theorem is +source-level Rust 1.85.1/edition 2021 freedom from undefined behavior for every +well-typed safe call to `lane_id`, plus the requested build/rejection and panic +contracts. It is relative only to accepted entry `BUILD-MAP-ORDERED`; no +backend or binary correctness is claimed. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {burst off, burst on}`, `A = {system, arena}`; +- `P` be every Cargo profile, `D = {debug assertions off, on}`, and + `V = {0,...,255}` (the complete `u8` domain); +- `Supported(t,b,a,p,d) := t in T && b in B && a in A && p in P && d in D + && !(t=wasm32-unknown-unknown && a=arena)`; and +- `C(t,b,a) := t=aarch64-unknown-linux-gnu && b=burst-on && a=arena`. + +`SUPPORT.md` states exactly the product above and exactly its wasm/arena +exclusion. `Cargo.toml` fixes Rust 1.85.1, edition 2021, the empty/default or +enabled `burst` feature, and this build script/library. `BUILD.md` makes the +allocator a generated cfg from an accepted raw selector. These sources agree; +normalizing their conjunction gives `Supported` in both directions. Rejected +raw values are required build-interface cases, not extra library +configurations. Profiles and debug assertions do not occur in either library +cfg predicate or in its value test, so the proofs below are parametric in +`p,d`. There are no dependencies or other generated files. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered raw-selector/build relation, including freshness | **PROVED**, relative to `BUILD-MAP-ORDERED` | Complete path partition below | +| Required wasm32/arena exclusion | **PROVED** | `cfg` plus `compile_error!` proof below | +| Safe-API soundness over `Supported x V` | **UNSOUND** | Every `C && value=0` safe call reaches documented UB | +| Soundness on `M := {(q,value): Supported(q) && (!C(q) || value!=0)}` | **PROVED** | Exhaustive cfg/input partition below | +| “Panics when `value` is zero” over all `Supported` | **UNPROVED**, not `CONTRACT-BROKEN` | Proved for `!C`; the only remaining executions have UB, so they cannot be postcondition counterexamples | + +Thus the combined full-domain result is **UNSOUND** for soundness and +**UNPROVED** for the documented panic postcondition. + +## Exact ordered build relation + +Write `R` for the complete line +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, `S` for +`cargo::rustc-cfg=fixture_allocator="system"`, and `A` for the analogous +`"arena"` line. + +The function body executes its statements in order. First it attempts `R`. +If that write fails, `println!` panics: for every raw environment class the +script exits unsuccessfully before reading/classifying the variable, with no +successfully written complete directive guaranteed (an incomplete byte prefix +of the failing line is immaterial). If `R` succeeds, the complete relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Classification and next action | Complete emitted prefix and exit | +|---|---|---| +| omitted | `Err(NotPresent)`; attempt `S` | `R,S`, normal success if the write succeeds; otherwise `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `system` | `Ok`; `as_str`; `"system"` arm; attempt `S` | same two outcomes as omitted | +| Unicode `arena` | `Ok`; `"arena"` arm; attempt `A` | `R,A`, normal success; or `R` plus at most an incomplete failing line, `println!` panic | +| Unicode `arena-stop` | `Ok`; matching arm; attempt `A`, then explicit `panic!` | if write succeeds: `R,A`, explicit panic; if it fails: `R` and `println!` panic before the explicit panic | +| every other Unicode value | `Ok`; wildcard arm | `R`, explicit panic; no allocator write attempted | +| every non-Unicode value | `Err(NotUnicode(_))` | `R`, explicit panic; no allocator write attempted | + +These are all raw classes, both stdout sites, all successful paths, all +explicit rejections, and all material complete prefixes. The successful +mapping is exactly `omitted|system -> system` and `arena -> arena`. The +`arena-stop` emitted allocator line never belongs to a successful execution. + +The accepted `BUILD-MAP-ORDERED` premise is consumed only as follows: a +successfully written current `R` makes any later raw-value change stale; a +successfully written allocator line is passed as that exact cfg only when the +current script succeeds; current success receives no retained old selector; +any write panic or explicit panic is an unsuccessful process and yields no +current library; Cargo does not substitute an old library after a stale failed +build; and `burst`/the three target triples set the exact named cfgs. Emitted +text and ordering above are proved from source, not assumed by that entry. + +Consequently, after a successful `arena` build, `R` necessarily was written. +Changing the same target directory to present value `arena-stop` is the +entry's present-to-present change: Cargo reruns before selecting a library. +The rerun fails at `R`, at `A`, or after successful `A`; every case is +unsuccessful, and neither its prefix nor the prior arena artifact is a result +of the current build. The freshness canary is therefore **PROVED**. + +## Version-matched Rust axioms + +The following are the material Rust 1.85.1 propositions; Cargo behavior above +comes only from the separately accepted project TCB entry. + +- [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says: + “Returns an `Err` if the variable is not present, or if it is not valid + Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + distinguishes `NotPresent` from `NotUnicode(OsString)`. +- [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” The + [match-expression rule](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + says: “The first arm with a matching pattern is chosen as the branch target + of the match.” [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + match the literal's value; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” +- [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially execute their component non-item declaration statements.” + [`println!` failure](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +- A [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + includes its attached form iff its predicate is true; if false, “the thing + is removed from the source code.” [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” +- The [`if` rule](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes the consequent when its Boolean condition is true; the + [comparison rule](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + makes `==` a value equality test. The [`u8` page](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + records `MIN = 0` and `MAX = 255`. +- Most importantly, [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + states: “This results in undefined behavior if the value is zero.” Its + Safety clause is: “The value must not be zero.” + +## Configuration exclusion and selected source + +On target `wasm32-unknown-unknown` after a successful arena selector, +`BUILD-MAP-ORDERED` supplies `target_arch="wasm32"` and exactly +`fixture_allocator="arena"`. Both operands of the source `all(...)` are true, +so the `compile_error!` item is included and compilation fails. This is +independent of `burst`, profile, and debug assertions. Hence the excluded pair +cannot produce a current library. For system on wasm32, and for either +allocator on the two other targets, that predicate is false and this error item +is removed. The project's sole exclusion is exactly enforced. + +## API, obligations, and maximal sound region + +The only language-reachable crate API is safe free function +`pub fn lane_id(u8) -> NonZeroU8`. There are no public fields, crate-owned +representation, traits/impls, methods, statics, macros, reexports, hidden +items, callbacks, or FFI. There is no persistent invariant; each unsafe call +locally consumes the sole obligation `value != 0`. + +The two complementary cfg blocks form an exhaustive partition: + +1. If `C`, the first block is included and the `not(all(...))` block removed. + Every input immediately reaches `new_unchecked(value)`. For `value in + 1..=255`, its sole safety precondition holds. For `value=0`, it is false and + the cited standard-library contract entails UB. +2. If `!C`, the first block is removed and the second included. At `value=0`, + equality is true and `panic!` executes before the unsafe call. At every + `value in 1..=255`, that branch is not taken and the exact same value reaches + `new_unchecked`, satisfying its safety clause. + +This proves every point of +`M = Supported x V intersect (!C or value!=0)`. Conversely, +`(Supported x V) \ M` is exactly `C && value=0`, for every profile and debug +assertion state. Calling this public safe function with zero is a valid +well-typed in-scope use; cfg selection reaches the unsafe call; its required +proposition is false; and the version-matched contract states the UB +consequence. Every omitted point is therefore unsound, proving both the +full-domain **UNSOUND** certificate and the exact maximality of `M`. + +For the documented postcondition, every `!C,value=0` execution reaches +`panic!`, so that region is proved. At `C,value=0` the whole execution has UB. +It cannot be a `CONTRACT-BROKEN` witness, which must be UB-free; absent an +independent UB-free witness, the full postcondition is **UNPROVED**. + +## Finding and proof-artifact quality + +**F-1 (critical, UNSOUND).** The special-path comment, “Burst-mode lane +identifiers are never zero,” is not derived from a check, type, invariant, or +unsafe caller contract. `value` is an unrestricted public `u8`, so zero is a +counterexample. The minimum repair is to validate zero on that path (or remove +the specialization and use the already checked path), then replace the comment +with a proof citing that dominating check and exact value. Changing prose alone +cannot repair the safe API. The ordinary-path comment correctly identifies the +dominating zero branch, though the derivation above supplies its complete +versioned contract basis. Any code repair is a new snapshot requiring re-audit. + +## TCB, residual scope, and triggers + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, accepted +for Cargo 1.85.1 and only its stated freshness, process-status, feature, target, +and cfg propositions. Its exclusions (emitted source text/order, Rust +semantics, source correctness, backend, binary) were not widened. No other +assumption, dependency, tool result, test, build, or prior audit was consumed. + +Excluded from the theorem are manual `rustc`, invented cfgs, build-script +override, unsupported targets, and binary/backend correctness. Re-audit is +required for any source/policy/manifest change; Cargo/Rust or documentation +change; target, feature, allocator, profile, or environment-interface change; +generated-cfg/build-order change; or altered TCB disposition. + +**Final attestation:** every source/API/build/configuration/postcondition +obligation has a disposition; `Required` and `M` are symbolic and closed; the +unsoundness witness is complete; no testing or absence-of-counterexample claim +is used. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/B.md new file mode 100644 index 0000000000..c17b23805f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/B.md @@ -0,0 +1,84 @@ +# Unsafe-code audit: supplied ordered-build crate + +## Claims, snapshot, and verdicts + +Audit cutoff: 2026-08-01. The audited identity is the complete supplied snapshot: `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`; Rust/Cargo/stdlib are exactly 1.85.1, edition 2021. There are no dependencies or generated files. No build, execution, expansion, or test evidence was used. + +Let `T={X86,A64,Wasm}` denote the three triples in `SUPPORT.md`; `B={off,on}` the `burst` cfg state; `A={system,arena}`; `P` every Cargo profile; and `D={debug_assertions off,on}`. The exact supported library domain is + +`R = {1.85.1} × T × B × A × P × D \ {(1.85.1,Wasm,b,arena,p,d)}`. + +The allocator coordinate must arise from a successful current build-script run: raw absent or `system` maps to `system`, and raw `arena` maps to `arena`. Rejected raw values and write-failing executions are part of the audited build interface but create no library configuration. + +| Claim | Verdict | Certificate | +|---|---|---| +| Ordered selector, rejection, freshness, and wasm/arena exclusion | **PROVED**, relative to `BUILD-MAP-ORDERED` | Exhaustive relation and exclusion proof below | +| Build script and `lane_id` are UB-free for every current library in `R` and every `u8` input | **UNSOUND** | Supported `A64,on,arena,p,d`, input `0`, reaches `new_unchecked(0)` | +| “Panics when `value` is zero” for every `c in R` | **UNPROVED** | Proved when `F(c)` is false; the remaining executions contain UB, so they cannot certify a defined contract refutation | + +Here `F(c) := (target=A64 && burst=on && allocator=arena)`. The **exact maximal sound region** over the requested product is + +`Smax = {(c,x) in R × u8 | !F(c) || x != 0}`. + +Its complement is exactly `{(c,0) | c in R && F(c)}` (all profiles and both debug-assertion states). Thus this is maximal, not merely a positive subset. + +## Version-matched Rust axioms + +These are the only material Rust propositions consumed: + +* AX-ENV: [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “Returns an Err if the variable is not present, or if the current value is not valid Unicode.” [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) represents success as `Ok` or failure as `Err`; [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) distinguishes `NotPresent` and `NotUnicode`. +* AX-ORDER: the [block-expression Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) says statements are “executed sequentially.” The [match Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) says values are sequentially compared with arm patterns and the first match is chosen. [Tuple-struct patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns) match tuple-struct and enum-variant values. [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) “Extracts a string slice containing the entire String.” Literal patterns [match the literal's value](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), while the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) “matches any value.” +* AX-EXIT: [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the current thread.” `BUILD-MAP-ORDERED` supplies the process-status consequence. +* AX-CFG: the [conditional-compilation Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) defines `all` as true exactly when all predicates are true and `not` as negation. The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) includes its attachment when true and removes it when false. [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) “causes compilation to fail with the given error message when encountered.” +* AX-NZ: Rust 1.85.1 [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) requires: “The value must not be zero”; creating it with zero is undefined behavior. The [UB Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) confirms that unsafe blocks remain subject to the UB rules. +* AX-IF: the [`if` Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) executes the consequent exactly when its Boolean condition is true; the [comparison-operator Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) gives `==` equality for the `u8` comparison. + +## Complete ordered build relation + +Write `RERUN`, `CS`, and `CA` for the complete lines at `build.rs:4`, `:8/:12`, and `:15/:18`. `partial(L)` means any bytes produced by a failing attempt to write `L`, possibly none or even a complete-looking line. This deliberately does not assume line-write atomicity. + +1. For **every** raw environment state, the first operation attempts `RERUN`. If it fails, the only output is `partial(RERUN)`; `println!` panics before `env::var`, the process is unsuccessful, and no current library is compiled. +2. If `RERUN` succeeds, `env::var` is evaluated and its exhaustive `Result`/match partition is: + * absent or Unicode `system`: attempt `CS`. Failure yields `[RERUN]+partial(CS)`, panic, and no library. Success yields `[RERUN,CS]`, normal return, and exactly `fixture_allocator="system"` for the current library; + * Unicode `arena`: the identical two outcomes with `CA`, selecting exactly `arena` only after success; + * Unicode `arena-stop`: attempt `CA`. A write failure yields `[RERUN]+partial(CA)` and no library. A successful write yields `[RERUN,CA]`, then the explicit panic at `build.rs:19`; despite the complete allocator line, no current library is compiled; + * every other Unicode value: output `[RERUN]`, then the wildcard-arm panic at `:21`; no allocator write and no library; + * every non-Unicode value: output `[RERUN]`, then the `NotUnicode` panic at `:24`; no allocator write and no library. + +This exhausts the first-write outcome, all three `env::var` result classes, all literal/wildcard subdivisions of `Ok`, and every second-write outcome. Local sequential execution plus AX-ENV/ORDER/EXIT proves the source-side order and exits. Accepted TCB entry `BUILD-MAP-ORDERED` supplies only these consumed Cargo facts: a successfully written rerun line tracks any raw-value change; a cfg line affects the current library only after that script exits successfully; only the current successful run's exact directives are used; an unsuccessful script (including uncaught panic or either write failure) produces no current library and cannot surface a stale one; enabled `burst` and the three target triples set the named cfgs. No source-correctness or Rust-semantic proposition is imported from that entry. + +**Freshness witness sequence.** A successful raw `arena` run writes `[RERUN,CA]`, returns, and may produce the arena library. In the same target directory, changing the present raw value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly the three unsuccessful cases above: first write fails; first succeeds and `CA` fails; or both writes succeed and `:19` panics. Therefore the current build is rejected in every case, and the prior arena library is not its result. + +## Configuration/source closure and exclusion + +For a successful selector run, Cargo supplies exactly one of `system` or `arena`. AX-CFG makes the two `lane_id` bodies complementary: + +* `system`, or any X86 configuration, or `burst=off`: only the checked body at `lib.rs:27-32` is selected; +* `A64 + arena + burst=on`: only the unchecked-return body at `:17-20` is selected; +* `Wasm + arena`: independently of `burst`, the cfg on `:3` is true and `compile_error!` makes the current library compilation fail, producing no library artifact; +* `Wasm + system` remains in the checked class. + +Thus the required exclusion is effectively and exactly rejected: successful arena selection plus the accepted Wasm target-cfg entails the compile error. No rejected raw class bypasses it, because none creates a current library. Conversely, this source error's predicate is precisely `Wasm && arena`, so it does not enlarge the stated exclusion. Profiles and debug assertions do not occur in any selector or source predicate, giving a parametric proof over `P×D`. Hence the build/exclusion `Covered` predicate contains the complete build-interface domain, and the successful-library projection is exactly `R`. + +## API, obligations, and maximal-region proof + +The only public surface is safe `lane_id(u8) -> NonZeroU8`; there are no public fields, traits/impls, callbacks, macros, statics, FFI, or hidden APIs. The only unsafe sites are its two cfg-complementary `new_unchecked` calls. The build script contains no unsafe code. + +* If `!F(c)` and `x=0`, `value == 0` is true, so `panic!` executes before the unsafe call. This is UB-free and proves the documented panic behavior. +* If `!F(c)` and `x!=0`, the zero branch is skipped; that dominating fact discharges AX-NZ before `lib.rs:32`. +* If `F(c)` and `x!=0`, the direct call at `:19` satisfies AX-NZ. +* If `F(c)` and `x=0`, cfg selection reaches `new_unchecked(0)`. The safe signature imposes no caller precondition, so this is a valid supported safe use; AX-NZ's required proposition is false and the operation has undefined behavior. This proves **UNSOUND**, for every `p,d` in this complement. + +The four cases are exhaustive (`F`/`!F`, zero/nonzero). The first three prove every member of `Smax`; the fourth proves every member of its complement unsound, establishing maximality. The existing fast-path comment—“Burst-mode lane identifiers are never zero”—is a false, unenforced premise; the parameter comes directly from adversarial safe code. The checked-path comment is adequate. + +For the panic contract, coverage is exactly `{(c,0) | c in R && !F(c)}`. In the uncovered `F(c),0` cases the whole execution contains UB. Consequently there is no UB-free witness here for `CONTRACT-BROKEN`; the strongest contract verdict is **UNPROVED**, alongside the independently certified **UNSOUND** verdict. + +## TCB audit, findings, and residual scope + +TCB log identity is the supplied `TCB.md`, entry `BUILD-MAP-ORDERED`, disposition accepted by the authorized reviewer. Its exact consumed fragments and consumers are recorded above; its Cargo/toolchain identity is 1.85.1. AX-ENV through AX-IF are versioned Rust authorities, not extra implementation assumptions. No pending, unsafe-dependency, tool, backend, binary, platform-runtime, or probabilistic premise is consumed. + +**Finding F-1 (UNSOUND; proof comment deficient):** `src/lib.rs:18-19`, precisely `F(c) && value=0`. Minimum repair is to check zero before every `new_unchecked`, use `NonZeroU8::new(value).expect(...)`, or remove the special unsafe branch. Merely strengthening prose would add an invalid hidden precondition to a safe API. Re-audit all cfg cases and the panic guarantee after repair. + +**Finding F-2 (postcondition UNPROVED):** the same region prevents a universal panic proof, but supplies no defined contract-breaking witness. Repair F-1 while retaining a zero-input panic on the fast path. + +This is a source-level Rust theorem only. Compiler/backend correctness, produced binaries, manually invented cfgs, direct `rustc`, build-script override, targets/toolchains outside the stated set, and future source or policy are excluded. Re-audit on any source, Rust/Cargo, support domain, raw interface, feature/target cfg, TCB disposition, or cited semantic-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/C.md new file mode 100644 index 0000000000..0276c50b7c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/C.md @@ -0,0 +1,78 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +This audits exactly the supplied `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and accepted `TCB.md`, under Rust/standard library 1.85.1 and Cargo 1.85.1. No generated file, dependency, test, build, macro expansion, backend, or binary claim is used. Audit cutoff: 2026-08-01. + +Write `X`, `A`, and `W` for the three supported targets (x86_64-linux-gnu, aarch64-linux-gnu, and wasm32-unknown-unknown); `b in {0,1}` for `burst`; `a in {system,arena}`; `p in P` for every Cargo profile; and `d in {0,1}` for debug assertions. The controlling full product is + +`F = {1.85.1} x {X,A,W} x {0,1} x {system,arena} x P x {0,1}`. + +`SUPPORT.md` makes the compilable-library domain + +`C = {c in F | not(c.target=W and c.allocator=arena)}`. + +No finite enumeration of `P` is inferred. The proofs below are parametric in `p,d`; neither selects inspected source. Build-domain coverage additionally quantifies over every raw environment class and success/failure of each stdout write described below. `BUILD.md` excludes manual rustc, invented cfgs, and build-script override; that exclusion is controlling, not inferred from successful compilation. + +* **Whole-crate safe-API soundness: UNSOUND**, relative to accepted `BUILD-MAP-ORDERED` and the quoted Rust axioms below. A supported safe call reaches UB. +* **Documented `lane_id(0)` panic postcondition: UNPROVED** over `C`. It is proved outside the defective configuration, but the only refutation found in that configuration contains UB, so it cannot certify `CONTRACT-BROKEN`. +* **Build mapping/freshness and W/arena rejection: PROVED** for the stated source domain relative to exactly `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `S`/`A0` the complete `cargo::rustc-cfg=fixture_allocator="system"`/`"arena"` lines. Rust blocks execute statements sequentially ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html): “a block sequentially executes its component non-item declaration statements and then its final optional expression”). Thus every path first attempts `R`, then calls `env::var`, then (only where shown) attempts one allocator line. + +`env::var` “Fetches the environment variable `key` from the current process”; it returns `NotPresent` when unset and `NotUnicode` when its value is not valid Unicode ([std](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)). The fixed name contains neither `=` nor NUL. `as_str` “Extracts a string slice containing the entire `String`” ([std](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)); match selects the first matching arm after evaluating the scrutinee ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). These facts make the following raw partition exhaustive. + +| Raw class, after successful `R` | Next events in exact order | Completed stdout prefix and exit | Current library | +|---|---|---|---| +| omitted | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `system` | attempt `S`; success returns | `R,S`, success | cfg `system` | +| Unicode `arena` | attempt `A0`; success returns | `R,A0`, success | cfg `arena`, subject to source rejection | +| Unicode `arena-stop` | attempt `A0`; after success explicit panic | `R,A0`, unsuccessful | none | +| every other Unicode string | explicit panic; no allocator attempt | `R`, unsuccessful | none | +| every non-Unicode value | explicit panic; no allocator attempt | `R`, unsuccessful | none | + +There are exactly two write-failure sites. If the `R` write fails, execution panics there: no complete directive is guaranteed (only a possibly incomplete byte prefix) and no environment read occurs. If `S` or `A0` fails, complete prefix `R` (plus a possibly incomplete suffix of that attempted line) precedes the panic; there is no return. On `arena-stop`, failure of `A0` gives the latter prefix; success gives `R,A0` followed by the explicit panic. `println!` “Prints to the standard output, with a newline” and “Panics if writing to `io::stdout` fails” ([std](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([std](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). These panics are safe behavior. + +The accepted TCB supplies, and this proof consumes only, these propositions: a completed `R` records raw-value freshness; a successful current execution's completed cfg line becomes that exact library cfg, with no retained earlier selector; any write failure or uncaught main-thread panic is unsuccessful and produces/presents no current library; enabling `burst` sets its feature cfg; and the three triples set the named `target_arch` values. Cargo documentation corroborates but does not replace that accepted premise: `rustc-cfg` “tells Cargo to pass the given value to the `--cfg` flag” ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)), while `rerun-if-env-changed` causes rerun when the named value changes ([Cargo](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). + +**Freshness challenge.** After successful `arena` in one target directory, changing the raw value to `arena-stop` is a present-to-present change covered by `R`. `BUILD-MAP-ORDERED` therefore forces a rerun before selection. That rerun either fails at `R`, fails at `A0`, or writes both then explicitly panics. Every case is unsuccessful; neither its partial output nor the old arena artifact is a result of the current build. The advertised canary works. + +## Directive-to-source closure and exclusion + +Conditional compilation compiles parts according to conditions, and a cfg attribute “conditionally includes the thing it is attached to based on a configuration predicate” ([Reference](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)). Consequently a successful accepted build supplies exactly one allocator cfg, the selected feature state, and the target architecture. + +For `W and arena`, the first predicate in `lib.rs` is true for either feature/profile/debug state, so `compile_error!`, which “Causes compilation to fail with the given error message when encountered” ([std](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)), rejects compilation. For every other member of `F` it is false, so it rejects nothing. Therefore the source enforces exactly `F ∖ C`; `arena-stop` never reaches this stage. There is no current API for the rejected pair. + +For each `c in C`, define + +`Q(c) = (burst enabled) and (target=A) and (allocator=arena)`. + +The two function-body cfgs are `Q` and `not(Q)`, hence form an exhaustive, disjoint partition. In `Q`, source selects the unconditional `return new_unchecked(value)` block. In `not(Q)`, it selects the block which first compares with zero, panics on equality, and otherwise calls `new_unchecked`. An `if` is a conditional branch and executes its consequent when its Boolean condition is true ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is the equality comparison operator ([Reference](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). + +## Unsafe obligation, witness, and exact maximal sound region + +The complete language-reachable crate API surface is the safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, constructors besides it, traits/impls, callbacks, statics, FFI, exported macros, or hidden APIs. `compile_error!` is configuration control. The two `new_unchecked` calls are the only unsafe sites. The owned invariant/obligation is `NZ(value): value != 0` immediately before either call. No caller obligation is permitted because `lane_id` is safe. + +`u8` is “The 8-bit unsigned integer type” ([std](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)); let `U={0,...,255}`. `NonZeroU8::new_unchecked` “Creates a non-zero value without checking whether the value is non-zero” and “The value must not be zero”; zero “results in undefined behavior” ([std](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +The exact maximal sound region of compiled API cases is + +`M = {(c,x) in C x U | not(Q(c) and x=0)}`. + +**Sufficiency:** if `not Q` and `x=0`, the comparison reaches `panic!` before unsafe code. If `not Q` and `x!=0`, the false branch itself establishes `NZ(x)`. If `Q` and `x!=0`, the input establishes `NZ(x)`. Thus every unsafe call in `M` satisfies its complete safety precondition. Profiles and debug assertions do not alter this derivation. + +**Necessity/maximality:** choose any profile/debug state with `(target=A, burst=1, allocator=arena, x=0)`. This configuration belongs to `C`, raw `arena` successfully selects it, and `lane_id(0)` is a well-typed safe use. `Q` selects the first block; it reaches `new_unchecked(0)`, its required proposition is false, and the quoted contract entails UB. Hence every point in `(C x U) ∖ M` is unsound, while every point in `M` was proved sound. This proves both maximality and the existential `UNSOUND` certificate. Over all of `F x U`, `W/arena` has no compiled API; every other case is classified by `M` or its complement. + +The special-path comment, “Burst-mode lane identifiers are never zero,” is false for caller-controlled `u8` and supplies neither a check nor an invariant. The ordinary-path comment is adequate: the dominating zero branch makes reaching its unsafe call imply nonzero. Minimal repair: perform the zero check before both cfg branches (or use checked `NonZeroU8::new(value)` and panic on `None`) and replace the false comment with that dominating fact. + +For the documented postcondition, zero reaches `panic!` in every `c in C` with `not Q`; it is therefore proved exactly there. In `Q`, the zero execution contains UB. There is no independent UB-free zero execution or equivalent existence proof, so the whole-domain result is `UNPROVED`, not `CONTRACT-BROKEN`. + +## TCB log, residual scope, and triggers + +* **BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo/freshness/process-status/feature/target propositions enumerated above; consumers are build reachability and exclusion only. No source correctness is imported. +* **AXIOM-CTRL/CFG/NZ (accepted Rust authority):** only the linked, versioned 1.85.1 propositions quoted above. Rust's UB rule applies inside unsafe blocks too ([Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). +* No dependency, allocator implementation, generated-code, tool, test, FFI, backend, binary, or deployment premise is consumed. “Allocator” is only this crate's cfg model. + +Re-audit on any supplied source/policy/manifest change; Cargo/Rust/stdlib version or TCB disposition change; target, feature, allocator, profile/debug scope change; changed build-output/freshness semantics; or a new API/cfg. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/D.md new file mode 100644 index 0000000000..12235d2ff6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/D.md @@ -0,0 +1,107 @@ +# Unsafe-code audit: `ordered-build-target` supplied snapshot + +## Claim, domain, and verdicts + +Audit cutoff: 2026-08-01. Scope is every supplied crate file, Cargo 1.85.1/Rust 1.85.1, the build interface and freshness contract, generated cfgs, selected `src/lib.rs`, its sole public safe API, and its documented panic condition. This is a Rust-abstract-semantics source claim, not a backend or binary claim. No build, execution, expansion, test, prior audit, or external dependency result was used. + +Write `X`, `A`, and `W` for the three listed target triples (x86_64 GNU/Linux, aarch64 GNU/Linux, and wasm32-unknown-unknown), `F={off,on}` for `burst`, `L={system,arena}`, `P` for every Cargo profile, `D={off,on}` for debug assertions, and `U={0,...,255}`. The full policy product is + +`C={X,A,W} x F x L x P x D`. + +`SUPPORT.md:9-16` says exactly those members are supported except + +`E={c in C | target(c)=W and allocator(c)=arena}`, + +so current library configurations are `S=C\E`. Both containments for this normalization follow literally: every tuple admitted by the “every other combination” clause is in `C\E`, and every member of `C\E` has listed axis values and is not the sole exclusion. No enumeration of `P` is assumed. + +Full `Required` is the union of (1) all supported Cargo build attempts over the six raw-environment classes below, every possible applicable stdout-success/failure path and relevant prior target-directory state, and (2) every call `lane_id(v)` with `c in S` and `v in U` after a current successful build. `E` and rejected selector attempts have no current API case. Manual rustc, invented cfgs, and build-script override are expressly excluded by `BUILD.md:31-34`. + +| Claim | Verdict | Certificate | +|---|---|---| +| Whole-crate safe-API freedom from UB over `S x U` | **UNSOUND** | `F-UB` below supplies a valid supported safe call, reachability, false safety condition, and explicit UB consequence. | +| “`lane_id(value)` panics when `value` is zero” over `S x {0}` | **UNPROVED** | Proved on `S\K`; the remaining `K` executions have UB, so they cannot establish `CONTRACT-BROKEN` and do not prove the postcondition. | +| Exact maximal realized library sound region | **PROVED relative to TCB-ORDERED** | `M=(S x U)\WIT`, proved below; every point in its complement within `S x U` is an UB witness. | +| Ordered build mapping, freshness canary, and target/allocator rejection | **PROVED relative to TCB-ORDERED** | Exhaustive staged relation and exact cfg derivation below. | + +Thus the combined mandatory result is **UNSOUND; documented postcondition UNPROVED**, not `PROVED` and not `CONTRACT-BROKEN`. + +## Boundary, surfaces, and invariants + +`Cargo.toml` selects only `build.rs` and `src/lib.rs`; all supplied files were read. `build.rs::main` is private and contains no unsafe operation. The complete downstream surface is the public **safe** free function `lane_id(u8) -> NonZeroU8`; there are no crate-defined public fields, constructors, traits/impls, statics, callbacks, FFI, reexports, hidden items, or exported/generated macros. Its caller has no safety precondition. The only invariant consumed is `NZ`: the argument to `NonZeroU8::new_unchecked` is nonzero, thereby producing a valid nonzero result. The function boundary must establish `NZ`; `lib.rs:18` does not. + +## Complete ordered build relation + +Let `R` be the complete line `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, and `CS`/`CA` the complete system/arena `cargo::rustc-cfg` lines. Block statements execute sequentially, and a value scrutinee is evaluated then patterns are compared sequentially until the first match. These checked semantics make the source order literal, not inferred from endpoint output. + +1. Cargo runs `build.rs`; `build.rs:4` first attempts `println!(R)`. If it succeeds, complete prefix `[R]` exists and only then is `env::var` called. If it fails, `println!` panics there: no classification or later write is reached and no earlier complete line is guaranteed. +2. With `[R]`, `env::var` and the two matches produce the exhaustive raw partition below. The key literal itself contains neither `=` nor NUL. `Result` has only `Ok`/`Err`; `VarError` has only `NotPresent`/`NotUnicode`; `as_str` preserves the entire Unicode string; literal patterns select exactly their values and `_` every remainder. + +| Raw `FIXTURE_ALLOCATOR` class | Reached operation after `[R]` | If that operation succeeds | Explicit/failure exit | +|---|---|---|---| +| omitted | `build.rs:8` attempts `CS` | return success with `[R,CS]` | write failure panics with prior complete prefix `[R]` | +| Unicode `system` | line 12 attempts `CS` | return success with `[R,CS]` | same failure prefix/exit | +| Unicode `arena` | line 15 attempts `CA` | return success with `[R,CA]` | same failure prefix/exit | +| Unicode `arena-stop` | line 18 attempts `CA` | prefix `[R,CA]`, then line 19 explicitly panics | line-18 failure panics first with prior prefix `[R]`; line 19 is not reached | +| every other Unicode value | no allocator write | none | line 21 explicitly panics with `[R]` | +| every non-Unicode value | no allocator write | none | line 24 explicitly panics with `[R]` | + +This includes every dynamic stdout failure site: common line 4 and the class-specific lines 8, 12, 15, and 18. A failed `println!` may have written an unspecified byte prefix (possibly a complete-looking attempted line); the table states only already successful complete lines. TCB-ORDERED makes all such executions unsuccessful and prevents any prefix from producing a current library, so no atomic-write premise is consumed. Explicit `panic!` writes no Cargo stdout directive. + +3. On exactly the three accepted successful classes, TCB-ORDERED interprets the current two complete lines: `R` establishes freshness tracking and exactly one of `CS`/`CA` passes the corresponding exact `fixture_allocator` key/value cfg to this library, with no selector retained from an earlier run. Every write failure, explicit panic, and `arena-stop` exit is unsuccessful; no current library compilation occurs. +4. TCB-ORDERED also supplies the exact `burst` and target-architecture leaf cfgs. Rust cfg semantics then select source. Define + +`K(c) := burst(c)=on and target(c)=A and allocator(c)=arena`. + +The first `lane_id` block is present exactly on `K`; the second is present exactly on `not K`, because its predicate is the literal `not(all(...))`. Profiles and debug assertions occur in no selector or safety check, so this partition is parametric over `P x D`. + +### Exact exclusion + +For a current successful arena selector on `W`, TCB-ORDERED sets both `target_arch="wasm32"` and `fixture_allocator="arena"`; `all` is true, the `cfg` attribute retains `compile_error!`, and that macro fails compilation. Conversely, encountering this source error requires both leaves true, hence exactly `E`; feature state is irrelevant. System-on-`W` and arena on `X`/`A` make at least one leaf false and remove the item. Therefore `Rejected_source=E` in both directions, not merely `E` contained in a sampled rejection. A failed current compilation is no current library/API case. Over the total `C x U`, `E x U` is precisely the no-library region. + +### Freshness sequence in one target directory + +Take any successful prior arena library build, necessarily on `X` or `A`. Its successful script emitted `[R,CA]`; TCB-ORDERED says a present-to-present raw change from `arena` to `arena-stop` stales that selection and reruns the script before a current library can be selected. On the rerun: line 4 failure rejects immediately; otherwise line 18 failure rejects with `[R]`; otherwise `[R,CA]` is followed by the explicit panic. TCB-ORDERED says every case supplies no current library and never presents the old arena library as this rejected build's result. The freshness canary is therefore effective. + +## Unsafe obligations and exact maximal region + +Rust 1.85.1 documents `NonZero::new_unchecked`: “The value must not be zero” and “undefined behavior if the value is zero.” Thus each site has exactly obligation `NZ`. + +* On `not K`, cfg removes the early-return block. If `v=0`, `==` is equality, the `if` consequent executes `panic!`, and control never reaches line 32. If `v!=0`, the consequent is skipped; reaching line 32 itself proves `NZ`, so the call is permitted and returns a nonzero. This reconstructs and completes the terse line-31 comment. +* On `K`, cfg removes the checked block. Line 19 is reached for every `v`. `v!=0` satisfies `NZ`; `v=0` falsifies it. The line-18 comment's “never zero” is neither type-enforced nor checked and is false for a caller-supplied `u8`. + +Let + +`WIT={(c,0) | c in S and K(c)}` and `M=(S x U)\WIT`. + +`WIT` is nonempty: `A`, burst on, arena is listed and not the wasm exclusion, for every `P,D`; an accepted arena build with successful writes selects it. Calling the public safe `lane_id(0)` is a valid safe use. Cfg makes line 19 reachable; zero falsifies `NZ`; the exact standard-library contract entails UB. This is the complete **UNSOUND** certificate (`F-UB`). + +For every member of `M`, either `not K` (the checked proof above covers every `u8`) or `K` and `v!=0` (the unsafe precondition holds); no other unsafe operation exists. Hence `M` is sound. Conversely, every member of `(S x U)\M` is by definition in `WIT` and has the proved UB certificate. Both containments establish equality and maximality, rather than a non-maximal remainder. The complete product partition is therefore: rejected `E x U`, realized-sound `M`, and realized-unsound `WIT`. + +For the panic contract, `(S\{c:K(c)}) x {0}` is proved: the equality is true and `panic!` “Panics the current thread.” On `WIT`, the whole execution contains UB, so it cannot be an UB-free postcondition counterexample. No independent UB-free witness exists in this source. The strongest global postcondition verdict is consequently **UNPROVED**, with no `CONTRACT-BROKEN` certificate. + +## Obligation ledger and findings + +| ID | Obligation | Coverage/status | +|---|---|---| +| O-BUILD | Exhaust raw classes, ordered effects/exits, partial prefixes, Cargo interpretation | All cases proved above relative to TCB-ORDERED | +| O-FRESH | stale arena then arena-stop cannot select old/current library | proved above relative to TCB-ORDERED | +| O-EXCL | reject exactly wasm32/arena | proved in both directions | +| O-NZ-NORMAL | line 32 argument nonzero | proved on `not K` for every `u8` | +| O-NZ-BURST | line 19 argument nonzero | proved only for `K and v!=0`; **UNSOUND** at `v=0` | +| O-PANIC | every zero call panics | proved on `not K`; **UNPROVED** on `K` | + +**F-UB (critical implementation defect; deficient proof artifact).** The safe `u8` input is treated as if “burst mode” enforced nonzero. Minimal resolution is to perform the zero check before every cfg-dependent unsafe call, or replace both calls with a checked safe constructor while preserving the documented panic. A valid replacement proof would say: “`new_unchecked` requires nonzero; if `value==0` the preceding `panic!` diverges, so reaching this call proves `value!=0`.” Re-audit all `K`, postcondition, and maximal-region proofs after repair. + +## Authority and TCB audit log + +**TCB-ORDERED (accepted human decision):** supplied `TCB.md` entry `BUILD-MAP-ORDERED`, Cargo 1.85.1, exact supplied manifest/script/interface/library. Consumed propositions only: required script execution; successful `R` freshness including present-to-present raw changes; exact current successful cfg and no retained selector; no compilation/old-result presentation after unsuccessful script even with complete prefixes; panic as unsuccessful exit; and exact feature/target leaves. No local emission, Rust semantics, source correctness, backend, binary, or compiler-correctness proposition is imported. Owner is the unidentified authorized human; triggers are exactly `TCB.md:43-45`. Cargo's versioned documentation corroborates that Cargo will [“execute it just before building”](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script), treats [stdout `cargo::` lines as instructions](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script), and [`rustc-cfg` passes its value to `--cfg`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg); the stronger failure/staleness clauses remain only the expressly accepted TCB proposition. + +Checked Rust 1.85.1 axioms, all accepted as version-matched authoritative text: + +* Environment/classification: `env::var` says [“The variable is not set” and `NotUnicode` means its “value is not valid Unicode”](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html); [`VarError` has exactly `NotPresent` and `NotUnicode`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html); [`Result` is `Ok(T)` or `Err(E)`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html); [`as_str` contains the entire `String`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str). +* Order/partition: blocks [“sequentially execute”](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html); match uses the [“first arm with a matching pattern”](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html); literal patterns [“match exactly the same value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), tuple patterns match enum values, and `_` [“matches any value”](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern). +* Effects: `println!` [prints stdout with newline and “Panics if writing ... fails”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics); [`panic!` “Panics the current thread”](https://doc.rust-lang.org/1.85.1/std/macro.panic.html). +* Cfg: the [conditional-compilation clauses](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) say an “option is set,” “all ... predicates are true,” `not` inverts, and false cfg means the “thing is removed from the source code.” [`compile_error!` “Causes compilation to fail”](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html). +* API: `u8::MIN=0` and [`u8::MAX=255`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html); `==` means [“Equal”](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators); a true `if` condition [executes its consequent](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html); and [`new_unchecked` “Creates a non-zero,” requires nonzero, and expressly makes zero UB](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked). + +No other TCB entry, dependency contract, tool-derived evidence, environment restriction, or compatibility premise was consumed. Rust/Cargo/toolchain, target/feature policy, script/source/docs, TCB disposition, or panic-contract changes trigger full re-audit. Review attestation is complete except that the audited artifact itself fails O-NZ-BURST and O-PANIC as reported. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/E.md new file mode 100644 index 0000000000..f826f01b97 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/E.md @@ -0,0 +1,78 @@ +# Unsafe Rust audit: complete supplied crate + +## Claim, snapshot, and verdicts + +Audited snapshot: the supplied `Cargo.toml`, `build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and `TCB.md`; Rust, std, and Cargo 1.85.1; edition 2021; no dependencies or generated source. Audit cutoff: 2026-08-01. No build, execution, expansion, or test evidence was used. + +Let `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`, `F={off,on}` for `burst`, `A={system,arena}`, `P` be every Cargo profile, and `D={off,on}` for debug assertions. The controlling support expression in `SUPPORT.md` normalizes exactly to + +`C = {(t,f,a,p,d) in T×F×A×P×D | not(t=wasm32-unknown-unknown and a=arena)}`. + +Both containments are direct: every policy-supported tuple has listed values and is not the sole stated exclusion, hence is in `C`; every member of `C` is one of the expressly supported Cartesian combinations and is not excluded, hence is policy-supported. `P` and `D` remain symbolic; no sampled inventory substitutes for them. + +The full required domain is (i) every supported-Cargo build attempt over every raw `FIXTURE_ALLOCATOR` class and every stdout-success/failure path described below, and (ii) every well-typed safe call `lane_id(x)` for `c in C` and every `x:u8`. Build rejection cases do not become library configurations. + +Verdicts, relative only to accepted `TCB.md` entry `BUILD-MAP-ORDERED` and the Rust 1.85.1 axioms quoted below: + +* **Build-interface contract: PROVED.** The raw partition, operation order, partial prefixes, current-build rejection, selector mapping, and arena-to-arena-stop freshness guarantee hold. +* **Target/allocator exclusion: PROVED.** Every wasm32/arena library attempt fails compilation, independently of feature, profile, and debug assertions; no such tuple is in `C`. +* **Safe-library soundness: UNSOUND.** A supported safe call reaches documented undefined behavior. +* **Documented panic postcondition: UNPROVED overall**, and PROVED on its exact positive region stated below. There is no UB-free counterexample establishing `CONTRACT-BROKEN`. + +## Checked authority and TCB + +The following are the material Rust axioms, all scoped to 1.85.1. + +* `std::env::var` “Fetches the environment variable `key` from the current process” and returns `NotPresent` or `NotUnicode` in the two stated error cases ([`var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); `VarError` has exactly those variants ([`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html)). `Result` “represents either success (`Ok`) or failure (`Err`)” ([`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html)). `String::as_str` “Extracts a string slice containing the entire `String`” ([`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). +* A block “sequentially executes its component non-item declaration statements” ([blocks](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html)); a match compares arms until a match and chooses the first matching arm ([match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). Tuple-struct patterns select the named enum variant, literal patterns match equal values, and `_` matches any value ([tuple-struct](https://doc.rust-lang.org/1.85.1/reference/patterns.html#tuple-struct-patterns), [literal](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern)). +* `println!` “Prints to the standard output, with a newline” and “Panics if writing to `io::stdout` fails” ([macro](https://doc.rust-lang.org/1.85.1/std/macro.println.html), [failure](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)). `panic!` “Panics the current thread” ([`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). Function calls execute their called body ([calls](https://doc.rust-lang.org/1.85.1/reference/expressions/call-expr.html), [function body](https://doc.rust-lang.org/1.85.1/reference/items/functions.html#function-body)). +* A `cfg` attribute conditionally includes its attached form; a false predicate removes it, while `all` and `not` have their literal Boolean meanings ([conditional compilation](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation), [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)). `compile_error!` “Causes compilation to fail with the given error message when encountered” ([`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). An `if` executes its consequent when its Boolean condition is true ([if](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is the equality comparison used here ([comparisons](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). `u8` is the 8-bit unsigned integer type, so every input is exactly zero or nonzero ([`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)). +* `NonZeroU8::new_unchecked` “Creates a non-zero without checking whether the value is non-zero”; critically, “This results in undefined behavior if the value is zero” and its Safety clause says “The value must not be zero” ([`new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). The general UB inventory also includes producing invalid values ([undefined behavior](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). + +`BUILD-MAP-ORDERED` is accepted exactly as written: current successful directive interpretation; freshness after a successfully written rerun directive; no current or stale library after an unsuccessful build script; feature and listed-target cfg mapping; and uncaught-main-panic status. It does **not** supply emitted strings/order or Rust/source correctness; those are derived here. Cargo documentation independently agrees that `rustc-cfg` passes a value to `--cfg` and `rerun-if-env-changed` reruns when the named value changes ([outputs](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#outputs-of-the-build-script), [`rustc-cfg`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg), [`rerun-if-env-changed`](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)); these checks do not widen the accepted premise. Cargo feature interpretation is likewise confined to the entry ([features](https://doc.rust-lang.org/1.85.1/cargo/reference/features.html)). + +## Complete ordered build relation + +Write `R` for `cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, `S` for `cargo::rustc-cfg=fixture_allocator="system"`, and `A` for the analogous `"arena"` line. Blocks execute in source order and every `println!` either completes or panics on its write. + +1. Every execution first attempts `R`. Failure exits by panic with emitted prefix `[]`; environment classification and all later operations are unreachable. Success leaves prefix `[R]`, then `env::var` is called and the exhaustive `Result`/`VarError` matches classify the raw value. +2. Raw absent: attempt `S`. Raw Unicode `system`: `as_str` yields the whole string, the literal arm matches, and it attempts `S`. Raw Unicode `arena`: analogously attempt `A`. At any such allocator-write failure, the exit is a `println!` panic with prefix `[R]`. At success, the exact prefix is respectively `[R,S]` or `[R,A]`, `main` returns normally, and `BUILD-MAP-ORDERED` passes exactly that allocator cfg to the current library compilation. +3. Raw Unicode `arena-stop`: attempt `A`. Write failure exits unsuccessfully with `[R]`. Write success leaves `[R,A]`; the following explicit `panic!` is necessarily reached and exits unsuccessfully. The emitted allocator prefix is not interpreted into a current compilation under `BUILD-MAP-ORDERED`. +4. Every Unicode value outside `{system,arena,arena-stop}` reaches `_` and explicitly panics with `[R]`; every non-Unicode value reaches `Err(NotUnicode(_))` and explicitly panics with `[R]`. No allocator write is attempted. + +Thus the successful outputs are exactly `[R,S]` for absent or `system`, and `[R,A]` for `arena`; unsuccessful prefixes are exactly `[]`, `[R]`, and (only for a fully written `arena-stop` allocator line) `[R,A]`. This accounts for both stdout failure points on every path where the second exists; a write failure is an exit, so no later fact is consumed. + +Freshness is ordered, not inferred from an endpoint. A successful `arena` run necessarily wrote `R` before `A`. By the accepted entry, changing the same target directory's raw value to `arena-stop` makes that selection stale and reruns the script before current selection. The rerun either fails writing `R`, fails writing `A`, or writes both then explicitly panics. Every case is unsuccessful, and the entry forbids both a current compilation and presentation of the earlier arena library as the current result. The canary therefore rejects. + +## Configuration selection and exclusion + +On a successful selector run, the TCB gives exactly one allocator cfg; it also gives `feature="burst"` iff enabled and the exact `target_arch` for each listed target. For wasm32/arena, `all(target_arch="wasm32", fixture_allocator="arena")` is true, so the `cfg` attribute includes `compile_error!`; compilation fails for both feature states and all `P,D`. For every other tuple, that conjunction is false and the item is removed. Partial `arena-stop` output never reaches this stage. This proves effective rejection, rather than merely assuming the policy exclusion. + +## API, invariant, and obligation coverage + +The only crate public surface is safe `pub fn lane_id(u8)->NonZeroU8`. There are no fields, constructors beyond that function, traits/impls, statics, FFI, callbacks, exported macros, hidden APIs, dependencies, or mutable state. The only unsafe sites are its two configuration-complementary calls to `new_unchecked`. The required local proposition at either call is `NZ(value): value != 0`. + +Let `B(c) = (f=on and t=aarch64-unknown-linux-gnu and a=arena)`. The two `cfg` predicates are literally `B` and `not(B)`, so exactly one block exists for every `c in C`; profile and debug state occur in neither selection nor proof. + +* If `B(c)`, source calls `new_unchecked(value)` without a check. `NZ` holds exactly when `value!=0`. The comment “Burst-mode lane identifiers are never zero” is false as an invariant: the safe signature admits every `u8`, and no producer or boundary restricts it. +* If `not B(c)`, `value==0` reaches `panic!` before the unsafe call. Otherwise the exhaustive complement is `value!=0`, establishing `NZ`; `new_unchecked` is then permitted. The adjacent second safety comment states the controlling local fact and is correct. + +### Exact maximal sound region + +Over the requested complete product and inputs, define + +`SOUND = {(c,x) in C×u8 | not(B(c) and x=0)}`. + +`SOUND` is sound: partition on `B`; in `B`, its formula gives `x!=0`, and outside `B`, zero panics before unsafe while nonzero proves `NZ`. These cases exhaust `SOUND`. It is exact: its complement within `C×u8` is exactly `{(c,0) | c in C and B(c)}` by Boolean algebra. Every such tuple reaches `new_unchecked(0)`, whose checked contract says that is UB. Consequently any strict superset of `SOUND` within `C×u8` contains an unsound tuple; `SOUND` is the unique maximal region. This proof is parametric over every `p in P` and both `d in D`. + +The universal soundness claim is therefore **UNSOUND**. A certificate is any supported `c` with aarch64 target, burst on, arena allocator, arbitrary profile/debug state, plus the well-typed safe call `lane_id(0)`: the first cfg block is selected, the unchecked call is executed, its required `value!=0` proposition is false, and its version-matched contract expressly entails UB. + +For the documented “Panics when `value` is zero” postcondition, the exact proved region is `{c in C | not B(c)}`: the equality is true and `panic!` is reached before unsafe. In `B`, zero reaches UB instead. An execution containing UB cannot certify `CONTRACT-BROKEN`, and no independent UB-free non-panicking zero execution is established; hence the full postcondition is **UNPROVED**, not `CONTRACT-BROKEN`. + +## Findings and remediation + +**F-1 — UNSOUND, critical.** `src/lib.rs`'s aarch64/burst/arena safe branch has an unenforced nonzero precondition and a false safety comment. Minimum repair: perform the same zero check on that branch, or use checked `NonZeroU8::new(value)` and panic on `None`; then replace the comment with the actual dominating derivation. Making the safe function unsafe would be a breaking and unnecessary alternative. Re-audit the new snapshot and the panic claim. + +**F-2 — postcondition UNPROVED.** The same region prevents a universal panic proof. F-1's checked repair also resolves it; wording alone cannot repair either result. + +No tool-derived evidence or additional assumptions were used. Residual scope excludes manual rustc invocation, invented cfgs, overridden build scripts, unlisted targets/toolchains, and binary/backend correctness exactly as the policies require. Re-audit on any source, support product, Cargo/Rust/std identity, build interface, cfg, TCB disposition, or documentation-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/F.md new file mode 100644 index 0000000000..5578f5219e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/F.md @@ -0,0 +1,203 @@ +# Unsafe Rust audit: `ordered-build-target` + +## Claim, snapshot, and verdicts + +This is a source-only audit of the complete supplied snapshot: `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, and `REQUEST.md`. +No build, execution, test, or expansion was used. The theorem is for Rust/Cargo +1.85.1, edition 2021, at the 2026-08-01 cutoff; it makes no backend or binary +claim. `BUILD-MAP-ORDERED` in the supplied `TCB.md` is the accepted TCB +revision. No dependency, tool-result, or additional implementation premise is +consumed. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe call to `lane_id` in every supported current library is free of Rust UB | **UNSOUND** | F-01 gives a valid safe call, reachability, false unsafe precondition, and authoritative UB consequence. | +| Documented postcondition “Panics when `value` is zero” over every supported library configuration | **UNPROVED** | Proved outside the exceptional configuration; its only zero execution has UB, so it cannot prove `CONTRACT-BROKEN`. | +| Ordered selector mapping, rejection, and `arena`→`arena-stop` freshness | **PROVED relative to `BUILD-MAP-ORDERED`** | B-01/B-02 below. | +| Required wasm32/arena exclusion | **PROVED** | B-03: the selected source necessarily fails compilation. | + +The combined mandatory result is therefore **UNSOUND** for soundness and +**UNPROVED** for the panic postcondition, not `CONTRACT-BROKEN`. + +## Exact theorem domain + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `F={off,on}` be `burst`; `A={system,arena}`; `P` be every Cargo profile; and + `D={off,on}` be debug assertions; +* `Q = T×F×A×P×D \ { (wasm32-unknown-unknown,f,arena,p,d) }`; and +* `U` be every value of type `u8`. + +This is an equality normalization of `SUPPORT.md`: it states exactly those +three targets, both feature and allocator states, every profile and both debug +assertion states, then removes exactly wasm32/arena for either feature. The +manifest fixes Rust 1.85.1/edition 2021 and declares only `burst`. `BUILD.md` +defines allocator selection. There is no policy conflict and no release +interval to extrapolate. Raw environment classes rejected below are build +interface cases, not extra members of `A`. Profiles/debug assertions do not +occur in the source predicates or arithmetic, so the proofs are parametric in +`P,D`. + +Write +`C(q) := (F=on ∧ T=aarch64-unknown-linux-gnu ∧ A=arena)`. +The **exact maximal sound region** over the requested full product is + +`S = { (q,v) ∈ Q×U | ¬C(q) ∨ v≠0 }`. + +The proof of both inclusion and maximality appears under S-01/S-02. + +## B-01: complete ordered build relation + +Let `R`, `L_s`, and `L_a` denote the newline-terminated rerun, system-cfg, and +arena-cfg lines literally present in `build.rs`. Let `p(X)` mean whatever bytes, +if any, a failed attempt to print `X` emitted; it may be empty or include a +complete line. Its exact bytes are immaterial because the accepted TCB says any +stdout-write failure is an unsuccessful script and supplies no current library. + +For **every** raw class, the first event is an attempt to print `R`. If it +fails, execution stops by `println!` panic with output `p(R)`; the environment +is not read, and there is no library. If it succeeds, the remaining exhaustive +relation is: + +| Raw `FIXTURE_ALLOCATOR` class | Events after `R`, in order | Output/exit | Current result | +|---|---|---|---| +| omitted | `env::var` gives `NotPresent`; attempt `L_s` | failure: `R+p(L_s)`, write panic; success: `R+L_s`, normal return | none on failure; exactly cfg `fixture_allocator="system"` and library attempt on success | +| Unicode `system` | `Ok`; `as_str`; literal arm; attempt `L_s` | same two outcomes | same | +| Unicode `arena` | `Ok`; `as_str`; literal arm; attempt `L_a` | failure: `R+p(L_a)`, write panic; success: `R+L_a`, normal return | none on failure; exactly cfg `fixture_allocator="arena"` and library attempt on success | +| Unicode `arena-stop` | `Ok`; literal arm; attempt `L_a`; if successful, explicit `panic!` | `R+p(L_a)`, write panic, or `R+L_a`, explicit panic | none in either case | +| every other Unicode value | `Ok`; wildcard arm; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | +| every non-Unicode value | `NotUnicode`; explicit `panic!`; no selector attempt | `R`, unsuccessful | none | + +Thus the only normal exits are omitted/system→system and arena→arena, each +after exactly two successful stdout writes. `BUILD-MAP-ORDERED` is consumed +literally: a successful current script gives the library exactly its current +selector directive and no retained selector; an unsuccessful script gives no +current compilation or stale result. It also supplies the requested feature +and target cfg mapping. The source-level ordering/partition follows from the +arms at `build.rs:4-25`; no endpoint-only inference is used. + +## B-02: freshness certificate + +Assume a successful `arena` build in target directory `X`. Its successful `R` +records the raw variable dependency and its `L_a` selects arena. Changing the +present value to `arena-stop` makes that result stale under +`BUILD-MAP-ORDERED`, so Cargo reruns the script before current selection. The +rerun has exactly three possibilities: first write failure (`p(R)`), second +write failure (`R+p(L_a)`), or both writes followed by the explicit panic +(`R+L_a`). Every possibility exits unsuccessfully. The accepted premise says +none compiles a current library or presents the earlier arena library as this +build's result. The requested reuse sequence therefore rejects exactly as +documented. + +## B-03: source exclusion and source selection + +On target wasm32 with a successful arena selector, the accepted TCB supplies +both `target_arch="wasm32"` and `fixture_allocator="arena"`. The first cfg in +`src/lib.rs` therefore includes `compile_error!` for either feature, profile, +or debug state, and compilation fails. Hence every and only listed +target/allocator exclusion is effectively rejected; no current library API is +produced. + +For every `q∈Q`, cfg processing selects exactly one `lane_id` body: + +* if `C(q)`, lines 13-22 include the immediate unchecked return and lines + 24-37 are absent; +* if `¬C(q)`, the first block is absent and the second checks zero before its + unchecked constructor. + +The public safe surface is exactly `pub fn lane_id(u8)->NonZeroU8`. There are no +public fields, unsafe APIs/traits/impls, callbacks, exported macros, hidden +items, FFI, dependencies, or invariant-bearing stored state. The standard +macros are consumers of documented standard behavior, not generated public +surface. + +## Unsafe-operation and postcondition ledger + +**S-01 (`¬C`).** If `v=0`, the equality test enters `panic!` before unsafe code. +If `v≠0`, the dominating test establishes the sole precondition of +`NonZeroU8::new_unchecked(v)`; it returns a valid nonzero value. The adjacent +safety comment is an adequate local proof. This proves UB freedom for all +`P,D` and proves the zero-panic postcondition. + +**S-02 (`C`).** If `v≠0`, the unsafe constructor's sole precondition holds, so +this region is sound. If `v=0`, F-01 proves UB. Since zero/nonzero and +`C/¬C` are exhaustive, every point of `S` is proved sound and every point of +`(Q×U)\S` is proved unsound. Consequently no strict superset of `S` within +`Q×U` is sound: this establishes exact maximality, not merely a positive +remainder. + +**POST-01.** The documented implication `v=0 ⇒ lane_id(v) panics` is proved for +`¬C`. For `C,v=0`, the execution reaches UB before a defined return or panic +can be certified. Under the required whole-execution rule, that execution +cannot witness `CONTRACT-BROKEN`; no independent UB-free refutation exists in +this source. The full-product postcondition is therefore `UNPROVED`. + +## F-01 — unchecked zero behind a safe API + +* **Status:** soundness **UNSOUND**; proof artifact deficient. +* **Valid use:** choose any `p∈P,d∈D`, target aarch64, `burst=on`, allocator + arena, and call the public safe `lane_id(0)`. This point belongs to `Q×U` and + requires no caller safety obligation. +* **Reachability:** `C` includes lines 13-22 and the function immediately calls + `NonZeroU8::new_unchecked(0)`. +* **False proposition:** that unsafe function requires a nonzero argument; zero + falsifies it. +* **UB consequence:** the exact standard-library contract states that zero + causes UB, independently confirmed by the Reference invalid-value rule. +* **Proof defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced constructor invariant and is false for caller-controlled `u8`. +* **Minimum repair:** make a dominating `value==0` panic check apply to the + exceptional block (or remove that block), then re-audit all cfg cases. Merely + editing the comment cannot repair the safe API. + +## Rust axioms and TCB audit + +The material Rust 1.85.1 propositions were checked against these narrowly +scoped authorities: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) “returns an + error if the environment variable is not set, or if the value is not valid + Unicode”; [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” +* [Block expressions](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + sequentially execute component statements; [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + “branches on a pattern.” These ground the source order, while `BUILD.md` + supplies the claimed complete raw partition. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) “Prints + to the standard output, with a newline,” and its [panic contract](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + says it panics if stdout writing fails. [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached construct according to its predicate; + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “Causes compilation to fail with the given error message when encountered.” + The [equality operators](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + are equality/inequality tests, and an [if expression](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + executes its consequent when its boolean condition is true. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and “This results in undefined behavior if the + value is zero.” The [Reference](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html) + says producing an invalid value is immediate UB and names `NonZero` as a type + with a custom valid range. + +`BUILD-MAP-ORDERED` is accepted only for: Cargo 1.85.1 execution; successful +rerun-line freshness including present-to-present changes; exact current +successful cfg-line interpretation with no retained selector; no library/stale +result after unsuccessful script exit; main-thread panic as unsuccessful; and +the named feature/target cfgs. Consumers are B-01–B-03 and source reachability. +No claim about emitted strings, source correctness, Rust semantics, backend, or +binary is imported. Its stated trigger—any Cargo/toolchain, manifest, script, +environment, target, source-cfg, or disposition change—requires re-audit; +source/API/docs/support changes likewise do. + +## Residual scope and attestation + +Manual rustc, invented cfgs, build-script override, unsupported targets, and +rejected raw values producing a library are outside the theorem exactly as +`BUILD.md` states. Rejected build executions and wasm32/arena have no API point +and are not counted as vacuously sound members of `S`. Every discovered build, +configuration, safe-surface, unsafe-operation, and requested postcondition +obligation has a status above; there is no sampled evidence or unresolved +supported configuration remainder. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/G.md new file mode 100644 index 0000000000..b70a0f21ac --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/G.md @@ -0,0 +1,208 @@ +# Source-only unsafe-code audit: supplied crate + +**Cutoff:** 2026-08-01. **Snapshot:** the complete supplied `Cargo.toml`, +`build.rs`, `src/lib.rs`, `BUILD.md`, `SUPPORT.md`, and `TCB.md`; no generated +source, dependencies, lockfile, tests, or prior audit were supplied or used. +Rust, standard library, edition, and Cargo are exactly 1.85.1, 1.85.1, 2021, +and 1.85.1. This is a Rust-abstract-semantics result, not a compiler-binary or +platform theorem. + +## Claims and verdicts + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the compiled public library is free of Rust UB over the supported domain | **UNSOUND** | F-1 gives a valid supported safe call, reaches `new_unchecked(0)`, falsifies its safety condition, and its contract says the result is UB. | +| `lane_id(value)` “Panics when `value` is zero” | **UNPROVED** | Proved on `not(K)` below. The only failing region executes UB, so it is not a UB-free `CONTRACT-BROKEN` witness. | +| Exact maximal sound API region | **PROVED** relative to `BUILD-MAP-ORDERED` | Both containments and maximality are proved below. | +| Ordered selector/rejection/freshness relation and wasm/arena source exclusion | **PROVED** relative to `BUILD-MAP-ORDERED` | Exhaustive staged relation below. | + +The combined mandatory result is therefore **soundness UNSOUND; panic +postcondition UNPROVED**. No design change affects these current-snapshot +verdicts. + +## Domain recovery + +Let + +* `T={x86_64-unknown-linux-gnu,aarch64-unknown-linux-gnu,wasm32-unknown-unknown}`; +* `B={off,on}` be `burst`, `A={system,arena}`, `P` any Cargo profile, `D` either + debug-assertion state, and `v:u8` any safe API input; +* `C0=T×B×A×P×D`; +* `E(c) := target=wasm32-unknown-unknown ∧ allocator=arena`; +* `S := C0 ∖ E`, the supported compiled-library configurations; and +* `K(c) := burst=on ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena`. + +This is an equality, not a sample: `SUPPORT.md` says “these target triples,” +“both states,” “both allocator models,” “exactly one exclusion,” and “every +other combination,” and explicitly quantifies every profile and both `D` +states. Thus every member of `S` is promised and every promised library +configuration is in `S`; there is no policy conflict. `Cargo.toml` independently +fixes the sole feature and toolchain. Profiles and `D` do not occur in a source +predicate or arithmetic operation, so every proof below is parametric over +their fibers. + +The full required cases are (i) every supported Cargo build attempt for each +raw environment class and every possible relevant stdout success/failure +sequence, including required rejection outcomes, and (ii) every safe +`lane_id(v)` execution for `c∈S`. Manual `rustc`, invented cfgs, and build-script +overrides are expressly outside `BUILD.md`. + +## Checked semantic authority + +These are Rust 1.85.1 axioms, not extra project assumptions: + +* [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html) says it + returns `NotPresent` when “The variable is not set” and `NotUnicode` when the + value “is not valid Unicode.” [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) + has exactly those two variants. The fixed key contains neither `=` nor NUL. +* A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements,” and a + [match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html) + compares arm patterns sequentially and chooses the first match. [Literal + patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the value created by the literal”; the [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” [`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + extracts a slice containing the entire `String`. +* [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + “Panics if writing to `io::stdout` fails”; [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) + “Panics the current thread.” +* The [`cfg` attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + conditionally includes its attached form from its predicate; [`all`/`not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + are true when all operands are true / their operand is false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message.” +* The [comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators) + and [`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html) + rules make `value == 0` select its consequent exactly for zero. +* [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked) + says: “The value must not be zero,” and “This results in undefined behavior + if the value is zero.” + +Cargo's 1.85.1 documentation corroborates, but does not replace, the accepted +Cargo premise: build scripts communicate by `cargo::` lines on stdout +([life cycle](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#life-cycle-of-a-build-script)); +`rustc-cfg` passes the value to compiler `--cfg` +([outputs](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rustc-cfg)); +and `rerun-if-env-changed` reruns when the named value changes +([freshness](https://doc.rust-lang.org/1.85.1/cargo/reference/build-scripts.html#rerun-if-env-changed)). +Process failure, current-output identity, and stale-artifact non-presentation +are consumed only in the narrower wording of accepted `BUILD-MAP-ORDERED`. + +## Complete ordered build relation + +Write `R` for the complete rerun line, `Sline` for the system cfg line, and +`Aline` for the arena cfg line. A failed `println!` may have emitted an +unspecified fragment `q` of that attempted output; no proof consumes `q`. + +1. Every path first attempts `R`. Failure exits by uncaught panic with output + `q`, performs no environment read, and produces no current library. + Success leaves the complete prefix `[R]` and only then calls `env::var`. +2. The result partition is exhaustive: absent; Unicode `system`; Unicode + `arena`; Unicode `arena-stop`; every other Unicode string (including empty); + and non-Unicode. Absence and `system` next attempt `Sline`; `arena` and + `arena-stop` next attempt `Aline`. Failure at any such second write exits by + uncaught panic with `[R]·q` and no current library. +3. Successful absent/`system` writes yield exactly `[R,Sline]`, normal return, + and exactly cfg `fixture_allocator="system"`. Successful `arena` yields + exactly `[R,Aline]`, normal return, and exactly cfg + `fixture_allocator="arena"`. These are the only successful selectors. +4. Successful `arena-stop` writes `[R,Aline]` and then explicitly panics. + Other-Unicode and non-Unicode explicitly panic with exactly the completed + directive prefix `[R]`, before attempting any allocator line. By + `BUILD-MAP-ORDERED`, every unsuccessful process produces no current library + even if a complete selector line was emitted; no prior selector is retained. + +This includes every stdout failure point and every claim-relevant partial +prefix. The raw partition is exact by `env::var`/`VarError`, the four literal +arms, and the wildcard; it creates only the two allocator models. + +On a successful selector, `BUILD-MAP-ORDERED` supplies exactly that allocator +cfg, maps `burst` and the three target triples to the named leaf cfgs, and +supplies no old selector. For `E`, the crate-level `all(wasm32,arena)` is true +for both feature states and `compile_error!` fails compilation. Conversely, +within `C0`, that conjunction is true only on `E`; hence the enforced exclusion +equals, rather than merely contains, the policy exclusion. All `S` cases reach +`lane_id` source. + +**Freshness certificate.** A successful `arena` build necessarily completed +`R`. In the same target directory, changing the raw value to `arena-stop` is a +present-to-present change. The exact accepted premise therefore makes the old +selection stale and reruns the script before current selection. The rerun +either fails a write or completes `[R,Aline]` and panics; all alternatives are +unsuccessful, compile no current library, and cannot present the old arena +library as the current result. + +## API, obligations, and exact maximal sound region + +The boundary inventory is complete: the crate exports only the safe free +function `lane_id(u8)->NonZeroU8`. There are no public fields, constructors, +traits/impls, callbacks, FFI, reexports, hidden items, or generated APIs. Its +only unsafe operations are the two cfg-complementary `new_unchecked` calls. +There is no persistent invariant-bearing representation. + +Cfg semantics makes the first block present exactly on `K` and the second +present exactly on `not(K)`; these predicates are complements, so exactly one +unsafe call exists in every `S` compilation. + +Define + +`M := {(c,v) ∈ S×u8 | ¬K(c) ∨ v≠0}`. + +**`M` is sound.** If `¬K` and `v=0`, the equality is true and `panic!` is +executed before the unsafe call; panic is not UB. If `¬K` and `v≠0`, that +branch is skipped and the dominating comparison establishes the exact +`new_unchecked` precondition. If `K` and `v≠0`, the input itself establishes +that precondition. These cases exhaust `M`; profile, debug assertions, and +panic strategy do not alter selection or the precondition. + +**Maximality/equality.** Inside `S×u8`, Boolean and integer case splitting gives +`(S×u8) ∖ M = {(c,0) | c∈S ∧ K(c)}`. Every such case reaches +`new_unchecked(0)`, whose required proposition is false and whose applicable +contract entails UB. Thus every point in `M` is sound and no point outside it +can be added: `M` is the exact maximal sound region. Over the pre-exclusion +product `C0×u8`, `E×u8` is rejected rather than a compiled API region; the +exact sound-or-rejected region is `(E×u8) ∪ M`. + +For the panic postcondition, all `¬K,v=0` cases execute `panic!`. The +`K,v=0` cases instead enter UB. Under whole-execution classification they prove +neither that a panic occurs nor a UB-free failure to panic, so the universal +postcondition is **UNPROVED**, not `CONTRACT-BROKEN`. + +## Finding F-1: unchecked zero in the special branch + +* **Implementation:** **UNSOUND**; **proof artifact:** false/deficient. +* **Valid use:** successfully build supported `aarch64-unknown-linux-gnu` with + raw `arena`, `burst` enabled, any profile/debug state, then safe-call + `lane_id(0)`. Safe callers have no precondition. +* **Reachability:** all three leaves of `K` are true, so the special block calls + `new_unchecked(0)`. +* **False proposition and consequence:** required `value≠0` is false; the + version-matched contract explicitly entails UB. +* **Comment defect:** “Burst-mode lane identifiers are never zero” reverses no + enforced producer contract and is contradicted by the public `u8` input. +* **Minimum repair:** perform the zero check before every cfg-dependent unsafe + call (or use a checked constructor) and replace the comment with the + dominating-check derivation. Re-audit `M` and the panic contract. Merely + changing documentation cannot repair the safe API. + +The fallback comment's local fact is correct: its zero branch dominates the +unsafe call. No other implementation or proof finding was found after the +complete surface/configuration inventory; this does not dilute F-1. + +## TCB, residual scope, and triggers + +The sole admitted project entry is `TCB.md` / **BUILD-MAP-ORDERED**, accepted +for exact Cargo 1.85.1 and only its stated execution, stdout-success, +freshness, process-status, feature, target-cfg, and selector-identity +propositions. Consumers are the staged relation, reachability, freshness, and +exclusion proof above. It supplies no Rust semantics or source correctness and +has not been widened. The Rust links above are authoritative axioms. There are +no dependency, tool-derived, external, probabilistic, deployment, or backend +premises and no test evidence. + +Re-audit on any supplied source/policy/manifest change; Rust, std, Cargo, target, +feature, profile, cfg, allocator, environment interface, or TCB change; changed +authoritative wording; or any new public/unsafe surface. All requested source +and build outcomes were audited; binaries, actual compiler correctness, +platform execution, manual cfg injection, and target files not supplied are +outside scope. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/H.md new file mode 100644 index 0000000000..069ed51e9b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/H.md @@ -0,0 +1,107 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +## Claims, scope, and verdicts + +This is a source-only audit of `Cargo.toml`, `build.rs`, `src/lib.rs`, and the supplied build, support, request, and TCB policies, at cutoff 2026-08-01. It covers Rust/Cargo/standard library 1.85.1, the complete supported build interface, the only public safe API, both unsafe operations, the source-enforced exclusion, and the documented panic postcondition. No binary/backend claim is made; nothing was built, run, tested, generated, or expanded. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every valid safe `lane_id` call in the required library domain is free of Rust UB. | **UNSOUND** | `SOUND-1` below gives a valid supported zero-input witness reaching documented UB. | +| “Panics when `value` is zero” throughout that domain. | **UNPROVED** | Proved outside `U`; inside `U` the only execution has UB, so it cannot certify `CONTRACT-BROKEN`. | +| Ordered build mapping, rejection, and freshness behavior. | **PROVED relative to accepted `BUILD-MAP-ORDERED`** | Exhaustive raw-value/write-outcome partition `BUILD-1`; freshness proof `BUILD-2`. | +| wasm32/arena is effectively excluded. | **PROVED relative to `BUILD-MAP-ORDERED`** | `CFG-1`: every successful arena selection for wasm32 activates `compile_error!`. | +| Formula `S` below is the exact maximal sound region. | **PROVED relative to the stated TCB** | Positive proof on `S`; UB proof at every point of its complement in the supported domain. | + +The combined mandatory result is **UNSOUND; documented postcondition UNPROVED**. + +## Required theorem domain and closure + +Let `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, wasm32-unknown-unknown}`, `B={burst-off,burst-on}`, `A={system,arena}`, `P` be every Cargo profile, and `D={debug-assertions-off,on}`. The policy's full product is + +`F = T × B × A × P × D`. + +Its exact supported library predicate is + +`C = F ∖ {c ∈ F | target(c)=wasm32-unknown-unknown ∧ allocator(c)=arena}`. + +This is an equality, not an inferred narrowing: `SUPPORT.md` gives precisely these axes, all their combinations, and exactly that exclusion. `Cargo.toml` fixes Rust 1.85.1/edition 2021 and declares `burst`; `BUILD.md` fixes allocator selection. Profiles and debug assertions never occur in either selected function body, so all proofs below are parametric over `P×D`. + +Build-interface `Required` additionally quantifies over every raw `FIXTURE_ALLOCATOR` class (omitted, `system`, `arena`, `arena-stop`, other Unicode, non-Unicode) and success/failure of every attempted stdout write. A current API execution exists only after an accepted selector's successful script exit and successful non-excluded library compilation. For API soundness, `Required=C×{0,…,255}`: `u8` is the “8-bit unsigned integer type” ([`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html)), and this safe function states no caller precondition. + +Closure is exhaustive: `BUILD-1` partitions all build cases; `C` partitions into `U` and `¬U`; inputs partition into zero and nonzero. Each obligation below covers every resulting case, so no sampled configuration substitutes for `Required ⊆ Covered`. + +## Authoritative Rust 1.85.1 premises + +These are the only Rust semantic axioms consumed: + +- **AX-ENV.** `env::var` returns `NotPresent` when “The variable is not set” and `NotUnicode` when its value “is not valid Unicode” ([`var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); `VarError` has exactly `NotPresent` and `NotUnicode(OsString)` ([`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html)). `String::as_str` “Extracts a string slice containing the entire `String`” ([`as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). A match chooses “The first arm with a matching pattern” ([match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)); literal patterns match their literal and `_` matches any value ([literal](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns), [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern)). +- **AX-OUT/PANIC.** `println!` “Panics if writing to `io::stdout` fails” ([`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)); `panic!` “Panics the current thread” ([`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). +- **AX-CFG.** A `cfg` attribute “conditionally includes the thing it is attached to” ([`cfg`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); `compile_error!` “causes compilation to fail with the given error message” ([`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +- **AX-CONTROL.** For `if`, a true condition executes the consequent block ([`if`](https://doc.rust-lang.org/1.85.1/reference/expressions/if-expr.html)); `==` is an equality operator ([comparison](https://doc.rust-lang.org/1.85.1/reference/expressions/operator-expr.html#comparison-operators)). Thus the `u8` comparison exactly separates zero from nonzero. +- **AX-NZ.** `NonZero::new_unchecked` “Creates a non-zero integer value without checking”; “This results in undefined behavior if the value is zero” ([`new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). This is also the Reference's UB class “producing an invalid value” ([undefined behavior](https://doc.rust-lang.org/1.85.1/reference/behavior-considered-undefined.html)). + +## Ordered build-to-source relation + +Write `R` for the complete rerun line and `S`/`A` for complete `system`/`arena` cfg lines. `q(L)` means any byte prefix produced by the failing `println!` for line `L` (possibly empty); regardless of those bytes, the TCB says an unsuccessful execution supplies no current library. + +| Raw class and ordered events after entry | Emitted prefix; exit; current result | +|---|---| +| Any raw value; first print fails | `q(R)`; println panic/unsuccessful; no library | +| omitted or Unicode `system`; `R` succeeds; `S` fails | `R,q(S)`; println panic; no library | +| same; both prints succeed | `R,S`; normal return; cfg `fixture_allocator="system"` | +| Unicode `arena`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; both succeed | `R,A`; normal return; cfg `fixture_allocator="arena"` | +| Unicode `arena-stop`; `R` succeeds; `A` fails | `R,q(A)`; println panic; no library | +| same; `A` succeeds | `R,A`; explicit panic; no library | +| other Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | +| non-Unicode; `R` succeeds | `R`; explicit panic before allocator print; no library | + +**BUILD-1.** AX-ENV and the fixed valid key make `env::var`'s result exactly absent, valid-Unicode `String`, or non-Unicode. AX-ENV/match/literals then select exactly the listed source arm. There are only the two `println!` sites in execution order; AX-OUT establishes each failure exit. Falling through `main` is successful. `BUILD-MAP-ORDERED` supplies only the stated Cargo consequences: a successful current script passes its exact cfg; every panic/write-failure exit compiles/presents no current library. Thus even a complete allocator directive in the `arena-stop` prefix has no effect. + +**BUILD-2 (freshness).** A successful `arena` run necessarily wrote `R` then `A`. The accepted TCB says that changing the raw present value to `arena-stop` makes that result stale and reruns the script before selection. The rerun has exactly three possibilities above: first print failure; `R` followed by allocator-print failure; or `R,A` followed by explicit panic. All are unsuccessful, and the TCB expressly forbids presenting the old arena library as the current result. The canary therefore rejects under reuse of the same target directory. + +**CFG-1.** On a successful arena selector, the TCB maps its emitted cfg exactly and maps the three target triples to their stated `target_arch`. AX-CFG makes `all(target_arch="wasm32", fixture_allocator="arena")` include `compile_error!` for both feature states; AX-CFG then forces compilation failure. Other raw rejection cases never reach current library compilation. The project exclusion is therefore enforced. + +The complete successful-output-to-source projection is therefore: + +| Emitted allocator cfg | Target/feature | Selected library source/result | +|---|---|---| +| `system` | every `T×B` | no source error; `U` is false; checked block | +| `arena` | x86_64, either feature | no source error; `U` is false; checked block | +| `arena` | aarch64, burst off | no source error; `U` is false; checked block | +| `arena` | aarch64, burst on | no source error; `U` is true; unchecked burst block | +| `arena` | wasm32, either feature | `compile_error!`; no current library artifact | + +No other allocator cfg reaches a current compilation. These cases are exhaustive by `BUILD-1` and the TCB's exact feature/target mappings. + +## API, obligations, and exact maximal sound region + +The entire public surface is safe free function `lane_id(u8)->NonZeroU8`; there are no public fields/types, traits, callbacks, FFI, reexports, hidden items, or generated/macro-generated APIs. `build.rs::main` is the audited build entrypoint. The two cfg-complementary `new_unchecked` calls are the only unsafe operations. The sole invariant consumed/established is that the returned `NonZeroU8` contains a nonzero integer. + +Define + +`U(c) := burst(c)=on ∧ target(c)=aarch64-unknown-linux-gnu ∧ allocator(c)=arena`. + +The exact maximal sound region over the full supported product and every API input is + +`S = {(c,v) ∈ C×{0,…,255} | ¬U(c) ∨ v≠0}`. + +**Positive proof.** If `U(c)`, AX-CFG includes only the first block; for `v≠0`, AX-NZ's sole safety requirement holds and it constructs the promised nonzero value. If `¬U(c)`, AX-CFG includes only the checked block. At `v=0`, AX-CONTROL reaches `panic!` before unsafe code. At `v≠0`, it skips the panic and the dominating comparison establishes AX-NZ's precondition. These cases cover `S`, independently of profile/debug-assertion state. + +**SOUND-1 and maximality.** Choose any profile/debug state, successful raw `arena`, aarch64 target, `burst` enabled, and safe input `0`. This configuration lies in `C`; `0` is a valid `u8`; the public call is valid safe use. `U` includes the unchecked block, which executes `new_unchecked(0)`. AX-NZ says that exact event is UB. Hence the full universal claim is **UNSOUND**. Every point of `(C×u8)\S` has exactly those three cfg facts and `v=0`, so the same proof establishes UB everywhere outside `S`; together with the positive proof, `S` is maximal, not merely a positive remainder. + +**Panic postcondition.** For every `c∈C` with `¬U(c)` and `v=0`, the checked branch invokes `panic!`, proving the documented implication. For `U(c),v=0`, execution instead has UB. Under the required whole-execution certificate, that is not a UB-free witness to a broken behavioral contract. Therefore the full postcondition is **UNPROVED**, not `CONTRACT-BROKEN`; its exact unresolved region is `{(c,0)|c∈C∧U(c)}`. + +## Finding and proof-artifact assessment + +**F-1 (critical implementation defect).** The first safety comment claims burst-mode lane identifiers are never zero, but the safe boundary accepts arbitrary `u8` and establishes no such invariant. The smallest repair is an unconditional zero check before either unsafe call (or a safe checked constructor), preserving the documented panic contract. Re-audit all cfg regions afterward. + +The second comment's dominating `value==0` branch does establish the required nonzero fact, so its implementation proof is correct on `¬U`; for proof-grade maintenance it should also name `new_unchecked`'s exact requirement and resulting `NonZeroU8` invariant. The first comment is false, not merely incomplete. + +## TCB audit log, evidence, residual scope, and triggers + +`BUILD-MAP-ORDERED` is the sole non-Rust admitted premise. Its human disposition is accepted only for Cargo 1.85.1, this exact manifest/build script/environment/library, successful-line interpretation, freshness/no-stale-result behavior, failure status, feature cfg, and target-arch cfg. This report consumes every listed part only in `BUILD-1`, `BUILD-2`, `CFG-1`, and reachability; it does not use it for source correctness. AX-ENV through AX-NZ are exact versioned Rust authority, not implementation trust. There are no dependencies, unsafe dependencies, tool results, tests, prior audits, or additional assumptions. + +Excluded/residual scope: compiler/backend correctness, binaries, custom/manual rustc cfgs, overridden build scripts, unsupported targets/toolchains, rejected raw selectors, and wasm32/arena artifacts. Re-audit on any source/manifest/policy/TCB change; Rust/Cargo/stdlib version change; target, feature, allocator, profile, environment, or cfg-domain change; or material authoritative-documentation change. + +All in-scope surfaces, raw classes, exits, prefixes, obligations, configuration partitions, mandatory postconditions, TCB consumers, and unresolved regions have dispositions. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/I.md new file mode 100644 index 0000000000..ab56821442 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/I.md @@ -0,0 +1,190 @@ +# Unsafe Rust audit: supplied `ordered-build-target` snapshot + +Audit cutoff: 2026-08-01. This is a source-level Rust 1.85.1/standard-library +1.85.1 audit of the supplied manifest, policies, `TCB.md`, `build.rs`, and +`src/lib.rs`; no backend or binary claim is made. No dependency, generated +file, test, prior audit, or tool result is present or used. + +## Claims and verdicts + +* **Safe-library soundness: UNSOUND.** A supported, well-typed safe call reaches + `NonZeroU8::new_unchecked(0)` (certificate `BAD` below). +* **Documented panic postcondition: UNPROVED**, not `CONTRACT-BROKEN`. It is + proved wherever its antecedent is relevant outside `BAD`; in `BAD`, the only + source execution already has undefined behavior, so it cannot be the required + UB-free postcondition witness. +* **Ordered build interface and exclusion: PROVED relative to the accepted + `BUILD-MAP-ORDERED` premise.** This includes all raw-selector classes, write + failures, partial prefixes, current-build rejection, and the stated + arena-to-arena-stop freshness sequence. + +The combined mandatory result is therefore **UNSOUND / postcondition +UNPROVED**, relative only to `TCB.md`'s accepted, exact Cargo premise and the +Rust axioms quoted below. + +## Exact domain and its recovery + +Let + +* `T={x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`, `B={off,on}`, `A={system,arena}`; +* `P` be every Cargo profile and `D={debug_assertions off,on}`; and +* `U={0,...,255}`, exactly the values of `u8`. + +`SUPPORT.md` literally defines the base product `C0=T×B×A×P×D` and the sole +exclusion `E={c∈C0 | c.target=wasm32-unknown-unknown ∧ c.allocator=arena}`. +Thus the supported library predicate is exactly `C=C0\E`: `C⊆C0\E` follows +from “every other combination ... is supported,” and `C0\E⊆C` follows from +the same exhaustive product statement; the single exclusion proves the reverse +nonmembership. Rust/Cargo are exactly 1.85.1 and the edition is 2021. + +The raw environment partition is the disjoint, exhaustive set +`R={absent, U("system"), U("arena"), U("arena-stop"), U(other), non-U}`. +Here `U(other)` means every other Unicode string. `env::var` “Returns a +`VarError` if the variable is not present, or if it is not valid Unicode” +([Rust 1.85.1 `env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html)); +the two documented error variants and the `Ok(String)` case, followed by +equality with the three literals and `_`, prove both coverage and disjointness. +`String::as_str` “Extracts a string slice containing the entire `String`” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str)). +Accepted fibers are `absent,U("system") -> system` and `U("arena") -> arena`; +the other three are rejection cases, not allocators. Manual `rustc`, invented +cfgs, and build-script overrides are expressly outside `BUILD.md`'s theorem. + +The full required case domain is (i) every build-interface execution over `R`, +the supported target/feature/profile/debug axes, each stdout success/failure +possibility, and reusable prior Cargo-target state, plus (ii) every safe +`lane_id(v)` call for `(c,v)∈C×U` produced by an accepted current build. This +retains inputs, execution/history, and configuration rather than replacing +them by `Required_cfg=C`. + +## Complete ordered build relation + +Write `RERUN` for the complete first line and `CFG(a)` for the allocator line. +Blocks execute operations sequentially and a match chooses the first matching +arm ([block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html), +[match](https://doc.rust-lang.org/1.85.1/reference/expressions/match-expr.html)). +`println!` “Panics if writing to `io::stdout` fails” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics)). +Consequently: + +| Raw class | after successful `RERUN` write | terminal result if later writes succeed | +|---|---|---| +| absent | read `NotPresent`; attempt `CFG(system)` | return success | +| `U("system")` | read `Ok`; attempt `CFG(system)` | return success | +| `U("arena")` | read `Ok`; attempt `CFG(arena)` | return success | +| `U("arena-stop")` | read `Ok`; attempt `CFG(arena)` | explicit panic after that complete line | +| `U(other)` | read `Ok`; no allocator write | explicit unsupported-value panic | +| non-U | read `NotUnicode`; no allocator write | explicit valid-Unicode panic | + +This table lists every successful script path: exactly its first three rows. +Before every row, failure of the first write exits by panic with no complete +line (and possibly a byte-prefix of `RERUN`); the environment read and all later +steps are unreached. In the four rows that attempt `CFG`, failure of that second +write exits by panic after complete prefix `[RERUN]` (and possibly a byte-prefix +of `CFG`); its return or explicit later panic is unreached. The successful +`arena-stop` write produces complete prefix `[RERUN,CFG(arena)]` before its +explicit panic. The other explicit rejections leave complete prefix `[RERUN]`. +These are all stdout calls and all alternative exits in `build.rs`. + +`BUILD-MAP-ORDERED` supplies, for Cargo 1.85.1 and every profile, exactly the +following consumed facts: a complete successful `RERUN` registers changes in +the raw value (including present-to-present); only a successful current script's +complete `CFG(a)` reaches the current library compilation; no prior selector is +retained; any write failure or uncaught explicit panic is unsuccessful; and an +unsuccessful script yields no current library or prior artifact as the current +result. Therefore arbitrary failed-write byte prefixes and every complete +prefix above are inert for source selection. + +**Freshness witness.** For a successful arena build (necessarily x86_64 or +aarch64 once the source exclusion is applied), the first run successfully wrote +`RERUN,CFG(arena)`. In the same target directory, raw `arena -> arena-stop` is a +registered present-to-present change, so Cargo reruns before selection. The new +run either fails at write 1, fails at write 2, or writes both lines and then +panics. Every exhaustive case is unsuccessful and `BUILD-MAP-ORDERED` forbids +both a current compilation and presentation of the earlier arena library. + +**Target exclusion.** A successful raw-arena script gives exactly +`fixture_allocator="arena"`; the accepted TCB maps the wasm triple to +`target_arch="wasm32"`. The `all` predicate on `lib.rs:3` is then true, +regardless of `burst`. A `cfg` attribute includes its item when true and removes +it when false +([Reference 1.85.1](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute)); +`compile_error!` “Causes compilation to fail with the given error message when +encountered” +([std 1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html)). +Thus every wasm/arena current compilation fails; if the script failed earlier, +the TCB already forbids compilation. No later-source fact is used on that exit. +For all other target/allocator pairs this particular `all` is false, so the +error item is absent. This proves exactly `E`, not a wider exclusion. + +## API, invariants, and unsafe obligations + +The complete language-reachable crate API is the safe free function +`lane_id(u8)->NonZeroU8`; there are no public fields, constructors of a local +type, traits/impls, macros, statics, FFI, reexports, callbacks, or dependencies. +Build code contains no unsafe operation. The two unsafe sites are +`lib.rs:21` and `lib.rs:36`. The consumed standard-library contract is exact: +`new_unchecked` “Creates a non-zero without checking whether the value is +non-zero. This results in undefined behavior if the value is zero,” and its +safety clause is “The value must not be zero” +([Rust 1.85.1](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked)). + +Define `H(c) = c.target=aarch64-unknown-linux-gnu ∧ c.burst=on ∧ +c.allocator=arena`. Accepted Cargo mappings and Rust `cfg(all(...))` semantics +make `H` select the first block and remove the `not(all(...))` block; `¬H` does +the reverse. + +* If `H(c)∧v!=0`, line 21 satisfies the exact unsafe precondition and returns + the corresponding nonzero value. +* If `¬H(c)∧v=0`, `if value==0` reaches `panic!` before line 36. If + `¬H(c)∧v!=0`, the false branch itself establishes the proposition needed by + line 36. Thus the second safety comment is adequate and this entire case is + UB-free. Profile, debug-assertion state, and panic strategy cannot alter the + cfg or value partition; abort versus unwind occurs only after the proved + zero-input panic and no invariant is suspended. +* **`BAD`:** choose any profile/debug state, `c=(aarch64,burst on,arena,...)∈C` + and safe input `v=0`. The public safe call is valid; `H(c)` reaches line 21; + its required `v!=0` proposition is false; the quoted contract directly + entails undefined behavior. This is a complete existential UB certificate. + The adjacent claim “Burst-mode lane identifiers are never zero” is false: + the API accepts every `u8` and enforces no such invariant. + +Therefore the **exact maximal sound region** over the requested full product is + +`SOUND = C×U \ { (c,0) | H(c) }`. + +Positive inclusion follows from the first two bullets. Reverse inclusion and +maximality follow because every omitted case satisfies `H∧v=0` and the `BAD` +derivation is parametric in profile/debug state, proving UB for every such +case—not merely one sample. The regions partition `C×U` exhaustively by +`H/¬H` and `v=0/v!=0`. + +The panic postcondition is proved for every zero input in `¬H`: the check +executes `panic!`, which “Panics the current thread” +([1.85.1](https://doc.rust-lang.org/1.85.1/std/macro.panic.html)). It imposes no +claim for nonzero inputs. For `H∧v=0`, UB precedes any panic, leaving the global +postcondition `UNPROVED` and supplying no `CONTRACT-BROKEN` certificate. + +## Finding, TCB log, and residual scope + +**F-1 (critical, UNSOUND; proof comment deficient).** `lib.rs:13-22` hides an +unenforced nonzero precondition behind a safe API. Minimum repair: perform the +zero check before either cfg branch (or use checked `NonZeroU8::new` and panic +on `None`), then replace the first safety comment with the dominating check's +exact `value!=0` derivation. Re-audit all `C×U`, both panic strategies, and the +documented panic after any change. + +**TCB log `supplied-TCB/BUILD-MAP-ORDERED`.** Category `IMPLEMENTATION`, human +disposition accepted; identity Cargo 1.85.1 plus the supplied manifest/build +interface; consumers are only ordered output interpretation, raw-value +freshness, feature/target/cfg reachability, selected source, and rejection. It +does not supply local emission order, source correctness, Rust semantics, +backend, or binary correctness; those were not widened. No other admitted +premise is consumed. Re-audit on any toolchain, source, manifest, policy, +target, cfg, feature, environment-interface, or TCB-disposition change. + +Residual scope: compiler/backend correctness, binaries, manually manufactured +cfgs, unsupported targets/toolchains, and overridden build machinery. Tool +evidence: none. The current global failure is proved rather than inferred from +missing tests. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/J.md new file mode 100644 index 0000000000..bfc973ce24 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/reports/J.md @@ -0,0 +1,199 @@ +# Source-only unsafe-code audit + +## Claim, domain, and verdicts + +Snapshot: the supplied `Cargo.toml`, `BUILD.md`, `SUPPORT.md`, `TCB.md`, +`build.rs`, and `src/lib.rs`; Rust and standard library 1.85.1, edition 2021. +No target was built, run, expanded, or modified. There are no dependencies or +generated source files. The only accepted non-Rust premise is +`BUILD-MAP-ORDERED` in the supplied `TCB.md`. + +Let + +- `T = {x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, + wasm32-unknown-unknown}`; +- `B = {off,on}` for `burst`, `A = {system,arena}`, `P` be every Cargo + profile, `D = {off,on}` for debug assertions, and `U = {0,...,255}`; +- `Q = {1.85.1} × T × B × A × P × D`; and +- `L = Q \ {q | target(q)=wasm32-unknown-unknown ∧ allocator(q)=arena}`. + +`Q` is the literal product in `SUPPORT.md`; the displayed subtraction is its +sole stated exclusion, so both containments establishing this normalization +follow directly from lines 3–16. Required library/API cases are `L × U`. +Profiles, debug assertions, and their panic strategies remain symbolic: no +source predicate or unsafe precondition depends on them. + +**Soundness: UNSOUND** for the complete crate over the required source-level +domain, relative to `BUILD-MAP-ORDERED`. A valid witness is any profile/debug +state with target `aarch64-unknown-linux-gnu`, `burst=on`, allocator `arena`, +and the safe call `lane_id(0)`. This configuration is in `L`. The selected +block at `lib.rs:12–20` executes `NonZeroU8::new_unchecked(0)`. Its safety +condition is false and its exact 1.85.1 contract says this is undefined +behavior (AX-5 below). This completes the existential certificate. + +**Documented postcondition: UNPROVED** globally. `lib.rs:8–10` promises that +`lane_id` “Panics when `value` is zero.” This is proved regionally whenever +`C(q) := burst(on) ∧ target=aarch64-unknown-linux-gnu ∧ allocator=arena` is +false: zero enters `lib.rs:28–30` and panics before unsafe code. In the `C` +region, zero instead reaches UB. That refutes soundness but cannot be a +`CONTRACT-BROKEN` witness because the execution is not UB-free as a whole; no +independent UB-free refutation is established. + +### Exact maximal sound region + +The exact maximal sound subset of the full supported configuration/input +domain is + +`M = {(q,v) ∈ L × U | ¬(C(q) ∧ v=0)}`. + +Proof of inclusion: if `C` is true and `v≠0`, `lib.rs:12–20` supplies the exact +nonzero precondition to `new_unchecked`. If `C` is false, the complementary +block at lines 22–33 is selected. For `v=0` it panics before the unsafe call; +for `v≠0`, falling through the check establishes the unsafe precondition. +These are the crate's only unsafe operations. Proof of maximality: the +complement of `M` inside `L×U` is exactly every profile/debug fiber satisfying +`C ∧ v=0`; the witness derivation above applies parametrically to every such +fiber. Thus every complement member is unsound and no strict superset within +`L×U` is sound. + +## Ordered build-to-source relation + +Write `R`, `S`, and `A` for the complete newline-terminated lines +`cargo::rerun-if-env-changed=FIXTURE_ALLOCATOR`, +`cargo::rustc-cfg=fixture_allocator="system"`, and +`cargo::rustc-cfg=fixture_allocator="arena"`. A failing `println!` panics at +that point. The supplied premises do not constrain bytes partially written by +the failing call; below, “prefix” means the exact earlier successfully written +complete directive-line prefix. This byte-level remainder is immaterial because +`BUILD-MAP-ORDERED` forbids a current library compilation after every +unsuccessful exit. + +1. `build.rs:4` first attempts `R`. Failure exits by panic, with complete-line + prefix `[]`; the environment read and all later operations are unreached. + Success leaves prefix `[R]` and reaches `env::var`. +2. The literal key has neither `=` nor NUL. Rust's documented result therefore + partitions raw values into omitted → `Err(NotPresent)`, Unicode `s` → + `Ok(String(s))`, and non-Unicode → `Err(NotUnicode(_))`. `Result` and + `VarError` each have exactly the variants matched at lines 6–25. `as_str` + exposes the entire Unicode string; literal patterns match exactly and `_` + matches every remainder. +3. Omitted and Unicode `system` each attempt `S`; Unicode `arena` attempts + `A`. Failure of that second write exits at the `println!`, with prefix + `[R]` (plus unconstrained failed-call bytes). Success leaves respectively + `[R,S]` or `[R,A]`, then the function returns successfully. These are all + successful paths, and each attempts exactly one allocator directive. +4. Unicode `arena-stop` attempts `A`. A write failure exits with prefix `[R]` + and never reaches its explicit panic. A successful write leaves `[R,A]`, + then line 19 explicitly panics. Unicode values other than the three named + literals panic at line 21 with prefix `[R]` and never attempt an allocator + line. Non-Unicode values do likewise at line 24. Together with first-write + failure, these are every explicit/infrastructure rejection and every + material exit. +5. Only the two successful prefixes are consumed downstream. By + `BUILD-MAP-ORDERED`, successful `[R,S]` passes exactly + `fixture_allocator="system"`; successful `[R,A]` passes exactly + `fixture_allocator="arena"`. Every failed path produces no current library, + irrespective of complete or partial stdout already emitted. No later Cargo + cfg interpretation or library source selection is attributed to an earlier + exit. + +Freshness is closed, including the required sequence. A successful `arena` +build wrote `[R,A]`, so Cargo recorded the raw-variable invalidation rule. +Changing the same target directory's raw value to `arena-stop` is a +present-to-present change; `BUILD-MAP-ORDERED` makes the old selection stale +and reruns the script before current source selection. That run necessarily +ends at the first-write failure, second-write failure, or explicit panic. +The accepted premise says every such outcome compiles no current library and +does not present the prior arena library as the current result. + +For a successful current script, the same premise maps `burst` and the three +target triples to their exact cfg leaves. Rust cfg semantics then make +`all(target_arch="wasm32", fixture_allocator="arena")` true exactly for the +stated excluded pair, independent of `burst`, profile, and debug assertions. +The encountered `compile_error!` at `lib.rs:3–4` rejects compilation. Conversely +that predicate is false for every member of `L`, so this error is absent. The +project's target/allocator exclusion is therefore **PROVED effectively +enforced**, and no excluded current library is produced. + +## Boundary, invariant, and obligation coverage + +The build-script entrypoint is safe Rust. The sole downstream public surface +is safe free function `lane_id(u8) -> NonZeroU8`; there are no public fields, +constructors beyond that function, user-implementable traits, exports, FFI, +statics, or generated/hidden APIs. The two cfg alternatives contain the only +unsafe calls (`lib.rs:19,32`). Invariant `NZ(value): value≠0` must hold at each +call. Lines 28–31 establish it on the ordinary path. The comment at line 18 +merely asserts it on the burst path, but a safe `u8` parameter admits zero and +no producer, type, check, or accepted TCB entry establishes `NZ` there. + +Obligation dispositions: + +- build raw-value partition, operation order, successful outputs, failures, + freshness, and Cargo interpretation: PROVED relative to `BUILD-MAP-ORDERED`; +- wasm/arena rejection and complementary source selection: PROVED; +- ordinary-path unsafe precondition and zero panic: PROVED; +- burst/aarch64/arena unsafe precondition: UNSOUND at zero, PROVED for nonzero; +- global documented zero-panic guarantee: UNPROVED, region as stated above. + +## Rust authority and TCB log + +All quotations and links are version 1.85.1 and apply to this exact toolchain. + +- **AX-1 (environment/result).** [`env::var`](https://doc.rust-lang.org/1.85.1/std/env/fn.var.html): + “Returns `VarError::NotPresent`” when unset and “Returns + `VarError::NotUnicode` if the variable’s value is not valid Unicode.” + [`VarError`](https://doc.rust-lang.org/1.85.1/std/env/enum.VarError.html) is + `NotPresent | NotUnicode(OsString)`; [`Result`](https://doc.rust-lang.org/1.85.1/std/result/enum.Result.html) + is `Ok(T) | Err(E)`. Consumers: build partition. +- **AX-2 (patterns/order).** [`String::as_str`](https://doc.rust-lang.org/1.85.1/std/string/struct.String.html#method.as_str) + “Extracts a string slice containing the entire `String`.” + [Literal patterns](https://doc.rust-lang.org/1.85.1/reference/patterns.html#literal-patterns) + “match exactly the same value as what is created by the literal”; the + [wildcard](https://doc.rust-lang.org/1.85.1/reference/patterns.html#wildcard-pattern) + “matches any value.” A [block](https://doc.rust-lang.org/1.85.1/reference/expressions/block-expr.html) + “sequentially executes its component non-item declaration statements and + then its final optional expression.” Consumers: exhaustive ordered relation. +- **AX-3 (panic/output).** [`println!`](https://doc.rust-lang.org/1.85.1/std/macro.println.html) + “Prints to the standard output, with a newline” and [“Panics if writing to + `io::stdout` fails.”](https://doc.rust-lang.org/1.85.1/std/macro.println.html#panics) + [`panic!`](https://doc.rust-lang.org/1.85.1/std/macro.panic.html) “Panics the + current thread.” Consumers: build exits and zero postcondition. +- **AX-4 (selection/rejection).** The [cfg attribute](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#the-cfg-attribute) + “conditionally includes the thing it is attached to based on a configuration + predicate”; [`all` and `not`](https://doc.rust-lang.org/1.85.1/reference/conditional-compilation.html#conditional-compilation) + mean respectively all predicates true and the predicate false. + [`compile_error!`](https://doc.rust-lang.org/1.85.1/std/macro.compile_error.html) + “causes compilation to fail with the given error message when encountered.” + Consumers: exclusion and the complementary lane blocks. +- **AX-5 (integer/unsafe contract).** [`u8`](https://doc.rust-lang.org/1.85.1/std/primitive.u8.html) + is “The 8-bit unsigned integer type,” with `MIN=0` and `MAX=255`. + [`NonZero::new_unchecked`](https://doc.rust-lang.org/1.85.1/std/num/struct.NonZero.html#method.new_unchecked): + “The value must not be zero” and zero “results in undefined behavior.” + Consumers: `NZ`, witness, and maximal region. + +**BUILD-MAP-ORDERED (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exact Cargo +1.85.1 proposition in `TCB.md:8–39`, consumed only for rerun/freshness, +process-status handling, exact current allocator cfg, feature/target cfg, source +selection, and lack of a current/stale artifact after failure. It is not widened +to Rust semantics or source correctness. No other additional premise or tool +evidence is consumed. + +## Findings and remediation + +**F-1 — UNSOUND safe API.** `lib.rs:18` reverses an unsupported assertion into +the precondition of `new_unchecked`; callers control the safe `u8`. Minimal +repair: perform the zero check on every cfg path (prefer +`NonZeroU8::new(value).expect(...)`) and remove the invalid comment, or change +the API to accept `NonZeroU8` if contract compatibility permits. Re-audit the +new snapshot and its panic behavior. + +**F-2 — deficient proof artifact/postcondition.** The line-18 SAFETY comment +does not identify an enforcing fact and the implementation cannot establish the +documented zero panic in that region without first avoiding UB. Repair F-1 and +use adjacent proof text: “`value == 0` panicked above; reaching this call proves +`value != 0`, satisfying `new_unchecked`.” Changing the safe API or panic +contract requires compatibility review. + +Residual scope is source-level Rust only; compiler backend, binaries, and +deployment are not claimed. Re-audit on any source, policy, Cargo/Rust, +target/feature/allocator, cfg, TCB-disposition, or authoritative-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/B/s2/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/PACKET.json new file mode 100644 index 0000000000..e6ee69b1e3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "afe540a0e03212b0d8554a6a522d2a5695a0eaadf07126c410ef831a563b9623", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "L", + "presentation_order": [ + "F", + "J", + "I", + "B", + "E", + "H", + "C", + "G", + "D", + "A" + ], + "report_sha256": { + "A": "d74c89e74f1a4cc352183cea151c4ac387fea502d6c9a88e8ee7c1b63612fce8", + "B": "da0d4553898b5177722b6739562ef75fa4d6baf228dd1818f8f7e39e42167356", + "C": "141d0ee3549279a6d90aab62c89bc12d0f85a994bbfcdc4c5d29102001a1cc67", + "D": "1eb7ccc5e3184fe8e43a576150a25f498bf6f1e514486fde15ece31fd660e3e6", + "E": "ce572d45451eaf768a3731e7a09f92a21d813c1b3fe1940260b4eb70a58b933d", + "F": "593b40969c0e46fab20eaa7be52d261dbc21dc0091a4e0c981acf53e6b8f21a9", + "G": "9710335249669b879feff80e14868026cb6161579aefe7fb97213aa0af27872f", + "H": "48b4903ce42d924f6c1f532d6685a79209756520980218163e5ca6aaebd1040e", + "I": "36f4b173f16b9fbeaeed4b9cf467e501d0c986eb4c8ebd3654467e6a5c27a434", + "J": "9ee2c47518f8d65a91c84a208bdec4050c516fe6ea1c6dcf6da45299451f9bed" + }, + "rubric_sha256": "4da5564ee971cdb7d8584c60c62b87a0c377efbe1a69b60576f22364b412b02a", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s1", + "target_byte_tree_sha256": "cc05da115d055febc313edcdf18bae59a6230a63583bf918ad29e89eb06a4266" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/RUBRIC.md new file mode 100644 index 0000000000..e16d3af5a3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/RUBRIC.md @@ -0,0 +1,146 @@ +# Mode L Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file, its atom labels, expected +> result, or hard-error rules to an evaluated report agent. + +## Exact result + +Within the scope in `REQUEST.md`, `last` is sound. On the `else` branch, +`bytes.is_empty()` evaluated to false. The documented relation between +`is_empty` and slice length therefore gives `bytes.len() != 0`. Slice length has +type `usize`, whose values are nonnegative, so `bytes.len() > 0`. Consequently +`bytes.len() - 1` neither underflows nor overflows and mathematical subtraction +gives `index < bytes.len()`. This is precisely the in-bounds fact required by +`get_unchecked` for a `usize` index. + +The existing comment states only a lifetime fact. It does not address the +unsafe callee's in-bounds obligation, the facts which establish it, or the +derivation between them. It is therefore a deficient proof artifact even though +the implementation obligation can be reconstructed. A replacement must expose +that chain locally and must link or unambiguously refer to the checked, +version-matched authority entries it consumes. + +## Atoms + +- **L1 — Callee obligation:** State that the executed `get_unchecked(index)` + requires `index` to be in bounds, equivalently `index < bytes.len()` for this + `usize` index, and that an out-of-bounds call is UB. + - `scope_basis`: `lib.rs` contains this unsafe call and `REQUEST.md` asks for + an implementation soundness audit. + - `dependencies`: none. +- **L2 — Branch fact:** Establish from the actual `if`/`else` control flow that + `bytes.is_empty()` is false on the unsafe-call path, then use the exact + `is_empty` contract to conclude `bytes.len() != 0`. + - `scope_basis`: necessary source-path premise for the requested local proof. + - `dependencies`: none. +- **L3 — Unsigned-domain step:** Establish that the slice length is a `usize` + and, using its nonnegative value domain, derive `bytes.len() > 0` from L2. + - `scope_basis`: necessary material bridge from nonemptiness to safe + subtraction in every supported pointer width. + - `dependencies`: L2. +- **L4 — Defined subtraction:** Establish that `bytes.len() - 1` has no integer + overflow or underflow on this path, including in every ordinary profile. + - `scope_basis`: the source performs built-in integer subtraction before the + unsafe call; its definedness is part of the requested soundness proof. + - `dependencies`: L3. +- **L5 — In-bounds derivation:** Use the assignment + `index = bytes.len() - 1` and ordinary integer arithmetic to derive + `index < bytes.len()`. + - `scope_basis`: the exact proposition needed to discharge L1. + - `dependencies`: L3, L4. +- **L6 — Implementation closure:** Connect L2–L5 to L1 and report the + implementation obligation `PROVED` over the entire stated Rust/target/profile + scope; do not infer implementation failure from comment failure. + - `scope_basis`: `REQUEST.md` explicitly asks for an implementation verdict + over its full scope. + - `dependencies`: L1, L2, L3, L4, L5. +- **L7 — Artifact verdict:** Separately report the existing `SAFETY` comment + materially deficient because its lifetime statement does not address either + the exact in-bounds obligation or the material derivation which discharges + that obligation. + - `scope_basis`: `REQUEST.md` explicitly asks for a separate comment-adequacy + determination. + - `dependencies`: L1, L2, L3, L4, L5. +- **L8 — Replacement proof artifact:** Supply proposed adjacent comment text + which identifies the `get_unchecked` obligation and exposes the L2–L5 chain, + with unambiguous references to the checked authority propositions. + - `scope_basis`: `REQUEST.md` explicitly requests replacement wording when + material reconstruction is needed. + - `dependencies`: L1, L2, L3, L4, L5. +- **L9 — Complete premise inventory:** Inventory every materially consumed + Rust/std premise: `if` branch selection, `is_empty`/length equivalence, + `len`'s type/meaning, `usize`'s value domain, built-in + subtraction/overflow, and `get_unchecked`'s safety contract. Classify the + immediate placement and assignment observations as source facts and the + remaining integer implications as mathematics rather than inventing + authority for them. + - `scope_basis`: `REQUEST.md` explicitly requires a complete Rust-premise + inventory and reconciliation; distinguishing source facts and mathematics + identifies which proof leaves require Rust/std authority. + - `dependencies`: L1, L2, L3, L4, L5. +- **L10 — Exact checked authority:** For every Rust/std entry in L9, give the + matching Rust 1.82.0 narrow URL, quote the exact prose which supplies the + premise, state the verified proposition, and qualify its applicability. Page + identity or an unexamined citation alone does not pass. + - `scope_basis`: `REQUEST.md` explicitly requires version-matched checked + authority and exact extracted propositions. + - `dependencies`: L9. +- **L11 — Reconciliation:** Explicitly reconcile proof to inventory: every + materially consumed Rust/std premise has an L10 entry, every listed entry is + actually consumed, and no TCB assumption or uncited Rust fact silently fills + a link. + - `scope_basis`: `REQUEST.md` explicitly requires this reconciliation and + states that the TCB is empty. + - `dependencies`: L1, L2, L3, L4, L5, L9, L10. + +Score atoms independently. Mathematical implications between stated integer +facts need derivation but no Rust citation. Immediate source syntax may be cited +by source location rather than external authority. + +## Hard errors + +- **LH1:** Report the implementation `UNSOUND` or `UNPROVED` solely because the + existing comment is deficient, despite reconstructing L1–L5 correctly. +- **LH2:** Explicitly call the existing comment adequate. +- **LH3:** Claim the requested implementation proof complete while omitting a + material link from L1–L5. +- **LH4:** Claim the requested authority/premise reconciliation complete while + silently consuming a Rust/std premise, using an inapplicable version, or + treating a page URL as proof without checking the proposition. +- **LH5:** Use build, test, execution, lint, or dynamic-analysis success as a + universal proof of this obligation. + +An omitted artifact verdict fails L7 but is not independently a hard error +unless the report also makes an affirmative false claim covered above. + +## Checked authority + +- Rust 1.82.0 slice `get_unchecked`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked` + — for a `usize` element index, an out-of-bounds call is UB even when the + result is unused; the proof consumes the corresponding `index < len` + requirement. +- Rust 1.82.0 slice `len`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len` + — returns the number of elements as `usize`. +- Rust 1.82.0 slice `is_empty`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty` + — returns true exactly when the slice has length zero. +- Rust 1.82.0 Reference, `if` expressions: + `https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions` + — when the condition evaluates to false, the consequent block is skipped and + the trailing `else` block is executed. +- Rust 1.82.0 Reference, arithmetic operators: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators` + — `-` is built-in subtraction for integer operands. +- Rust 1.82.0 Reference, integer overflow: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow` + — identifies overflow for built-in integer operators and its profile/context + behavior; L3 proves the exceptional case absent here. +- Rust 1.82.0 Reference, unsigned integer value domains: + `https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types` + — `usize` is an unsigned integer type and its values are nonnegative. + +There is no accepted TCB entry for this mode. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/allowlist.txt new file mode 100644 index 0000000000..7c3ef37288 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/allowlist.txt @@ -0,0 +1,7 @@ +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty +https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow +https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/A.md new file mode 100644 index 0000000000..4182eed1cf --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/A.md @@ -0,0 +1,81 @@ +# Audit of `last` + +## Claim, snapshot, and verdict + +**Soundness verdict: PROVED.** For the exact `lib.rs` supplied with this review, under Rust and standard library 1.82.0, every well-typed safe call to `last` on every target where this source and the used 1.82.0 slice APIs exist, in every ordinary profile, is free of Rust undefined behavior. The caller has no extra safety obligation. `Required(case)` is exactly that predicate over source identity, toolchain/stdlib, target, profile, input slice, and permitted execution. `Required_cfg(c)` is `Rust/std = 1.82.0 ∧ target has the used items ∧ profile ∈ Ordinary`. Audit cutoff: this supplied snapshot, reviewed 2026-08-01. + +The only public/safe surface is `pub fn last(bytes: &[u8]) -> Option<&u8>` (`lib.rs:3-11`). Its only unsafe consumer is `bytes.get_unchecked(index)` at line 10. There are no unsafe declarations, fields, traits/impls, callbacks, macros, hidden APIs, dependencies, FFI, generated artifacts, `cfg` branches, or invariant-bearing state. `#![allow(dead_code)]` does not select or alter code. No documented postcondition or separately requested robustness property exists; the function name is not treated as normative documentation. + +**Proof-artifact verdict: DEFICIENT.** The existing `SAFETY` comment says only that the returned reference cannot outlive `bytes`. That does not establish the actual `get_unchecked` obligation—an in-bounds index—and therefore is not an adequate local proof. The missing derivation is material and is reconstructed below. This is a documentation defect, not an implementation defect. + +TCB log `TCB-LAST-1` consists only of the Rust 1.82.0 authoritative axioms A1-A5 below. There are no additional TCB assumptions, selected dependencies, tools, tests, or implementation/platform premises. This is a source-level result relative to documented Rust abstract semantics, not a compiler-backend or binary certificate. + +## Complete premise inventory + +Each semantic/std premise consumed by the derivation appears here; the remaining steps are inspected source facts or arithmetic/logic. + +**A1 — slice length.** Rust 1.82.0 [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len), signature `pub const fn len(&self) -> usize`: + +> “Returns the number of elements in the slice.” + +Verified proposition: for the input slice, `bytes.len()` is a `usize` equal to its number of elements; call that value `n`. + +**A2 — emptiness observation.** Rust 1.82.0 [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + +> “Returns `true` if the slice has a length of 0.” + +Verified proposition used: `n = 0 ⇒ bytes.is_empty() = true`; hence, by contraposition, `bytes.is_empty() = false ⇒ n ≠ 0`. + +**A3 — branch execution.** Rust 1.82.0 [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + +> “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped. If a condition operand evaluates to `false`, the consequent block is skipped … If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” + +Verified proposition: the unsafe call is reachable only when `bytes.is_empty()` evaluated to false; when it evaluates true, only `None` is evaluated. + +**A4 — `usize` range and subtraction.** Rust 1.82.0 [integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types) states, under “The unsigned integer types consist of,” the table row: + +> `usize` | minimum `0` | maximum `2^w − 1` + +Rust 1.82.0 [binary-operator table](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators) gives the integer meaning of `-` as: + +> “Subtraction” + +and [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow) defines an overflow case as: + +> “When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored.” + +Verified proposition: a nonzero `usize` value `n` lies in `[1, 2^w−1]`; its integer subtraction `n−1` lies in `[0, 2^w−2]`, so `n - 1` does not overflow under any target width or overflow-check/profile setting, and its value is strictly less than `n`. + +**A5 — unsafe operation contract and result.** Rust 1.82.0 [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + +> “Returns a reference to an element or subslice, without doing bounds checking.” + +> “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” + +The same safety section expressly gives `.get_unchecked(len)` as UB. Verified proposition: the caller must supply an in-bounds index; for a `usize` element index of a slice of length `n`, `0 ≤ index < n` discharges that condition, and the result is a reference to that indexed element. + +## Obligation ledger and reconstructed derivation + +**O1, reachability and arithmetic — PROVED over all `Required`.** Let `n = bytes.len()` (A1). A3 says reaching the `else` and unsafe call means the condition was false. A2 then yields `n ≠ 0`. By A4, `n ≥ 1`, `index = n - 1` is evaluated without overflow in every profile, and `0 ≤ index < n`. + +**O2, `get_unchecked` precondition — PROVED over all `Required`.** O1 establishes exactly that `index` is in the slice's bounds. This discharges A5's sole safety condition. A5 supplies a shared reference to element `n-1`; no code, callback, mutation, or unwind point intervenes between computing `index` and the call. + +**O3, other input/control-flow case — PROVED over all `Required`.** If the condition is true, A3 skips the `else`, so no unsafe operation executes and the function evaluates `None`. If false, O1-O2 apply. Boolean truth/falsity exhausts executions, so their union covers every input/execution. + +For each obligation, the derivation is symbolic in target width `w` and profile. Every required configuration selects identical source, and A1-A5 contain no narrower target/profile qualification. Thus each obligation's covered predicate contains `Required`; pointwise intersection across O1-O3 still contains `Required`. This proves `Required ⊆ Covered` and certifies the verdict. Empty, one-element, and maximum-representable-length boundaries respectively take O3, produce index `0`, and produce `n-1` without overflow; none falsifies the proof. + +## Required replacement comment + +```rust +// SAFETY: Reaching this branch means `bytes.is_empty()` was false, so the +// slice length is nonzero. Therefore `index = bytes.len() - 1` does not +// overflow and satisfies `index < bytes.len()`, making it in bounds as +// required by `slice::get_unchecked`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +This is the minimum acceptable repair: it names the callee obligation, the dominating branch fact, the arithmetic derivation, and the conclusion. The old lifetime sentence may be omitted because it does not discharge an unsafe precondition. + +## Residual scope and review triggers + +Nothing within the requested source-level domain remains uncovered. No target was built or executed, as required. Re-audit if the function, comment, signature, slice APIs/contracts, Rust/stdlib version, target-availability predicate, or profile scope changes. Compiler code generation, custom backend correctness, binaries, and behavior beyond any documented postcondition are outside this source review. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/B.md new file mode 100644 index 0000000000..48a8fee2d5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/B.md @@ -0,0 +1,65 @@ +# `last` source review + +## Claim and verdict + +**Implementation soundness: PROVED.** For the exact `target/lib.rs` supplied, every well-typed safe call to `last` is free of Rust undefined behavior under Rust 1.82.0 documented abstract semantics, on every target where this source and the used Rust 1.82.0 standard-library items exist, in every ordinary profile. There is no caller safety precondition and no additional TCB assumption. + +**Existing `SAFETY` comment: deficient.** It discusses the result's lifetime, but `get_unchecked`'s material safety obligation is that the index not be out of bounds. The comment gives none of the branch-and-arithmetic derivation needed to establish that obligation. The missing derivation can be reconstructed, so this is a proof-artifact defect, not an implementation defect. + +There are no documented postconditions on `last` and no additional robustness claim in the request; consequently no separate postcondition verdict is required. + +## Snapshot, boundary, and domain closure + +Scope is exactly `target/lib.rs`, lines 1–11. The sole language-reachable API surface is safe public free function `last(bytes: &[u8]) -> Option<&u8>`. Its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors for an invariant-bearing type, traits or impls, callbacks, macros, generated code, dependencies, `cfg`s, FFI, concurrency, allocation, or other unsafe sites. The only transient invariant is `INV-N`: in the `else` branch, for the unchanged receiver `bytes`, `n = bytes.len() > 0`. + +The request directly defines + +`Required = {exact source} × {Rust/std 1.82.0} × {targets on which the source and used items exist} × {ordinary profiles}`. + +No normalization, exclusion, or finite target inventory is used. The proof below is parametric in the target-dependent `usize` value `n`; it assumes no pointer width. Profile-dependent overflow handling is immaterial because the subtraction is proved not to overflow. The source contains no configuration selection. Thus every premise applies throughout `Required`, `Covered = Required`, and `Required ⊆ Covered`. + +No build, test, execution, expansion, or tool-derived evidence was used. This is a source-level result, not a claim about a particular compiler binary or backend. + +## Obligation ledger and reconstructed proof + +`OBL-1` (line 7, all of `Required`): prove `bytes.len() - 1` does not underflow or panic and produces `index = n - 1`. **PROVED.** + +`OBL-2` (line 9, all of `Required`): prove `index` is not out of bounds for the same `bytes` passed to `get_unchecked`. **PROVED.** + +Derivation: + +1. Let `q` be the boolean returned by `bytes.is_empty()` at line 4. Execution reaches the `else` block only when `q = false` (AX-IF). +2. AX-EMPTY says `bytes.len() = 0 -> q = true`; by contraposition, `q = false -> bytes.len() != 0`. Both observations concern the same shared slice value, with no intervening mutation, call, callback, or state transition. Set `n = bytes.len()` at line 7, so `n != 0`. +3. `len` returns a `usize` and counts elements (AX-LEN). `usize` is unsigned (AX-USIZE), hence `n != 0` gives `n >= 1`. +4. Binary `-` on these primitive integer operands is subtraction (AX-SUB). Therefore line 7 computes `n - 1`. Since `n >= 1`, the result is nonnegative and no greater than the already representable `n`; it is representable as `usize`. It is not less than the type minimum, so AX-OVERFLOW's underflow case cannot occur under any ordinary overflow-check setting. Thus `index = n - 1` and `0 <= index < n`. +5. `n` is the number of elements of this same `bytes`, so `index` is in bounds. This discharges the sole documented `get_unchecked` safety requirement (AX-GET). The standard-library contract then supplies the returned shared reference. No later unsafe consumer exists. + +The empty case never evaluates the `else` block, subtraction, or unsafe call. Hence `OBL-1` and `OBL-2` cover all reachable unsafe executions, and the implementation certificate is complete. + +## Complete authoritative-premise inventory + +All entries are Rust 1.82.0 axioms, apply on every target/profile in `Required`, and were verified on the linked versioned page. Quotations are the exact minimal prose fragments consumed. + +- **AX-EMPTY** — [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “Returns `true` if … length of 0.” Verified proposition: zero length implies the returned boolean is true. Used in step 2. +- **AX-LEN** — [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “Returns the number of elements”. Together with the displayed return type `usize`, verified proposition: `bytes.len()` is the element count represented as `usize`. Used in steps 2–5. +- **AX-IF** — [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this single-condition `else` runs only for a false condition. Used in step 1 and to exclude unsafe evaluation on the empty branch. +- **AX-USIZE** — [numeric integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The `usize` type is an unsigned integer type”. Verified proposition: `usize` values are nonnegative target-width integers. Used in steps 3–4. +- **AX-SUB** — [arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): the primitive-integer `-` entry is “Subtraction”. Verified proposition: line 7 performs integer subtraction. Used in step 4. +- **AX-OVERFLOW** — [overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): binary subtraction overflows when it creates a value “less than the minimum value that can be stored”. Verified proposition: unsigned subtraction underflow is overflow; because the mathematical result is representable here, profile-controlled overflow behavior is unreachable. Used in step 4 and configuration closure. +- **AX-GET** — [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “Returns a reference to an element or subslice”; “out-of-bounds index is undefined behavior”. Verified proposition: the operation supplies an element reference without bounds checking, and its unsafe-call obligation is that the numeric index be in bounds. Used in step 5. + +No other Rust semantic or standard-library proposition is materially consumed. In particular, the existing comment's lifetime assertion is not a precondition of `get_unchecked` and plays no role in the derivation. Every inventoried entry has a consumer above, and every nonlocal premise used above appears in this inventory. The TCB contains these authoritative Rust/std axioms only; there are no dependency, implementation, external-specification, deployment, tool, or out-of-band assumptions. + +## Finding and replacement comment + +**DOC-1 — inadequate local proof (implementation remains PROVED).** The current comment does not identify `get_unchecked`'s bounds obligation, the dominating false `is_empty` branch, the non-underflowing subtraction, or the conclusion `index < bytes.len()`. Replace it with: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() > 0`. Thus subtracting 1 cannot underflow and produces +// `index < bytes.len()` for this same slice, so `index` is in bounds as +// required by `get_unchecked`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +This repair changes proof documentation only; it neither adds a caller obligation nor changes behavior. Re-audit if the source, function contract, support domain, Rust/std version, cited contracts, or overflow/index computation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/C.md new file mode 100644 index 0000000000..70e6c68c71 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/C.md @@ -0,0 +1,64 @@ +# Unsafe Rust review: `last` + +## Claim and verdict + +**Implementation soundness: PROVED.** For the exact `lib.rs`, every well-typed safe call to `last` is free of Rust undefined behavior under Rust and standard library 1.82.0 abstract semantics, on every target where this source and the used standard-library items exist, in every ordinary profile. This result is relative only to `TCB-R182-v1` below; there are no additional TCB assumptions. + +**Existing proof artifact: DEFICIENT.** The `SAFETY` comment does not establish the actual `get_unchecked` precondition. A material bounds-and-arithmetic derivation had to be reconstructed below. This is a documentation finding, not an implementation defect. + +No caller-facing postcondition is documented in the source. The derivation nevertheless establishes the implementation behavior: an empty slice produces `None`; a nonempty slice of length `L` produces `Some` referencing element `L - 1`. + +## Snapshot, boundary, and domain + +The reviewed artifact is the complete supplied `lib.rs`; no generated artifact, dependency, build script, macro-generated API, FFI, allocator, concurrency mechanism, target feature, or conditional source exists in scope. The only external safe surface is `pub fn last(bytes: &[u8]) -> Option<&u8>`. Its only unsafe obligation site is `bytes.get_unchecked(index)` at `lib.rs:10`. There is no representation invariant or unsafe public contract. + +Let `Required(c)` mean: `c` uses this exact source, Rust/stdlib 1.82.0, an eligible target, an ordinary profile, any valid `&[u8]` (all contents, lengths, and lifetimes), and any permitted execution. Its configuration projection is + +`Required_cfg = { (Rust 1.82.0, eligible target, ordinary profile) }`, + +where “eligible” and “ordinary” retain the request's symbolic predicates. This is an identity normalization of the controlling request: each direction follows by the same conjuncts; no target/profile is enumerated or excluded by the audit. + +## Rust 1.82 authority inventory (`TCB-R182-v1`) + +Each entry applies to all `Required` cases and is consumed below. Quotations are from the exact versioned page. + +- **AX-IF.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped.” Also: “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: with this single condition, the unsafe-containing `else` is reached only for a false condition. + +- **AX-EMPTY.** [`is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “Returns true if the slice has a length of 0.” Verified proposition: length zero implies `is_empty()` is true; contrapositively, a false result implies nonzero length. + +- **AX-LEN.** [`len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “Returns the number of elements in the slice.” Its displayed signature returns `usize`. Verified proposition: `bytes.len()` is the element count `L`, represented as `usize`. + +- **AX-USIZE.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): the unsigned-integer table gives the `usize` row as minimum `0` and maximum `2^ptr_size − 1`. Verified proposition: every `usize`, hence `L`, lies in that inclusive range. + +- **AX-SUB.** [Arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): the operator table identifies “`-` Subtraction.” Verified proposition: binary `-` computes subtraction subject to the documented overflow rules. + +- **AX-OVERFLOW.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): “The following things are considered to be overflow: When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored.” Verified proposition: `L - 1` does not overflow when its mathematical result remains in the `usize` range; profile-dependent overflow handling is then irrelevant. + +- **AX-GET.** [`get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “Returns a reference to an element or subslice, without doing bounds checking.” Safety: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” Verified proposition: the caller must supply an in-bounds index; for a permitted call with `usize`, the result is the referenced element under the displayed shared-reference signature. + +These are authoritative Rust axioms, not added environmental or implementation assumptions. There are no safe/unsafe dependencies, external specifications, tool results, compiler-backend claims, or pending TCB entries. + +## Reconstructed proof and obligation ledger + +Let `L` be the element count returned by `bytes.len()` (AX-LEN). Both method calls inspect the same unchanged local slice value; there is no reassignment, callback, or intervening transition. + +1. If `bytes.is_empty()` is true, AX-IF selects the consequent, which returns `None`; the unsafe operation is not reached. +2. If the unsafe operation is reached, AX-IF says the condition was false. AX-EMPTY's `L = 0 -> true` gives, by contraposition, `L != 0`. +3. AX-USIZE gives `L >= 0`; together with `L != 0`, this gives `1 <= L`. Therefore the mathematical result `L - 1` lies in `[0, L)` and also in the `usize` range. +4. AX-SUB and AX-OVERFLOW therefore establish that `index = bytes.len() - 1` is exactly that mathematical result without underflow in every ordinary profile. Hence `index < bytes.len()`. +5. Thus `index` is in bounds, discharging AX-GET's sole documented safety requirement. AX-GET returns the element reference, and safe `Some` construction returns it. No raw reference is constructed or lifetime extended by this function; the local and standard-library signatures carry the shared borrow. + +The two boolean cases are exhaustive. The proof is parametric in slice contents, lifetime, `usize` width, eligible target, and ordinary profile. There is no `cfg` or generated/source-selection stage, and the one profile-sensitive arithmetic operation cannot overflow. Consequently every `Required` case is covered: `Covered = Required`, which certifies `Required ⊆ Covered`. + +## Finding DOC-1: inadequate adjacent proof + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not mention `index`, bounds, nonemptiness, or subtraction. Even if its lifetime statement is true, it does not entail the actual AX-GET precondition. Replace it with: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// Thus `bytes.len() != 0`, so `index = bytes.len() - 1` is representable +// and satisfies `index < bytes.len()`. Therefore `index` is in bounds, +// as required by `get_unchecked`. +``` + +Minimum resolution is this proof-artifact change; the implementation need not change. Re-audit if the function/control flow, used Rust contracts, Rust version, support predicate, or arithmetic/indexing operation changes. Binary/compiler correctness and behavior not documented by this source remain outside this source-level review. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/D.md new file mode 100644 index 0000000000..5828e73a5a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/D.md @@ -0,0 +1,134 @@ +# Source review: `last` + +## Claim and verdicts + +Snapshot: the complete supplied `target/lib.rs`, specifically safe public function +`last` at lines 3–10 and its sole unsafe operation at line 9. Review date/cutoff: +2026-08-01. No generated code, dependencies, build scripts, FFI, macros, traits, +mutable state, or prior audit are present in the supplied artifact. + +**Soundness — PROVED.** For Rust 1.82.0, every well-typed safe call +`last(bytes)` on every target where this source and the cited Rust 1.82.0 slice +APIs exist, in every ordinary profile, is free of Rust undefined behavior. This +is a source-level result under documented Rust abstract semantics. + +**Existing `SAFETY` comment — deficient.** It states a return-lifetime fact but +does not state or prove the only material caller obligation of the unsafe call: +that `index` is in bounds. The missing bounds derivation is material and is +reconstructed below. This documentation defect does not change the separately +proved implementation verdict. + +There is no documented caller-facing postcondition in the supplied source, so +there is no separate mandatory postcondition verdict. No additional robustness +claim was requested. TCB `TCB-LAST-R1` consists only of the Rust 1.82.0 +authoritative axioms inventoried below; there are no additional assumptions. + +## Domain, boundary, and coverage + +Let + +`Required = {Rust 1.82.0} × {every target where the exact source and used 1.82.0 std items exist} × {every ordinary profile} × {every valid &[u8] value}`. + +This is the controlling expression supplied by `REQUEST.md`; no normalization, +enumeration, or exclusion is applied. The only language-reachable in-scope API +surface is safe free function `last`. Its caller is adversarial subject only to +well-typed safe use. The only unsafe consumer is +`bytes.get_unchecked(index)`. There is no representation invariant beyond the +valid slice/reference properties enforced at the input type boundary. + +The proof below is parametric in slice length, target `usize` width, and profile. +The source has no conditional compilation. It proves the same obligation for +every member of `Required`; hence `Covered = Required` and +`Required ⊆ Covered`. In particular, the subtraction is proved non-overflowing, +so profile-dependent overflow handling is unreachable and immaterial. + +## Authoritative premise inventory (`TCB-LAST-R1`) + +All entries apply exactly to Rust 1.82.0 and to the full required target/profile +domain. Each is accepted solely as version-matched Rust standard-library or +Reference authority. These, and only these, are the non-local premises consumed +by the derivation. + +- **A1 — unchecked slice access.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “Returns a reference to an element or subslice, without doing bounds + checking.” Its Safety section says: “Calling this method with an + out-of-bounds index is undefined behavior even if the resulting reference is + not used.” Verified proposition: a `usize` call must use an in-bounds element + index; with that obligation met, the shown `&self -> &Output` API returns a + reference to that element. + +- **A2 — slice length.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “Returns the number of elements in the slice.” Its displayed return type is + `usize`. Verified proposition: `bytes.len()` is the slice's element count `n` + represented as `usize`. + +- **A3 — emptiness test.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “Returns `true` if the slice has a length of 0.” Verified proposition: + `bytes.is_empty()` reports whether the same slice's element count is zero; + therefore a false result means `n != 0`. + +- **A4 — selected `if` arm.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “If all `if` and `else if` conditions evaluate to false then any `else` block + is executed.” Verified proposition: execution of lines 7–9 implies that the + line-4 condition evaluated to false; the unsafe call is not executed on the + true/empty path. + +- **A5 — `usize` lower bound.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + the unsigned-integer table gives `usize` minimum `0` (and maximum + `2^ptr_size - 1`). Verified proposition: every `usize`, including `n`, is + nonnegative; thus `n != 0` implies `n >= 1` on every target width. + +- **A6 — subtraction and overflow boundary.** [Arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators) + identifies binary `-` as “Subtraction.” [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow) + includes: “When `+`, `*` or binary `-` create a value greater than the maximum + value, or less than the minimum value that can be stored.” Verified + proposition: for `usize n >= 1`, `n - 1` is the mathematical difference, + lies in `usize`'s range, and does not overflow in any ordinary profile. + +Reconciliation: A4 and A3 establish non-emptiness; A2 and A5 turn it into the +integer bound; A6 establishes the exact index without overflow; A1 consumes the +resulting in-bounds fact and supplies the reference. No cited premise is unused. + +## Obligation ledger and reconstructed proof + +**O1, empty path (lines 4–5): PROVED.** By A4, when the condition is true only +the consequent path is selected. It returns `None` and executes no unsafe +operation. + +**O2, arithmetic (line 7): PROVED.** Let `n = bytes.len()` (A2). Reaching the +`else` proves `is_empty() == false` (A4), hence `n != 0` (A3). Since `n: usize` +and its minimum is zero (A5), `n >= 1`. Therefore `n - 1` is representable and +non-overflowing by A6, and line 7 establishes `index = n - 1`. + +**O3, `get_unchecked` (line 9): PROVED.** From O2, +`0 <= index = n - 1 < n = bytes.len()`. Thus `index` denotes an element within +`bytes`, satisfying A1's safety obligation. A1 then supplies a reference to that +element. The call neither mutates the slice nor crosses an intervening call, +callback, unwind point, or state transition. Its displayed borrow-returning +signature, composed with `last`'s borrow-returning signature, carries the +reference rather than fabricating or extending one. Wrapping that reference in +`Some` introduces no further unsafe operation. + +The intersection of O1–O3 coverage is all of `Required`, establishing the +soundness certificate stated above. + +## Finding DOC-PROOF-1 and replacement text + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not +name `get_unchecked`'s bounds requirement and supplies none of O2/O3. Moreover, +the lifetime statement is not the caller obligation identified by A1. A local +reviewer must reconstruct the branch, zero-length, unsigned-arithmetic, and +bounds chain to validate the unsafe call. + +Minimal replacement comment: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() != 0`. Therefore `index = bytes.len() - 1` is representable and +// satisfies `index < bytes.len()`, making `index` in bounds for `bytes`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Required resolution is documentation-only; `lib.rs` was not edited. Re-audit +this result if the function, unsafe call contract, Rust version, supported +domain, or any cited authoritative text changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/E.md new file mode 100644 index 0000000000..20a88bcf47 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/E.md @@ -0,0 +1,51 @@ +# Review of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, every well-typed safe call to `last` is free of Rust undefined behavior under Rust and standard library 1.82.0, for every input `bytes: &[u8]`, every target on which this source and the used 1.82.0 slice APIs exist, and every ordinary profile. The result uses only the authoritative 1.82.0 axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** The comment's lifetime statement is not the safety precondition documented for `get_unchecked`. It omits the material derivation that `index` is in bounds. The implementation verdict and proof-artifact verdict are therefore intentionally different. + +There is no documented caller precondition or documented postcondition on `last` itself. The documented `get_unchecked` result guarantee consumed by the wrapper is proved below. + +## Domain and surface closure + +Let `Required(case)` mean: exact supplied source; Rust/stdlib 1.82.0; any target where the source and `is_empty`, `len`, and `get_unchecked` exist; any ordinary profile; and any well-typed safe call with any valid shared byte slice and permitted execution. Its configuration projection changes none of the source: there is no `cfg`, feature, generated code, dependency, FFI, allocator, concurrency, or target-specific operation. The sole language-reachable surface in scope is the public safe free function `last`; its only unsafe obligation site is `bytes.get_unchecked(index)`. + +Partition every required case by the natural number `n = bytes.len()`: `n = 0` or `n != 0`. These cases are exhaustive and the proof below is parametric in target and profile. Thus their union covers every configuration fiber and every input; the aggregate `Covered` predicate equals `Required` for the in-scope soundness obligation. + +## Reconstructed proof and obligation ledger + +**O1 — empty path.** If `bytes.is_empty()` evaluates to true, `if` semantics executes the consequent and skips the `else`. The function returns `None` and never reaches an unsafe operation. This path is covered. + +**O2 — `get_unchecked` precondition.** On the `else` path, `if` semantics establishes that `bytes.is_empty()` evaluated to false. Axiom A1 states `n = 0 -> is_empty() = true`; its contrapositive gives `is_empty() != true -> n != 0`. A2 identifies `n` as the number of slice elements, hence a natural number, so `n != 0` gives `n >= 1`. Consequently the source assignment computes the representable value `index = n - 1`, with `0 <= index < n`. It is therefore not an out-of-bounds index, discharging A4's exact unsafe-call requirement. There is no underflow, so no overflow-check or optimization profile creates another case. + +**O3 — consumed callee result.** By A4, the in-bounds call returns a reference to the selected element; with `index = n - 1`, that is the final element. The callee and wrapper signatures carry the returned shared reference from the input borrow, so no hidden caller obligation is introduced. `Some` wraps that reference. This establishes every documented callee postcondition consumed here. + +O1 and O2 cover the exhaustive partition; O3 establishes the consumed result on O2. Therefore `Required subseteq Covered`, certifying the stated `PROVED` verdict. No test, build, compiler-backend claim, or unlisted premise participates. + +## Authoritative premise inventory and reconciliation + +All quotations and links are version-matched to 1.82.0 and apply throughout the required target/profile domain where the respective item exists. + +- **A1 (`slice::is_empty`).** The documentation says it returns “true if the slice has a length of 0.” [Rust 1.82.0 `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition: for this slice, `len = 0 -> is_empty() = true`. O2 consumes its contrapositive. +- **A2 (`slice::len`).** It returns the “number of elements in the slice.” [Rust 1.82.0 `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition: `n = bytes.len()` is exactly the slice's element count. O2 consumes it. +- **A3 (`if`).** “If a condition operand evaluates to false, the consequent block is skipped”. [Rust 1.82.0 `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Together with the same paragraph's branch rules, this verifies that only the true condition reaches O1 and only the false condition reaches the `else` containing O2. +- **A4 (`slice::get_unchecked`).** The contract identifies an “out-of-bounds index” as “undefined behavior” and says the method returns a “reference to an element”. [Rust 1.82.0 `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified propositions: the call must use an in-bounds index even if the result were unused, and an admitted `usize` index returns a reference to its element. O2 consumes the former; O3 consumes the latter. + +This list is complete for the derivation. The exhaustive two-case split, contrapositive, and `n >= 1 -> 0 <= n - 1 < n` are mathematical steps. Branch reachability and assignments are inspected local source facts. No overflow behavior, integer-width bound, target property, lifetime promise beyond the checked signatures, dependency behavior, or external specification is silently consumed; accordingly, unused allowlisted pages are not cited. + +## Finding and replacement comment + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not mention A4's bounds obligation and does not connect the dominating branch to `len() - 1`. Removing the reconstructed A1/A3-to-bounds argument leaves no local proof of the unsafe precondition, so the omission is material. The statement is compatible with the typed signatures, but it is not an adequate `SAFETY` proof. + +Replace it with: + +```rust +// SAFETY: This `else` branch is reached only when `bytes.is_empty()` is +// false. Therefore `bytes.len() != 0`, so `index = bytes.len() - 1` is +// representable and satisfies `index < bytes.len()`. Thus `index` is in +// bounds, as required by `slice::get_unchecked`. +``` + +Re-audit if the source, function/callee contracts, Rust version, supported configuration predicate, or any cited 1.82.0 documentation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/F.md new file mode 100644 index 0000000000..0d4148584a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/F.md @@ -0,0 +1,59 @@ +# Audit of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact `lib.rs` supplied, Rust and standard library 1.82.0, every target on which this source and the used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)` with any valid shared slice, execution introduces no Rust undefined behavior. The proof is relative only to the Rust 1.82.0 authoritative axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** “The returned reference cannot outlive `bytes`” does not establish the only documented safety obligation of the executed `get_unchecked(index)`: that `index` is not out of bounds. A material bounds derivation had to be reconstructed. This is a proof-artifact defect, not an implementation defect. + +No caller safety precondition is permitted or needed. `last` has no documented postcondition, so there is no separate mandatory postcondition verdict. No tests, builds, execution, expansion, prior audit, dependency claim, or tool-derived evidence is used. + +## Domain and surface closure + +Let + +`Required = { (this exact source, Rust/std 1.82.0, target t, ordinary profile p, valid &[u8] value B, permitted execution e) | the source and its used std items exist on t }`. + +This is the request's controlling expression, preserved without enumeration or exclusion. Its configuration projection fixes Rust/std to 1.82.0 and otherwise quantifies over those `t` and `p`. The complete language-reachable in-scope surface is the safe public free function `last`; it accepts a caller-controlled shared slice. The sole unsafe site is `bytes.get_unchecked(index)`. There are no fields, constructors, traits or impls, callbacks, macros, generated items, dependencies, `cfg`s, FFI, concurrency, allocators, or invariant-bearing state in the supplied source. + +The two Boolean outcomes of `bytes.is_empty()` are exhaustive. The proof below is parametric in target and profile: the same source is selected, no target fact is used, and the subtraction is proved non-overflowing rather than relying on profile overflow behavior. Thus each required configuration fiber is covered. With `Covered` equal to the union of the two branch cases for the sole unsafe-backed safe surface, `Required ⊆ Covered`. + +## Reconstructed local proof and obligation ledger + +Fix an arbitrary required case and write `L = bytes.len()`. + +1. If `bytes.is_empty()` is true, the `if` consequent executes and returns `None`; the unsafe call is not reached. +2. If it is false, the `else` executes. AX-EMPTY states that length zero implies `is_empty() == true`; contraposition gives `L ≠ 0`. AX-LEN identifies `L` as the number of slice elements, hence a natural count, so `L ≥ 1`. +3. Therefore `I = L - 1` is representable, cannot underflow, and satisfies `0 ≤ I < L`. This is ordinary predecessor arithmetic applied to the locally obtained element count; it is independent of overflow-check and optimization settings. +4. Consequently `I` denotes the last of the `L` elements and is not out of bounds for this same slice. This discharges AX-UNCHECKED's exact safety condition before the call. No operation can change the slice or `L` between the check, length reads, and call. +5. `get_unchecked`'s expression type is a shared reference, and the enclosing well-typed safe function returns it inside `Option`; no caller-supplied behavior or hidden obligation intervenes. + +Obligation dispositions: branch reachability—proved by AX-IF; nonzero length—proved by AX-EMPTY and AX-LEN; subtraction representability and `I < L`—proved by the local facts plus predecessor arithmetic; `get_unchecked` in-bounds precondition—proved; safe-surface soundness—proved by the exhaustive branch union. There are no remaining obligations or uncovered cases. + +## Authoritative-premise inventory and reconciliation + +All entries apply exactly to Rust/std 1.82.0, all targets where the cited item exists, and every ordinary profile. Each is accepted as authoritative Rust documentation, consumed exactly where identified above, and must be rechecked if Rust/std or the cited text changes. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Verified proposition: `bytes.len()` returns the slice's element count as `usize`. Consumer: steps 2–3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Verified proposition: if `L = 0`, `bytes.is_empty()` evaluates to true. Consumer: step 2. +- **AX-IF.** [Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this `else` body, and hence the unsafe call, is reached only in the false-condition case; the true case executes the consequent instead. Consumers: steps 1–2 and branch exhaustiveness. +- **AX-UNCHECKED.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “with an out-of-bounds index is undefined behavior”. Verified proposition: the call requires its `usize` index not to be out of bounds for the receiver slice. Consumer: step 4. + +The remaining inputs are inspected-source facts and elementary logic/arithmetic: the dominating branch, assignments `L` and `I`, absence of intervening mutation/calls, contraposition, and the predecessor lemma for a positive element count. No other Rust semantic or standard-library proposition is consumed. In particular, the existing lifetime sentence is not used to discharge `get_unchecked`'s safety condition. + +## Required proof-artifact repair + +Replace the existing comment with: + +```rust +// SAFETY: This `else` executes only when `bytes.is_empty()` is false. +// Since `is_empty()` returns true for a zero-length slice, `bytes.len()` is +// nonzero. Thus `index = bytes.len() - 1` is representable and is strictly +// less than `bytes.len()`, so it is in bounds for this same slice. +``` + +This states the operation's controlling obligation, the dominating local fact, the derivation, and the resulting in-bounds proposition adjacent to the unsafe call. + +## Residual scope and review triggers + +Excluded because the request does not include them: undocumented behavioral robustness, compiler/backend or binary correctness, nonordinary profiles, other Rust/std versions, and targets where the source or used items do not exist. Re-audit on any change to `last`, its signature or documentation, the supported version/configuration predicate, or any consumed Rust/std contract. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/G.md new file mode 100644 index 0000000000..1ec57594c3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/G.md @@ -0,0 +1,53 @@ +# Source audit: `lib.rs::last` + +## Claim and verdict + +**Implementation soundness: PROVED.** For the supplied 11-line `lib.rs`, every well-typed safe call to `last(bytes: &[u8])` under Rust/standard library 1.82.0 is free of Rust undefined behavior. `Required` is exactly the requested product of: Rust 1.82.0; every target on which this source and the used 1.82.0 slice items exist; every ordinary profile; and every valid `&[u8]` argument. The proof is source-level under documented Rust abstract semantics. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” is an accurate type/lifetime observation, but it does not establish the actual caller obligation of `get_unchecked`: that `index` is in bounds. Closing the implementation proof requires the material reconstruction below. This is a proof-artifact defect, not an implementation defect. + +There is no caller-side safety precondition: `last` is public and safe. It has no documented behavioral postcondition, so none is silently inferred from its name. No additional robustness property is in scope. + +## Surface, snapshot, and domain closure + +The complete target contains only `#![allow(dead_code)]` and the public safe free function `last`; its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors, traits/impls, macros, generated artifacts, dependencies, callbacks, `cfg`s, target-specific operations, mutable state, or representation invariants. + +The only profile-sensitive candidate is subtraction overflow. The proof below establishes mathematically that it cannot overflow, so overflow-check configuration, optimization, and debug assertions do not change coverage. Pointer width changes `usize`'s maximum but not the parametric argument. Consequently `Covered = Required`, proving `Required ⊆ Covered` without enumerating targets or profiles. No target was built, tested, executed, or expanded. + +## Authoritative premise inventory (Rust 1.82.0) + +These are all Rust/std premises consumed; each link is version-matched. The quoted excerpt is the minimum supplying the proposition. + +1. **A1 — `get_unchecked` safety.** [Slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “out-of-bounds index is undefined behavior”. Proposition: the unsafe call requires its `usize` index to be in bounds (even non-use of the result would not cure an out-of-bounds call). Consumer: OBL-1. +2. **A2 — length.** [Slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Proposition: `bytes.len()` equals the slice's element count. Consumers: OBL-1 and the bounds normalization. +3. **A3 — empty test.** [Slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Proposition: length zero implies `is_empty() == true`; its contrapositive is consumed. Consumer: OBL-1. +4. **A4 — branch selection.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all if and else if conditions evaluate to false then any else block is executed.” Proposition: reaching lines 7–9 means `bytes.is_empty()` evaluated false. Consumer: OBL-1. +5. **A5 — binary minus.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): “- Subtraction”. Proposition: binary `-` on primitive integers denotes subtraction. Consumer: OBL-1. +6. **A6 — subtraction overflow criterion.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): “binary - create a value greater than the maximum value, or less than the minimum value that can be stored.” Proposition: binary subtraction overflows when its mathematical result lies outside the integer type's range. Consumer: OBL-1 and profile closure. +7. **A7 — `usize` domain.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The usize type is an unsigned integer type”. Proposition: `usize` values are nonnegative integers (with target-dependent width). Consumer: OBL-1 and target closure. + +Facts read directly from the checked source/type signatures—`bytes: &[u8]`, `index: usize`, the shared-reference result, and the returned lifetime being limited by the sole input borrow—are local, compiler-enforced type facts rather than extra admitted premises. The TCB is **TCB-LAST-1**: exactly A1–A7 as authoritative Rust 1.82.0 axioms; no safe/unsafe dependencies, implementation assumptions, external specifications, tools, deployment restrictions, or other assumptions. + +## Obligation ledger and reconstructed proof + +**OBL-1 (line 9): satisfy A1 for every input/configuration.** Let `n = bytes.len()` (A2). + +* If `bytes.is_empty()` is true, the first branch returns `None`; subtraction and the unsafe call are not executed (source plus A4). There is no unsafe obligation. +* Otherwise A4 gives `is_empty() == false`. If `n` were zero, A3 would make it true; hence `n != 0`. Because `n: usize` is unsigned (A7), `n >= 1`. +* By A5, line 7 computes the mathematical value `i = n - 1`. Thus `0 <= i < n`; since `n` itself is representable, `i` is also within the `usize` range. A6 therefore rules out subtraction overflow in every ordinary profile. +* A2 says the slice has exactly `n` elements. The integer positions of an `n`-element sequence are `0..n`, so `0 <= i < n` makes `i` in bounds. This discharges A1 before `get_unchecked(i)` executes. The shared result is tied by the method and function signatures to the `bytes` borrow, so returning it introduces no hidden lifetime or mutation obligation. + +Every path is covered, and no premise appears above without a consumer or is consumed without appearing in A1–A7. + +## Required replacement comment + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice is empty, so `bytes.len() != 0`. Therefore +// `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, making `index` in bounds for `get_unchecked`. +// The returned shared reference remains bounded by the `bytes` borrow. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Review must be repeated if `last`, its signature/comment, Rust/std version, used std contracts, or the requested target/profile domain changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/H.md new file mode 100644 index 0000000000..379631973b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/H.md @@ -0,0 +1,98 @@ +# Source review: `last` + +## Claim, snapshot, and verdicts + +Audited artifact: the exact `target/lib.rs` supplied for this review, containing one public safe function, `pub fn last(bytes: &[u8]) -> Option<&u8>`, and one unsafe operation, `bytes.get_unchecked(index)`. No generated code, dependencies, features, `cfg`, macros, FFI, traits, mutable state, or other API surfaces occur in the supplied target. + +**Soundness — PROVED.** For Rust and standard library 1.82.0, every target on which this exact source and the used standard-library items exist, every ordinary profile, and every well-typed safe call with any valid `&[u8]`, every execution of `last` is free of Rust undefined behavior under the documented Rust abstract semantics. There is no caller-side safety precondition. + +**Existing proof artifact — DEFICIENT.** The comment “The returned reference cannot outlive `bytes`” states a type-enforced lifetime property, but does not establish the sole safety precondition of the executed unsafe call: that `index` is in bounds. A material bounds-and-arithmetic derivation had to be reconstructed below. This is a documentation defect, not an implementation defect. + +There is no source documentation specifying a caller-facing behavioral postcondition, so no separate documented-postcondition verdict is in scope. The standard-library return guarantee consumed by the soundness proof is covered below. + +## Domain and boundary closure + +Let `Required = {Rust/stdlib = 1.82.0} × {targets where this source and these items exist} × {ordinary profiles} × {all valid &[u8] inputs}`. This is the controlling expression stated by `REQUEST.md`; no normalization, exclusion, release interpolation, or finite target enumeration is used. + +The only safe surface is `last`; its input type enforces a valid shared slice reference and its return type carries a shared element reference. The only unsafe consumer is `get_unchecked`. There is no invariant-bearing stored state. The local relation is that `n = bytes.len()` and `index = n - 1`, with the unchanged `bytes` value used as the call receiver. + +Coverage partitions executions by the Boolean result of `bytes.is_empty()`, an exhaustive partition. The `true` case executes no unsafe operation. The `false` case is proved parametrically below for every slice length and every target pointer width. Because subtraction is proved non-overflowing, profile-dependent overflow checking is irrelevant. Thus `Covered = Required`, establishing `Required ⊆ Covered`. + +## Authoritative premise inventory (Rust 1.82.0 only) + +Each entry is an accepted, version-matched Rust axiom; its exact proposition is stated after the quotation. + +**A-GET.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + +> “Returns a reference to an element or subslice, without doing bounds checking.” +> +> “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” + +Proposition: for the `usize` call here, the caller must establish that `index` selects an element of this slice; when it does, the method returns a reference to that element. Consumed by O3–O4. + +**A-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len), whose displayed signature returns `usize`: + +> “Returns the number of elements in the slice.” + +Proposition: `n = bytes.len()` is the slice's element count and has type `usize`. Consumed by O1–O4. + +**A-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + +> “Returns `true` if the slice has a length of 0.” + +Proposition: `bytes.len() = 0` implies `bytes.is_empty() = true`; contraposition permits a false result to establish nonzero length. Consumed by O1. + +**A-IF.** [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + +> “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped.” +> +> “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” + +Proposition: reaching this `else` block establishes that `bytes.is_empty()` evaluated to false; the other branch contains no unsafe call. Consumed by O1 and coverage. + +**A-SUB.** [arithmetic and logical binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): + +> “Operators are defined for built in types by the Rust language.” + +The table specifies binary `-` on integers as “Subtraction.” Proposition: the `usize` expression `n - 1` is integer subtraction when representable. Consumed by O2. + +**A-OVERFLOW.** [overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): + +> “When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored” + +is listed as overflow, and the section states that integer operators panic on overflow in debug mode. Proposition: if the mathematical result remains in the `usize` range, this subtraction does not overflow, so overflow-check configuration cannot alter this path. Consumed by O2 and configuration closure. + +**A-USIZE.** [integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + +> “The `usize` type is an unsigned integer type with the same number of bits as the platform’s pointer type.” + +Proposition: `usize` values are nonnegative integers; therefore a nonzero `usize` is at least one. Consumed by O2. The proof is parametric in its target-dependent width. + +No other Rust semantic or standard-library premise is consumed. Local source facts are the displayed types, the dominating branch, the assignments, the absence of any intervening mutation/reassignment, and the fact that the same `bytes` value is the receiver. Ordinary integer inequalities and contraposition are logical/mathematical inference, not additional Rust premises. + +## Obligation ledger and reconstructed proof + +**O1 — nonzero length (PROVED).** The unsafe call is reachable only in the `else` block. A-IF makes the observed condition false. A-EMPTY gives `len = 0 ⇒ is_empty = true`; contraposition gives `is_empty = false ⇒ n != 0`. + +**O2 — arithmetic and bound (PROVED).** By A-LEN and A-USIZE, `n` is a nonnegative integer; O1 therefore gives `n ≥ 1`. Hence the mathematical value `n - 1` is nonnegative, is no greater than the representable `n`, and is strictly less than `n`. A-SUB and A-OVERFLOW therefore establish that `index = n - 1` is representable without underflow/overflow in every ordinary profile and that `index < bytes.len()`. + +**O3 — unsafe-call precondition (PROVED).** `index` is a `usize`, so it is nonnegative; O2 gives `index < bytes.len()` for the unchanged receiver. It therefore selects an element of `bytes`, discharging A-GET's bounds requirement. No alias, mutation, temporal, panic, or unwind obligation is introduced by this shared-reference call. + +**O4 — result (PROVED).** A-GET returns a reference to the selected element. The inspected method and function signatures carry that shared borrow into `Option<&u8>`; no unsafe lifetime extension, raw pointer, or stored state occurs. The empty/true branch returns `None` without unsafe execution. + +## Finding and proposed repair + +**F-DOC-1 — inadequate local `SAFETY` proof.** The current comment proves neither O1, O2, nor O3. Its lifetime statement does not imply in-bounds indexing and therefore cannot justify `get_unchecked`. Replace it with: + +```rust +// SAFETY: Reaching this `else` branch means `bytes.is_empty()` was false. +// Since a zero-length slice makes `is_empty()` true, `bytes.len()` is nonzero. +// Thus `bytes.len() - 1` neither underflows nor overflows and is strictly less +// than `bytes.len()`, so `index` is in bounds as required by `get_unchecked`. +``` + +This repair changes no implementation or public contract and has no compatibility impact. Re-audit if the branch, index arithmetic, receiver, function signature, Rust/stdlib version, supported configuration domain, or `get_unchecked` contract changes. + +## TCB, evidence, and residual scope + +TCB revision `TCB-LAST-1` consists only of accepted A-GET through A-USIZE, each verified against the linked Rust 1.82.0 Reference or standard-library page and consumed exactly as mapped above. There are no additional TCB assumptions, dependencies, tools, tests, sampled executions, generated artifacts, or prior audits. No build, test, execution, or macro expansion was performed. The verdict is source-level; compiler/backend binary correctness and behavior outside the exact requested Rust/version/target/profile domain are excluded. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/I.md new file mode 100644 index 0000000000..41d220b8cb --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/I.md @@ -0,0 +1,57 @@ +# Local proof-artifact review: `last` + +## Claim and results + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard library 1.82.0, every target on which this source and its used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)`, execution is free of Rust undefined behavior under the documented Rust abstract semantics. The TCB is `TCB-LAST-1` below: version-matched Rust authorities only, with no additional assumptions. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” does not establish the sole material caller obligation of `get_unchecked`: that `index` is in bounds. Reconstructing that omitted bounds proof is necessary to certify the implementation. This is a proof-artifact defect, not an implementation defect. + +`last` has no documented behavioral postcondition, so no independent `CONTRACT-BROKEN` claim arises. Its safe signature imposes no caller-side safety precondition beyond a well-typed `&[u8]`. + +## Snapshot, boundary, and domain + +The audited artifact is exactly the supplied `target/lib.rs`; no revision or digest was supplied. Audit cutoff: 2026-08-01. The complete safe boundary is the public free function `pub fn last(bytes: &[u8]) -> Option<&u8>`. Its only unsafe site is `bytes.get_unchecked(index)`. There are no fields, traits, impls, callbacks, FFI, macros, generated artifacts, dependencies, persistent invariants, `cfg`s, features, or target-specific branches in the supplied source. No build, test, execution, or tool-derived evidence was used. + +Let + +`Required = {source exactly as supplied} × {Rust/std 1.82.0} × {targets where the source and used items exist} × {ordinary profiles} × {all valid &[u8] inputs}`. + +The proof below is parametric in slice length, `usize` width, target, and profile. Hence `Covered = Required`, proving `Required ⊆ Covered`; no enumeration or exclusion is used. Debug/release overflow behavior is irrelevant because the subtraction is proved non-overflowing. + +## Obligation ledger and reconstructed proof + +Let `L = bytes.len()`. + +1. **Control flow.** The unsafe site is reachable only through the `else` block, so `bytes.is_empty()` evaluated to `false` (A2). +2. **Nonzero length.** A1 states `L = 0 ⇒ is_empty() = true`; by contraposition with step 1, `L ≠ 0`. A3 identifies `L` as the slice's element count, and A4 identifies its type as unsigned, so `L ≥ 1`. +3. **Arithmetic.** Integer `-` is subtraction (A5). Therefore `index = L - 1` is representable and satisfies `0 ≤ index < L`. It neither creates a value below the type minimum nor overflows under A6, in any ordinary profile. +4. **Unsafe call.** Thus the `usize` index is in bounds. This discharges A7's safety requirement, and `get_unchecked` supplies the shared element reference described by its contract. Wrapping it in `Some` and returning it introduces no unsafe operation. The empty branch executes no unsafe operation. + +These cases exhaust every boolean result and every valid slice, so every unsafe-site obligation is proved over `Required`. + +## Authoritative premise inventory (`TCB-LAST-1`) + +All entries apply exactly to Rust/std 1.82.0 on every target where the cited item and audited source exist. Each is accepted as a versioned Rust `AXIOM`; there are no other TCB categories or premises. + +- **A1 — `is_empty`.** The docs say “`true` if the slice has a length of 0.” [Rust 1.82 slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition consumed in step 2: `L = 0 ⇒ is_empty() = true`. +- **A2 — `if`.** “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” [Rust 1.82 Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Verified proposition consumed in step 1: this `else` execution entails the sole condition evaluated to `false`. +- **A3 — slice length.** `len` returns the “number of elements.” [Rust 1.82 slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition consumed in step 2: `L` is the slice's element count; its displayed return type is `usize`. +- **A4 — `usize`.** “The `usize` type is an unsigned integer type.” [Rust 1.82 Reference, numeric types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types). Verified proposition consumed in steps 2–3: `L` and `index` have no negative representable values; the proof is width-parametric. +- **A5 — subtraction.** The primitive-integer table defines `-` as “Subtraction.” [Rust 1.82 Reference, arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators). Verified proposition consumed in step 3: `L - 1` denotes integer subtraction when representable. +- **A6 — overflow boundary.** Binary subtraction overflows when it creates a value “less than the minimum value that can be stored” (or above the maximum). [Rust 1.82 Reference, overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow). Verified proposition consumed in step 3: because `L ≥ 1`, `L - 1 ≥ 0`, so this subtraction does not overflow; overflow-check profile choices cannot change this path. +- **A7 — unchecked indexing.** The method “Returns a reference to an element or subslice”; an “out-of-bounds index is undefined behavior.” [Rust 1.82 slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified proposition consumed in step 4: a `usize` index must be in bounds, and a contract-satisfying call returns the shared reference. + +The derivation consumes A1–A7 exactly as mapped above and no unlisted Rust semantic premise material to the unsafe obligation. + +## Finding and replacement comment + +**FINDING-COMMENT-1 (proof documentation):** the current comment establishes no implication from the dominating branch to `index < bytes.len()`. Minimum resolution is to replace it with: + +```rust +// SAFETY: This else branch is executed only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() != 0` here. +// Thus `index = bytes.len() - 1` cannot underflow and is strictly less than +// `bytes.len()`, so it is in bounds as required by `get_unchecked`. +``` + +Re-audit if the source, function or callee contract, Rust/std version, support domain, or cited authoritative prose changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/J.md new file mode 100644 index 0000000000..e5a8cb2601 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/reports/J.md @@ -0,0 +1,149 @@ +# Unsafe Rust Audit: `last` + +## Claim and verdict + +**Soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard +library 1.82.0, every target on which this source and the used standard-library +items exist, every ordinary profile, every valid `&[u8]`, and every permitted +source-level execution, every well-typed safe call to `last` is free of Rust +undefined behavior. There is no caller-side safety precondition. This result is +relative only to the Rust 1.82.0 authorities in TCB-R1 below; it adds no TCB +assumption. + +**Existing `SAFETY` comment: DEFICIENT.** Its lifetime statement does not +establish the `get_unchecked` call's material requirement that `index` be in +bounds. Reconstructing that missing argument is necessary to reach the +implementation verdict. This is a proof-artifact defect, not an implementation +defect. + +There is no documented postcondition on `last`, so no separate mandatory +postcondition verdict applies. In particular, the name `last` is not treated as +normative documentation. + +## Snapshot, domain, and boundary + +- Snapshot: the complete supplied `lib.rs`, lines 1--11; no generated source, + dependencies, features, `cfg`, macros, FFI, assembly, build scripts, or prior + audit are present in the supplied target. +- Surface inventory: one public safe free function, + `pub fn last(bytes: &[u8]) -> Option<&u8>`. There are no representation + fields, constructors, traits, methods, callbacks, hidden items, statics, or + invariant-bearing state. The sole unsafe site is + `bytes.get_unchecked(index)` at line 9. +- Let `Required(b,t,p,e)` mean: this exact source; Rust/std 1.82.0; `b` is any + valid `&[u8]`; `t` is any target where the source and used items exist; `p` is + any ordinary profile; and `e` is any permitted execution. This is exactly the + request's controlling expression, so the normalization is equality in both + directions. `Required_cfg(t,p) = target_exists(t) && ordinary_profile(p)`. + There is no policy conflict, exclusion, or unresolved domain. +- Actual axes are slice length, target-dependent `usize` width, and arithmetic + overflow-check configuration. The proof below is parametric in all three. + Optimization, debug assertions, and panic strategy do not alter any consumed + proposition. No build or generation pipeline selects another artifact. + +## Obligation ledger and reconstructed proof + +**O1 -- branch closure.** Partition executions by the branch actually selected +at lines 4--10. Rust's `if` semantics makes the two source paths exhaustive. If +the consequent executes, line 5 returns `None` and the unsafe operation is not +reached. If the `else` executes, `bytes.is_empty()` evaluated false. + +**O2 -- arithmetic.** Put `n = bytes.len()` on the `else` path. AX-EMPTY says +that length zero would make `is_empty()` true; by contraposition, the observed +false result gives `n != 0`. AX-USIZE makes `n` an unsigned integer, hence +`n > 0`. Integer `-` is subtraction (AX-SUB), so line 7 computes +`index = n - 1`. Mathematically `0 <= n - 1 < n`; the result is neither below +the type minimum nor above its maximum, so AX-OVERFLOW shows that this +subtraction does not overflow. Thus this result and the absence of an +arithmetic panic are identical with overflow checks enabled or disabled. + +**O3 -- unsafe call.** AX-LEN identifies `n` as the number of slice elements. +Consequently the integer index `n - 1`, with `n > 0`, is in the slice's index +range. AX-GET says an out-of-bounds call is UB and that the method returns a +reference to the selected element; O2 proves the excluded condition false. +The call therefore satisfies its safety contract and returns the in-bounds +`&u8` used to construct `Some`. There is no later mutation, callback, +interference, unwind point, or unsafe consumer. + +For every `Required` case, O1 selects a covered path; the consequent path has no +unsafe operation, while O2--O3 cover every alternative path for every target +`usize` width and profile. Hence each obligation's covered domain contains +`Required`; their pointwise intersection does too. This is the +`Required ⊆ Covered` certificate for the verdict. + +## Rust/std authority inventory (TCB-R1) + +All entries are Rust 1.82.0 AXIOMs, checked at the linked versioned sections, +accepted as the request-authorized Rust authority, and applicable to every +`Required` target where the item exists. There are no dependencies, tools, or +additional admitted propositions. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “number of elements in the slice”. Verified proposition: `bytes.len()` is the + slice's element count and has the shown return type `usize`. Consumers: O2, + O3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “`true` if the slice has a length of 0”. Verified proposition: if the element + count is zero, this call returns true. Consumer: O2. +- **AX-IF.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “condition operand evaluates to `true`, the consequent block is executed”; + “conditions evaluate to `false` then any `else` block is executed”. Verified + proposition: for this one-condition `if`/`else`, the condition selects the + consequent when true and the `else` when false. Consumer: O1. +- **AX-USIZE.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + “The `usize` type is an unsigned integer type”. Verified proposition: + `n: usize` is nonnegative and lies in that type's representable integer + range, for every supported pointer width. Consumer: O2. +- **AX-SUB.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): + the integer `-` table entry is “Subtraction”. Verified proposition: the + built-in operation on these `usize` operands is integer subtraction. + Consumer: O2. +- **AX-OVERFLOW.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): + “binary `-` create a value greater than the maximum value, or less than the + minimum value that can be stored” is overflow. Verified proposition: a + subtraction whose mathematical result remains in the `usize` range does not + overflow. Consumer: O2. +- **AX-GET.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “reference to an element”; “out-of-bounds index is undefined behavior”. + Verified proposition: the `usize` call returns a reference to the indexed + element without a bounds check, and the caller must exclude an out-of-bounds + index. Consumer: O3. + +This inventory exactly matches the semantic leaves used above. The remaining +steps are inspected source syntax, contraposition, integer inequalities, and +set inclusion; no uncited Rust/std proposition or tool result supplies a +material inference. + +## Finding PA-1 -- inadequate local proof + +- **Affected artifact:** line 8's comment; implementation status **PROVED**, + proof-artifact status **deficient**. +- **Defect:** “The returned reference cannot outlive `bytes`” neither states + nor derives `index < bytes.len()`, the precondition consumed at line 9. It is + not a substitute for O1--O3. +- **Required resolution:** replace the comment with locally reviewable bounds + reasoning. No caller contract or code change is needed. + +Proposed replacement text: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() > 0` here. +// Therefore `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, as required by `get_unchecked`. +``` + +## Evidence, residual scope, and review triggers + +No build, test, execution, macro expansion, or tool-derived evidence was used. +This is a source-level Rust abstract-semantics result, not a claim about a +particular compiler backend, binary, platform implementation, undocumented +behavior, performance, or panic freedom outside the proved subtraction. +Re-audit if the source/comment, function or std contracts, Rust version, +supported domain, or any presently absent configuration/generation/dependency +mechanism changes. + +**Final attestation:** every in-scope surface and unsafe obligation has a +status; the material reconstruction and proof-artifact defect are explicit; +the authority inventory is reconciled to the derivation; and no conclusion +rests on testing or absence of a counterexample. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s1/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/PACKET.json new file mode 100644 index 0000000000..ee76babcb9 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "afe540a0e03212b0d8554a6a522d2a5695a0eaadf07126c410ef831a563b9623", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "L", + "presentation_order": [ + "J", + "F", + "D", + "G", + "H", + "C", + "A", + "B", + "E", + "I" + ], + "report_sha256": { + "A": "d74c89e74f1a4cc352183cea151c4ac387fea502d6c9a88e8ee7c1b63612fce8", + "B": "da0d4553898b5177722b6739562ef75fa4d6baf228dd1818f8f7e39e42167356", + "C": "141d0ee3549279a6d90aab62c89bc12d0f85a994bbfcdc4c5d29102001a1cc67", + "D": "1eb7ccc5e3184fe8e43a576150a25f498bf6f1e514486fde15ece31fd660e3e6", + "E": "ce572d45451eaf768a3731e7a09f92a21d813c1b3fe1940260b4eb70a58b933d", + "F": "593b40969c0e46fab20eaa7be52d261dbc21dc0091a4e0c981acf53e6b8f21a9", + "G": "9710335249669b879feff80e14868026cb6161579aefe7fb97213aa0af27872f", + "H": "48b4903ce42d924f6c1f532d6685a79209756520980218163e5ca6aaebd1040e", + "I": "36f4b173f16b9fbeaeed4b9cf467e501d0c986eb4c8ebd3654467e6a5c27a434", + "J": "9ee2c47518f8d65a91c84a208bdec4050c516fe6ea1c6dcf6da45299451f9bed" + }, + "rubric_sha256": "4da5564ee971cdb7d8584c60c62b87a0c377efbe1a69b60576f22364b412b02a", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s2", + "target_byte_tree_sha256": "cc05da115d055febc313edcdf18bae59a6230a63583bf918ad29e89eb06a4266" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/RUBRIC.md new file mode 100644 index 0000000000..e16d3af5a3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/RUBRIC.md @@ -0,0 +1,146 @@ +# Mode L Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file, its atom labels, expected +> result, or hard-error rules to an evaluated report agent. + +## Exact result + +Within the scope in `REQUEST.md`, `last` is sound. On the `else` branch, +`bytes.is_empty()` evaluated to false. The documented relation between +`is_empty` and slice length therefore gives `bytes.len() != 0`. Slice length has +type `usize`, whose values are nonnegative, so `bytes.len() > 0`. Consequently +`bytes.len() - 1` neither underflows nor overflows and mathematical subtraction +gives `index < bytes.len()`. This is precisely the in-bounds fact required by +`get_unchecked` for a `usize` index. + +The existing comment states only a lifetime fact. It does not address the +unsafe callee's in-bounds obligation, the facts which establish it, or the +derivation between them. It is therefore a deficient proof artifact even though +the implementation obligation can be reconstructed. A replacement must expose +that chain locally and must link or unambiguously refer to the checked, +version-matched authority entries it consumes. + +## Atoms + +- **L1 — Callee obligation:** State that the executed `get_unchecked(index)` + requires `index` to be in bounds, equivalently `index < bytes.len()` for this + `usize` index, and that an out-of-bounds call is UB. + - `scope_basis`: `lib.rs` contains this unsafe call and `REQUEST.md` asks for + an implementation soundness audit. + - `dependencies`: none. +- **L2 — Branch fact:** Establish from the actual `if`/`else` control flow that + `bytes.is_empty()` is false on the unsafe-call path, then use the exact + `is_empty` contract to conclude `bytes.len() != 0`. + - `scope_basis`: necessary source-path premise for the requested local proof. + - `dependencies`: none. +- **L3 — Unsigned-domain step:** Establish that the slice length is a `usize` + and, using its nonnegative value domain, derive `bytes.len() > 0` from L2. + - `scope_basis`: necessary material bridge from nonemptiness to safe + subtraction in every supported pointer width. + - `dependencies`: L2. +- **L4 — Defined subtraction:** Establish that `bytes.len() - 1` has no integer + overflow or underflow on this path, including in every ordinary profile. + - `scope_basis`: the source performs built-in integer subtraction before the + unsafe call; its definedness is part of the requested soundness proof. + - `dependencies`: L3. +- **L5 — In-bounds derivation:** Use the assignment + `index = bytes.len() - 1` and ordinary integer arithmetic to derive + `index < bytes.len()`. + - `scope_basis`: the exact proposition needed to discharge L1. + - `dependencies`: L3, L4. +- **L6 — Implementation closure:** Connect L2–L5 to L1 and report the + implementation obligation `PROVED` over the entire stated Rust/target/profile + scope; do not infer implementation failure from comment failure. + - `scope_basis`: `REQUEST.md` explicitly asks for an implementation verdict + over its full scope. + - `dependencies`: L1, L2, L3, L4, L5. +- **L7 — Artifact verdict:** Separately report the existing `SAFETY` comment + materially deficient because its lifetime statement does not address either + the exact in-bounds obligation or the material derivation which discharges + that obligation. + - `scope_basis`: `REQUEST.md` explicitly asks for a separate comment-adequacy + determination. + - `dependencies`: L1, L2, L3, L4, L5. +- **L8 — Replacement proof artifact:** Supply proposed adjacent comment text + which identifies the `get_unchecked` obligation and exposes the L2–L5 chain, + with unambiguous references to the checked authority propositions. + - `scope_basis`: `REQUEST.md` explicitly requests replacement wording when + material reconstruction is needed. + - `dependencies`: L1, L2, L3, L4, L5. +- **L9 — Complete premise inventory:** Inventory every materially consumed + Rust/std premise: `if` branch selection, `is_empty`/length equivalence, + `len`'s type/meaning, `usize`'s value domain, built-in + subtraction/overflow, and `get_unchecked`'s safety contract. Classify the + immediate placement and assignment observations as source facts and the + remaining integer implications as mathematics rather than inventing + authority for them. + - `scope_basis`: `REQUEST.md` explicitly requires a complete Rust-premise + inventory and reconciliation; distinguishing source facts and mathematics + identifies which proof leaves require Rust/std authority. + - `dependencies`: L1, L2, L3, L4, L5. +- **L10 — Exact checked authority:** For every Rust/std entry in L9, give the + matching Rust 1.82.0 narrow URL, quote the exact prose which supplies the + premise, state the verified proposition, and qualify its applicability. Page + identity or an unexamined citation alone does not pass. + - `scope_basis`: `REQUEST.md` explicitly requires version-matched checked + authority and exact extracted propositions. + - `dependencies`: L9. +- **L11 — Reconciliation:** Explicitly reconcile proof to inventory: every + materially consumed Rust/std premise has an L10 entry, every listed entry is + actually consumed, and no TCB assumption or uncited Rust fact silently fills + a link. + - `scope_basis`: `REQUEST.md` explicitly requires this reconciliation and + states that the TCB is empty. + - `dependencies`: L1, L2, L3, L4, L5, L9, L10. + +Score atoms independently. Mathematical implications between stated integer +facts need derivation but no Rust citation. Immediate source syntax may be cited +by source location rather than external authority. + +## Hard errors + +- **LH1:** Report the implementation `UNSOUND` or `UNPROVED` solely because the + existing comment is deficient, despite reconstructing L1–L5 correctly. +- **LH2:** Explicitly call the existing comment adequate. +- **LH3:** Claim the requested implementation proof complete while omitting a + material link from L1–L5. +- **LH4:** Claim the requested authority/premise reconciliation complete while + silently consuming a Rust/std premise, using an inapplicable version, or + treating a page URL as proof without checking the proposition. +- **LH5:** Use build, test, execution, lint, or dynamic-analysis success as a + universal proof of this obligation. + +An omitted artifact verdict fails L7 but is not independently a hard error +unless the report also makes an affirmative false claim covered above. + +## Checked authority + +- Rust 1.82.0 slice `get_unchecked`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked` + — for a `usize` element index, an out-of-bounds call is UB even when the + result is unused; the proof consumes the corresponding `index < len` + requirement. +- Rust 1.82.0 slice `len`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len` + — returns the number of elements as `usize`. +- Rust 1.82.0 slice `is_empty`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty` + — returns true exactly when the slice has length zero. +- Rust 1.82.0 Reference, `if` expressions: + `https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions` + — when the condition evaluates to false, the consequent block is skipped and + the trailing `else` block is executed. +- Rust 1.82.0 Reference, arithmetic operators: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators` + — `-` is built-in subtraction for integer operands. +- Rust 1.82.0 Reference, integer overflow: + `https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow` + — identifies overflow for built-in integer operators and its profile/context + behavior; L3 proves the exceptional case absent here. +- Rust 1.82.0 Reference, unsigned integer value domains: + `https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types` + — `usize` is an unsigned integer type and its values are nonnegative. + +There is no accepted TCB entry for this mode. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/allowlist.txt new file mode 100644 index 0000000000..7c3ef37288 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/allowlist.txt @@ -0,0 +1,7 @@ +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty +https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators +https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow +https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/A.md new file mode 100644 index 0000000000..4182eed1cf --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/A.md @@ -0,0 +1,81 @@ +# Audit of `last` + +## Claim, snapshot, and verdict + +**Soundness verdict: PROVED.** For the exact `lib.rs` supplied with this review, under Rust and standard library 1.82.0, every well-typed safe call to `last` on every target where this source and the used 1.82.0 slice APIs exist, in every ordinary profile, is free of Rust undefined behavior. The caller has no extra safety obligation. `Required(case)` is exactly that predicate over source identity, toolchain/stdlib, target, profile, input slice, and permitted execution. `Required_cfg(c)` is `Rust/std = 1.82.0 ∧ target has the used items ∧ profile ∈ Ordinary`. Audit cutoff: this supplied snapshot, reviewed 2026-08-01. + +The only public/safe surface is `pub fn last(bytes: &[u8]) -> Option<&u8>` (`lib.rs:3-11`). Its only unsafe consumer is `bytes.get_unchecked(index)` at line 10. There are no unsafe declarations, fields, traits/impls, callbacks, macros, hidden APIs, dependencies, FFI, generated artifacts, `cfg` branches, or invariant-bearing state. `#![allow(dead_code)]` does not select or alter code. No documented postcondition or separately requested robustness property exists; the function name is not treated as normative documentation. + +**Proof-artifact verdict: DEFICIENT.** The existing `SAFETY` comment says only that the returned reference cannot outlive `bytes`. That does not establish the actual `get_unchecked` obligation—an in-bounds index—and therefore is not an adequate local proof. The missing derivation is material and is reconstructed below. This is a documentation defect, not an implementation defect. + +TCB log `TCB-LAST-1` consists only of the Rust 1.82.0 authoritative axioms A1-A5 below. There are no additional TCB assumptions, selected dependencies, tools, tests, or implementation/platform premises. This is a source-level result relative to documented Rust abstract semantics, not a compiler-backend or binary certificate. + +## Complete premise inventory + +Each semantic/std premise consumed by the derivation appears here; the remaining steps are inspected source facts or arithmetic/logic. + +**A1 — slice length.** Rust 1.82.0 [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len), signature `pub const fn len(&self) -> usize`: + +> “Returns the number of elements in the slice.” + +Verified proposition: for the input slice, `bytes.len()` is a `usize` equal to its number of elements; call that value `n`. + +**A2 — emptiness observation.** Rust 1.82.0 [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + +> “Returns `true` if the slice has a length of 0.” + +Verified proposition used: `n = 0 ⇒ bytes.is_empty() = true`; hence, by contraposition, `bytes.is_empty() = false ⇒ n ≠ 0`. + +**A3 — branch execution.** Rust 1.82.0 [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + +> “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped. If a condition operand evaluates to `false`, the consequent block is skipped … If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” + +Verified proposition: the unsafe call is reachable only when `bytes.is_empty()` evaluated to false; when it evaluates true, only `None` is evaluated. + +**A4 — `usize` range and subtraction.** Rust 1.82.0 [integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types) states, under “The unsigned integer types consist of,” the table row: + +> `usize` | minimum `0` | maximum `2^w − 1` + +Rust 1.82.0 [binary-operator table](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators) gives the integer meaning of `-` as: + +> “Subtraction” + +and [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow) defines an overflow case as: + +> “When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored.” + +Verified proposition: a nonzero `usize` value `n` lies in `[1, 2^w−1]`; its integer subtraction `n−1` lies in `[0, 2^w−2]`, so `n - 1` does not overflow under any target width or overflow-check/profile setting, and its value is strictly less than `n`. + +**A5 — unsafe operation contract and result.** Rust 1.82.0 [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + +> “Returns a reference to an element or subslice, without doing bounds checking.” + +> “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” + +The same safety section expressly gives `.get_unchecked(len)` as UB. Verified proposition: the caller must supply an in-bounds index; for a `usize` element index of a slice of length `n`, `0 ≤ index < n` discharges that condition, and the result is a reference to that indexed element. + +## Obligation ledger and reconstructed derivation + +**O1, reachability and arithmetic — PROVED over all `Required`.** Let `n = bytes.len()` (A1). A3 says reaching the `else` and unsafe call means the condition was false. A2 then yields `n ≠ 0`. By A4, `n ≥ 1`, `index = n - 1` is evaluated without overflow in every profile, and `0 ≤ index < n`. + +**O2, `get_unchecked` precondition — PROVED over all `Required`.** O1 establishes exactly that `index` is in the slice's bounds. This discharges A5's sole safety condition. A5 supplies a shared reference to element `n-1`; no code, callback, mutation, or unwind point intervenes between computing `index` and the call. + +**O3, other input/control-flow case — PROVED over all `Required`.** If the condition is true, A3 skips the `else`, so no unsafe operation executes and the function evaluates `None`. If false, O1-O2 apply. Boolean truth/falsity exhausts executions, so their union covers every input/execution. + +For each obligation, the derivation is symbolic in target width `w` and profile. Every required configuration selects identical source, and A1-A5 contain no narrower target/profile qualification. Thus each obligation's covered predicate contains `Required`; pointwise intersection across O1-O3 still contains `Required`. This proves `Required ⊆ Covered` and certifies the verdict. Empty, one-element, and maximum-representable-length boundaries respectively take O3, produce index `0`, and produce `n-1` without overflow; none falsifies the proof. + +## Required replacement comment + +```rust +// SAFETY: Reaching this branch means `bytes.is_empty()` was false, so the +// slice length is nonzero. Therefore `index = bytes.len() - 1` does not +// overflow and satisfies `index < bytes.len()`, making it in bounds as +// required by `slice::get_unchecked`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +This is the minimum acceptable repair: it names the callee obligation, the dominating branch fact, the arithmetic derivation, and the conclusion. The old lifetime sentence may be omitted because it does not discharge an unsafe precondition. + +## Residual scope and review triggers + +Nothing within the requested source-level domain remains uncovered. No target was built or executed, as required. Re-audit if the function, comment, signature, slice APIs/contracts, Rust/stdlib version, target-availability predicate, or profile scope changes. Compiler code generation, custom backend correctness, binaries, and behavior beyond any documented postcondition are outside this source review. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/B.md new file mode 100644 index 0000000000..48a8fee2d5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/B.md @@ -0,0 +1,65 @@ +# `last` source review + +## Claim and verdict + +**Implementation soundness: PROVED.** For the exact `target/lib.rs` supplied, every well-typed safe call to `last` is free of Rust undefined behavior under Rust 1.82.0 documented abstract semantics, on every target where this source and the used Rust 1.82.0 standard-library items exist, in every ordinary profile. There is no caller safety precondition and no additional TCB assumption. + +**Existing `SAFETY` comment: deficient.** It discusses the result's lifetime, but `get_unchecked`'s material safety obligation is that the index not be out of bounds. The comment gives none of the branch-and-arithmetic derivation needed to establish that obligation. The missing derivation can be reconstructed, so this is a proof-artifact defect, not an implementation defect. + +There are no documented postconditions on `last` and no additional robustness claim in the request; consequently no separate postcondition verdict is required. + +## Snapshot, boundary, and domain closure + +Scope is exactly `target/lib.rs`, lines 1–11. The sole language-reachable API surface is safe public free function `last(bytes: &[u8]) -> Option<&u8>`. Its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors for an invariant-bearing type, traits or impls, callbacks, macros, generated code, dependencies, `cfg`s, FFI, concurrency, allocation, or other unsafe sites. The only transient invariant is `INV-N`: in the `else` branch, for the unchanged receiver `bytes`, `n = bytes.len() > 0`. + +The request directly defines + +`Required = {exact source} × {Rust/std 1.82.0} × {targets on which the source and used items exist} × {ordinary profiles}`. + +No normalization, exclusion, or finite target inventory is used. The proof below is parametric in the target-dependent `usize` value `n`; it assumes no pointer width. Profile-dependent overflow handling is immaterial because the subtraction is proved not to overflow. The source contains no configuration selection. Thus every premise applies throughout `Required`, `Covered = Required`, and `Required ⊆ Covered`. + +No build, test, execution, expansion, or tool-derived evidence was used. This is a source-level result, not a claim about a particular compiler binary or backend. + +## Obligation ledger and reconstructed proof + +`OBL-1` (line 7, all of `Required`): prove `bytes.len() - 1` does not underflow or panic and produces `index = n - 1`. **PROVED.** + +`OBL-2` (line 9, all of `Required`): prove `index` is not out of bounds for the same `bytes` passed to `get_unchecked`. **PROVED.** + +Derivation: + +1. Let `q` be the boolean returned by `bytes.is_empty()` at line 4. Execution reaches the `else` block only when `q = false` (AX-IF). +2. AX-EMPTY says `bytes.len() = 0 -> q = true`; by contraposition, `q = false -> bytes.len() != 0`. Both observations concern the same shared slice value, with no intervening mutation, call, callback, or state transition. Set `n = bytes.len()` at line 7, so `n != 0`. +3. `len` returns a `usize` and counts elements (AX-LEN). `usize` is unsigned (AX-USIZE), hence `n != 0` gives `n >= 1`. +4. Binary `-` on these primitive integer operands is subtraction (AX-SUB). Therefore line 7 computes `n - 1`. Since `n >= 1`, the result is nonnegative and no greater than the already representable `n`; it is representable as `usize`. It is not less than the type minimum, so AX-OVERFLOW's underflow case cannot occur under any ordinary overflow-check setting. Thus `index = n - 1` and `0 <= index < n`. +5. `n` is the number of elements of this same `bytes`, so `index` is in bounds. This discharges the sole documented `get_unchecked` safety requirement (AX-GET). The standard-library contract then supplies the returned shared reference. No later unsafe consumer exists. + +The empty case never evaluates the `else` block, subtraction, or unsafe call. Hence `OBL-1` and `OBL-2` cover all reachable unsafe executions, and the implementation certificate is complete. + +## Complete authoritative-premise inventory + +All entries are Rust 1.82.0 axioms, apply on every target/profile in `Required`, and were verified on the linked versioned page. Quotations are the exact minimal prose fragments consumed. + +- **AX-EMPTY** — [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “Returns `true` if … length of 0.” Verified proposition: zero length implies the returned boolean is true. Used in step 2. +- **AX-LEN** — [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “Returns the number of elements”. Together with the displayed return type `usize`, verified proposition: `bytes.len()` is the element count represented as `usize`. Used in steps 2–5. +- **AX-IF** — [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this single-condition `else` runs only for a false condition. Used in step 1 and to exclude unsafe evaluation on the empty branch. +- **AX-USIZE** — [numeric integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The `usize` type is an unsigned integer type”. Verified proposition: `usize` values are nonnegative target-width integers. Used in steps 3–4. +- **AX-SUB** — [arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): the primitive-integer `-` entry is “Subtraction”. Verified proposition: line 7 performs integer subtraction. Used in step 4. +- **AX-OVERFLOW** — [overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): binary subtraction overflows when it creates a value “less than the minimum value that can be stored”. Verified proposition: unsigned subtraction underflow is overflow; because the mathematical result is representable here, profile-controlled overflow behavior is unreachable. Used in step 4 and configuration closure. +- **AX-GET** — [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “Returns a reference to an element or subslice”; “out-of-bounds index is undefined behavior”. Verified proposition: the operation supplies an element reference without bounds checking, and its unsafe-call obligation is that the numeric index be in bounds. Used in step 5. + +No other Rust semantic or standard-library proposition is materially consumed. In particular, the existing comment's lifetime assertion is not a precondition of `get_unchecked` and plays no role in the derivation. Every inventoried entry has a consumer above, and every nonlocal premise used above appears in this inventory. The TCB contains these authoritative Rust/std axioms only; there are no dependency, implementation, external-specification, deployment, tool, or out-of-band assumptions. + +## Finding and replacement comment + +**DOC-1 — inadequate local proof (implementation remains PROVED).** The current comment does not identify `get_unchecked`'s bounds obligation, the dominating false `is_empty` branch, the non-underflowing subtraction, or the conclusion `index < bytes.len()`. Replace it with: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() > 0`. Thus subtracting 1 cannot underflow and produces +// `index < bytes.len()` for this same slice, so `index` is in bounds as +// required by `get_unchecked`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +This repair changes proof documentation only; it neither adds a caller obligation nor changes behavior. Re-audit if the source, function contract, support domain, Rust/std version, cited contracts, or overflow/index computation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/C.md new file mode 100644 index 0000000000..70e6c68c71 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/C.md @@ -0,0 +1,64 @@ +# Unsafe Rust review: `last` + +## Claim and verdict + +**Implementation soundness: PROVED.** For the exact `lib.rs`, every well-typed safe call to `last` is free of Rust undefined behavior under Rust and standard library 1.82.0 abstract semantics, on every target where this source and the used standard-library items exist, in every ordinary profile. This result is relative only to `TCB-R182-v1` below; there are no additional TCB assumptions. + +**Existing proof artifact: DEFICIENT.** The `SAFETY` comment does not establish the actual `get_unchecked` precondition. A material bounds-and-arithmetic derivation had to be reconstructed below. This is a documentation finding, not an implementation defect. + +No caller-facing postcondition is documented in the source. The derivation nevertheless establishes the implementation behavior: an empty slice produces `None`; a nonempty slice of length `L` produces `Some` referencing element `L - 1`. + +## Snapshot, boundary, and domain + +The reviewed artifact is the complete supplied `lib.rs`; no generated artifact, dependency, build script, macro-generated API, FFI, allocator, concurrency mechanism, target feature, or conditional source exists in scope. The only external safe surface is `pub fn last(bytes: &[u8]) -> Option<&u8>`. Its only unsafe obligation site is `bytes.get_unchecked(index)` at `lib.rs:10`. There is no representation invariant or unsafe public contract. + +Let `Required(c)` mean: `c` uses this exact source, Rust/stdlib 1.82.0, an eligible target, an ordinary profile, any valid `&[u8]` (all contents, lengths, and lifetimes), and any permitted execution. Its configuration projection is + +`Required_cfg = { (Rust 1.82.0, eligible target, ordinary profile) }`, + +where “eligible” and “ordinary” retain the request's symbolic predicates. This is an identity normalization of the controlling request: each direction follows by the same conjuncts; no target/profile is enumerated or excluded by the audit. + +## Rust 1.82 authority inventory (`TCB-R182-v1`) + +Each entry applies to all `Required` cases and is consumed below. Quotations are from the exact versioned page. + +- **AX-IF.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped.” Also: “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: with this single condition, the unsafe-containing `else` is reached only for a false condition. + +- **AX-EMPTY.** [`is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “Returns true if the slice has a length of 0.” Verified proposition: length zero implies `is_empty()` is true; contrapositively, a false result implies nonzero length. + +- **AX-LEN.** [`len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “Returns the number of elements in the slice.” Its displayed signature returns `usize`. Verified proposition: `bytes.len()` is the element count `L`, represented as `usize`. + +- **AX-USIZE.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): the unsigned-integer table gives the `usize` row as minimum `0` and maximum `2^ptr_size − 1`. Verified proposition: every `usize`, hence `L`, lies in that inclusive range. + +- **AX-SUB.** [Arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): the operator table identifies “`-` Subtraction.” Verified proposition: binary `-` computes subtraction subject to the documented overflow rules. + +- **AX-OVERFLOW.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): “The following things are considered to be overflow: When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored.” Verified proposition: `L - 1` does not overflow when its mathematical result remains in the `usize` range; profile-dependent overflow handling is then irrelevant. + +- **AX-GET.** [`get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “Returns a reference to an element or subslice, without doing bounds checking.” Safety: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” Verified proposition: the caller must supply an in-bounds index; for a permitted call with `usize`, the result is the referenced element under the displayed shared-reference signature. + +These are authoritative Rust axioms, not added environmental or implementation assumptions. There are no safe/unsafe dependencies, external specifications, tool results, compiler-backend claims, or pending TCB entries. + +## Reconstructed proof and obligation ledger + +Let `L` be the element count returned by `bytes.len()` (AX-LEN). Both method calls inspect the same unchanged local slice value; there is no reassignment, callback, or intervening transition. + +1. If `bytes.is_empty()` is true, AX-IF selects the consequent, which returns `None`; the unsafe operation is not reached. +2. If the unsafe operation is reached, AX-IF says the condition was false. AX-EMPTY's `L = 0 -> true` gives, by contraposition, `L != 0`. +3. AX-USIZE gives `L >= 0`; together with `L != 0`, this gives `1 <= L`. Therefore the mathematical result `L - 1` lies in `[0, L)` and also in the `usize` range. +4. AX-SUB and AX-OVERFLOW therefore establish that `index = bytes.len() - 1` is exactly that mathematical result without underflow in every ordinary profile. Hence `index < bytes.len()`. +5. Thus `index` is in bounds, discharging AX-GET's sole documented safety requirement. AX-GET returns the element reference, and safe `Some` construction returns it. No raw reference is constructed or lifetime extended by this function; the local and standard-library signatures carry the shared borrow. + +The two boolean cases are exhaustive. The proof is parametric in slice contents, lifetime, `usize` width, eligible target, and ordinary profile. There is no `cfg` or generated/source-selection stage, and the one profile-sensitive arithmetic operation cannot overflow. Consequently every `Required` case is covered: `Covered = Required`, which certifies `Required ⊆ Covered`. + +## Finding DOC-1: inadequate adjacent proof + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not mention `index`, bounds, nonemptiness, or subtraction. Even if its lifetime statement is true, it does not entail the actual AX-GET precondition. Replace it with: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// Thus `bytes.len() != 0`, so `index = bytes.len() - 1` is representable +// and satisfies `index < bytes.len()`. Therefore `index` is in bounds, +// as required by `get_unchecked`. +``` + +Minimum resolution is this proof-artifact change; the implementation need not change. Re-audit if the function/control flow, used Rust contracts, Rust version, support predicate, or arithmetic/indexing operation changes. Binary/compiler correctness and behavior not documented by this source remain outside this source-level review. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/D.md new file mode 100644 index 0000000000..5828e73a5a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/D.md @@ -0,0 +1,134 @@ +# Source review: `last` + +## Claim and verdicts + +Snapshot: the complete supplied `target/lib.rs`, specifically safe public function +`last` at lines 3–10 and its sole unsafe operation at line 9. Review date/cutoff: +2026-08-01. No generated code, dependencies, build scripts, FFI, macros, traits, +mutable state, or prior audit are present in the supplied artifact. + +**Soundness — PROVED.** For Rust 1.82.0, every well-typed safe call +`last(bytes)` on every target where this source and the cited Rust 1.82.0 slice +APIs exist, in every ordinary profile, is free of Rust undefined behavior. This +is a source-level result under documented Rust abstract semantics. + +**Existing `SAFETY` comment — deficient.** It states a return-lifetime fact but +does not state or prove the only material caller obligation of the unsafe call: +that `index` is in bounds. The missing bounds derivation is material and is +reconstructed below. This documentation defect does not change the separately +proved implementation verdict. + +There is no documented caller-facing postcondition in the supplied source, so +there is no separate mandatory postcondition verdict. No additional robustness +claim was requested. TCB `TCB-LAST-R1` consists only of the Rust 1.82.0 +authoritative axioms inventoried below; there are no additional assumptions. + +## Domain, boundary, and coverage + +Let + +`Required = {Rust 1.82.0} × {every target where the exact source and used 1.82.0 std items exist} × {every ordinary profile} × {every valid &[u8] value}`. + +This is the controlling expression supplied by `REQUEST.md`; no normalization, +enumeration, or exclusion is applied. The only language-reachable in-scope API +surface is safe free function `last`. Its caller is adversarial subject only to +well-typed safe use. The only unsafe consumer is +`bytes.get_unchecked(index)`. There is no representation invariant beyond the +valid slice/reference properties enforced at the input type boundary. + +The proof below is parametric in slice length, target `usize` width, and profile. +The source has no conditional compilation. It proves the same obligation for +every member of `Required`; hence `Covered = Required` and +`Required ⊆ Covered`. In particular, the subtraction is proved non-overflowing, +so profile-dependent overflow handling is unreachable and immaterial. + +## Authoritative premise inventory (`TCB-LAST-R1`) + +All entries apply exactly to Rust 1.82.0 and to the full required target/profile +domain. Each is accepted solely as version-matched Rust standard-library or +Reference authority. These, and only these, are the non-local premises consumed +by the derivation. + +- **A1 — unchecked slice access.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “Returns a reference to an element or subslice, without doing bounds + checking.” Its Safety section says: “Calling this method with an + out-of-bounds index is undefined behavior even if the resulting reference is + not used.” Verified proposition: a `usize` call must use an in-bounds element + index; with that obligation met, the shown `&self -> &Output` API returns a + reference to that element. + +- **A2 — slice length.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “Returns the number of elements in the slice.” Its displayed return type is + `usize`. Verified proposition: `bytes.len()` is the slice's element count `n` + represented as `usize`. + +- **A3 — emptiness test.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “Returns `true` if the slice has a length of 0.” Verified proposition: + `bytes.is_empty()` reports whether the same slice's element count is zero; + therefore a false result means `n != 0`. + +- **A4 — selected `if` arm.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “If all `if` and `else if` conditions evaluate to false then any `else` block + is executed.” Verified proposition: execution of lines 7–9 implies that the + line-4 condition evaluated to false; the unsafe call is not executed on the + true/empty path. + +- **A5 — `usize` lower bound.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + the unsigned-integer table gives `usize` minimum `0` (and maximum + `2^ptr_size - 1`). Verified proposition: every `usize`, including `n`, is + nonnegative; thus `n != 0` implies `n >= 1` on every target width. + +- **A6 — subtraction and overflow boundary.** [Arithmetic binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators) + identifies binary `-` as “Subtraction.” [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow) + includes: “When `+`, `*` or binary `-` create a value greater than the maximum + value, or less than the minimum value that can be stored.” Verified + proposition: for `usize n >= 1`, `n - 1` is the mathematical difference, + lies in `usize`'s range, and does not overflow in any ordinary profile. + +Reconciliation: A4 and A3 establish non-emptiness; A2 and A5 turn it into the +integer bound; A6 establishes the exact index without overflow; A1 consumes the +resulting in-bounds fact and supplies the reference. No cited premise is unused. + +## Obligation ledger and reconstructed proof + +**O1, empty path (lines 4–5): PROVED.** By A4, when the condition is true only +the consequent path is selected. It returns `None` and executes no unsafe +operation. + +**O2, arithmetic (line 7): PROVED.** Let `n = bytes.len()` (A2). Reaching the +`else` proves `is_empty() == false` (A4), hence `n != 0` (A3). Since `n: usize` +and its minimum is zero (A5), `n >= 1`. Therefore `n - 1` is representable and +non-overflowing by A6, and line 7 establishes `index = n - 1`. + +**O3, `get_unchecked` (line 9): PROVED.** From O2, +`0 <= index = n - 1 < n = bytes.len()`. Thus `index` denotes an element within +`bytes`, satisfying A1's safety obligation. A1 then supplies a reference to that +element. The call neither mutates the slice nor crosses an intervening call, +callback, unwind point, or state transition. Its displayed borrow-returning +signature, composed with `last`'s borrow-returning signature, carries the +reference rather than fabricating or extending one. Wrapping that reference in +`Some` introduces no further unsafe operation. + +The intersection of O1–O3 coverage is all of `Required`, establishing the +soundness certificate stated above. + +## Finding DOC-PROOF-1 and replacement text + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not +name `get_unchecked`'s bounds requirement and supplies none of O2/O3. Moreover, +the lifetime statement is not the caller obligation identified by A1. A local +reviewer must reconstruct the branch, zero-length, unsigned-arithmetic, and +bounds chain to validate the unsafe call. + +Minimal replacement comment: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false, so +// `bytes.len() != 0`. Therefore `index = bytes.len() - 1` is representable and +// satisfies `index < bytes.len()`, making `index` in bounds for `bytes`. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Required resolution is documentation-only; `lib.rs` was not edited. Re-audit +this result if the function, unsafe call contract, Rust version, supported +domain, or any cited authoritative text changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/E.md new file mode 100644 index 0000000000..20a88bcf47 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/E.md @@ -0,0 +1,51 @@ +# Review of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, every well-typed safe call to `last` is free of Rust undefined behavior under Rust and standard library 1.82.0, for every input `bytes: &[u8]`, every target on which this source and the used 1.82.0 slice APIs exist, and every ordinary profile. The result uses only the authoritative 1.82.0 axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** The comment's lifetime statement is not the safety precondition documented for `get_unchecked`. It omits the material derivation that `index` is in bounds. The implementation verdict and proof-artifact verdict are therefore intentionally different. + +There is no documented caller precondition or documented postcondition on `last` itself. The documented `get_unchecked` result guarantee consumed by the wrapper is proved below. + +## Domain and surface closure + +Let `Required(case)` mean: exact supplied source; Rust/stdlib 1.82.0; any target where the source and `is_empty`, `len`, and `get_unchecked` exist; any ordinary profile; and any well-typed safe call with any valid shared byte slice and permitted execution. Its configuration projection changes none of the source: there is no `cfg`, feature, generated code, dependency, FFI, allocator, concurrency, or target-specific operation. The sole language-reachable surface in scope is the public safe free function `last`; its only unsafe obligation site is `bytes.get_unchecked(index)`. + +Partition every required case by the natural number `n = bytes.len()`: `n = 0` or `n != 0`. These cases are exhaustive and the proof below is parametric in target and profile. Thus their union covers every configuration fiber and every input; the aggregate `Covered` predicate equals `Required` for the in-scope soundness obligation. + +## Reconstructed proof and obligation ledger + +**O1 — empty path.** If `bytes.is_empty()` evaluates to true, `if` semantics executes the consequent and skips the `else`. The function returns `None` and never reaches an unsafe operation. This path is covered. + +**O2 — `get_unchecked` precondition.** On the `else` path, `if` semantics establishes that `bytes.is_empty()` evaluated to false. Axiom A1 states `n = 0 -> is_empty() = true`; its contrapositive gives `is_empty() != true -> n != 0`. A2 identifies `n` as the number of slice elements, hence a natural number, so `n != 0` gives `n >= 1`. Consequently the source assignment computes the representable value `index = n - 1`, with `0 <= index < n`. It is therefore not an out-of-bounds index, discharging A4's exact unsafe-call requirement. There is no underflow, so no overflow-check or optimization profile creates another case. + +**O3 — consumed callee result.** By A4, the in-bounds call returns a reference to the selected element; with `index = n - 1`, that is the final element. The callee and wrapper signatures carry the returned shared reference from the input borrow, so no hidden caller obligation is introduced. `Some` wraps that reference. This establishes every documented callee postcondition consumed here. + +O1 and O2 cover the exhaustive partition; O3 establishes the consumed result on O2. Therefore `Required subseteq Covered`, certifying the stated `PROVED` verdict. No test, build, compiler-backend claim, or unlisted premise participates. + +## Authoritative premise inventory and reconciliation + +All quotations and links are version-matched to 1.82.0 and apply throughout the required target/profile domain where the respective item exists. + +- **A1 (`slice::is_empty`).** The documentation says it returns “true if the slice has a length of 0.” [Rust 1.82.0 `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition: for this slice, `len = 0 -> is_empty() = true`. O2 consumes its contrapositive. +- **A2 (`slice::len`).** It returns the “number of elements in the slice.” [Rust 1.82.0 `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition: `n = bytes.len()` is exactly the slice's element count. O2 consumes it. +- **A3 (`if`).** “If a condition operand evaluates to false, the consequent block is skipped”. [Rust 1.82.0 `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Together with the same paragraph's branch rules, this verifies that only the true condition reaches O1 and only the false condition reaches the `else` containing O2. +- **A4 (`slice::get_unchecked`).** The contract identifies an “out-of-bounds index” as “undefined behavior” and says the method returns a “reference to an element”. [Rust 1.82.0 `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified propositions: the call must use an in-bounds index even if the result were unused, and an admitted `usize` index returns a reference to its element. O2 consumes the former; O3 consumes the latter. + +This list is complete for the derivation. The exhaustive two-case split, contrapositive, and `n >= 1 -> 0 <= n - 1 < n` are mathematical steps. Branch reachability and assignments are inspected local source facts. No overflow behavior, integer-width bound, target property, lifetime promise beyond the checked signatures, dependency behavior, or external specification is silently consumed; accordingly, unused allowlisted pages are not cited. + +## Finding and replacement comment + +The existing comment—“The returned reference cannot outlive `bytes`.”—does not mention A4's bounds obligation and does not connect the dominating branch to `len() - 1`. Removing the reconstructed A1/A3-to-bounds argument leaves no local proof of the unsafe precondition, so the omission is material. The statement is compatible with the typed signatures, but it is not an adequate `SAFETY` proof. + +Replace it with: + +```rust +// SAFETY: This `else` branch is reached only when `bytes.is_empty()` is +// false. Therefore `bytes.len() != 0`, so `index = bytes.len() - 1` is +// representable and satisfies `index < bytes.len()`. Thus `index` is in +// bounds, as required by `slice::get_unchecked`. +``` + +Re-audit if the source, function/callee contracts, Rust version, supported configuration predicate, or any cited 1.82.0 documentation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/F.md new file mode 100644 index 0000000000..0d4148584a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/F.md @@ -0,0 +1,59 @@ +# Audit of `last` + +## Claim, scope, and verdict + +**Implementation soundness: PROVED.** For the exact `lib.rs` supplied, Rust and standard library 1.82.0, every target on which this source and the used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)` with any valid shared slice, execution introduces no Rust undefined behavior. The proof is relative only to the Rust 1.82.0 authoritative axioms inventoried below; there are no additional TCB assumptions. + +**Existing `SAFETY` comment: deficient.** “The returned reference cannot outlive `bytes`” does not establish the only documented safety obligation of the executed `get_unchecked(index)`: that `index` is not out of bounds. A material bounds derivation had to be reconstructed. This is a proof-artifact defect, not an implementation defect. + +No caller safety precondition is permitted or needed. `last` has no documented postcondition, so there is no separate mandatory postcondition verdict. No tests, builds, execution, expansion, prior audit, dependency claim, or tool-derived evidence is used. + +## Domain and surface closure + +Let + +`Required = { (this exact source, Rust/std 1.82.0, target t, ordinary profile p, valid &[u8] value B, permitted execution e) | the source and its used std items exist on t }`. + +This is the request's controlling expression, preserved without enumeration or exclusion. Its configuration projection fixes Rust/std to 1.82.0 and otherwise quantifies over those `t` and `p`. The complete language-reachable in-scope surface is the safe public free function `last`; it accepts a caller-controlled shared slice. The sole unsafe site is `bytes.get_unchecked(index)`. There are no fields, constructors, traits or impls, callbacks, macros, generated items, dependencies, `cfg`s, FFI, concurrency, allocators, or invariant-bearing state in the supplied source. + +The two Boolean outcomes of `bytes.is_empty()` are exhaustive. The proof below is parametric in target and profile: the same source is selected, no target fact is used, and the subtraction is proved non-overflowing rather than relying on profile overflow behavior. Thus each required configuration fiber is covered. With `Covered` equal to the union of the two branch cases for the sole unsafe-backed safe surface, `Required ⊆ Covered`. + +## Reconstructed local proof and obligation ledger + +Fix an arbitrary required case and write `L = bytes.len()`. + +1. If `bytes.is_empty()` is true, the `if` consequent executes and returns `None`; the unsafe call is not reached. +2. If it is false, the `else` executes. AX-EMPTY states that length zero implies `is_empty() == true`; contraposition gives `L ≠ 0`. AX-LEN identifies `L` as the number of slice elements, hence a natural count, so `L ≥ 1`. +3. Therefore `I = L - 1` is representable, cannot underflow, and satisfies `0 ≤ I < L`. This is ordinary predecessor arithmetic applied to the locally obtained element count; it is independent of overflow-check and optimization settings. +4. Consequently `I` denotes the last of the `L` elements and is not out of bounds for this same slice. This discharges AX-UNCHECKED's exact safety condition before the call. No operation can change the slice or `L` between the check, length reads, and call. +5. `get_unchecked`'s expression type is a shared reference, and the enclosing well-typed safe function returns it inside `Option`; no caller-supplied behavior or hidden obligation intervenes. + +Obligation dispositions: branch reachability—proved by AX-IF; nonzero length—proved by AX-EMPTY and AX-LEN; subtraction representability and `I < L`—proved by the local facts plus predecessor arithmetic; `get_unchecked` in-bounds precondition—proved; safe-surface soundness—proved by the exhaustive branch union. There are no remaining obligations or uncovered cases. + +## Authoritative-premise inventory and reconciliation + +All entries apply exactly to Rust/std 1.82.0, all targets where the cited item exists, and every ordinary profile. Each is accepted as authoritative Rust documentation, consumed exactly where identified above, and must be rechecked if Rust/std or the cited text changes. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Verified proposition: `bytes.len()` returns the slice's element count as `usize`. Consumer: steps 2–3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Verified proposition: if `L = 0`, `bytes.is_empty()` evaluates to true. Consumer: step 2. +- **AX-IF.** [Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” Verified proposition: this `else` body, and hence the unsafe call, is reached only in the false-condition case; the true case executes the consequent instead. Consumers: steps 1–2 and branch exhaustiveness. +- **AX-UNCHECKED.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “with an out-of-bounds index is undefined behavior”. Verified proposition: the call requires its `usize` index not to be out of bounds for the receiver slice. Consumer: step 4. + +The remaining inputs are inspected-source facts and elementary logic/arithmetic: the dominating branch, assignments `L` and `I`, absence of intervening mutation/calls, contraposition, and the predecessor lemma for a positive element count. No other Rust semantic or standard-library proposition is consumed. In particular, the existing lifetime sentence is not used to discharge `get_unchecked`'s safety condition. + +## Required proof-artifact repair + +Replace the existing comment with: + +```rust +// SAFETY: This `else` executes only when `bytes.is_empty()` is false. +// Since `is_empty()` returns true for a zero-length slice, `bytes.len()` is +// nonzero. Thus `index = bytes.len() - 1` is representable and is strictly +// less than `bytes.len()`, so it is in bounds for this same slice. +``` + +This states the operation's controlling obligation, the dominating local fact, the derivation, and the resulting in-bounds proposition adjacent to the unsafe call. + +## Residual scope and review triggers + +Excluded because the request does not include them: undocumented behavioral robustness, compiler/backend or binary correctness, nonordinary profiles, other Rust/std versions, and targets where the source or used items do not exist. Re-audit on any change to `last`, its signature or documentation, the supported version/configuration predicate, or any consumed Rust/std contract. Independent review was not performed. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/G.md new file mode 100644 index 0000000000..1ec57594c3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/G.md @@ -0,0 +1,53 @@ +# Source audit: `lib.rs::last` + +## Claim and verdict + +**Implementation soundness: PROVED.** For the supplied 11-line `lib.rs`, every well-typed safe call to `last(bytes: &[u8])` under Rust/standard library 1.82.0 is free of Rust undefined behavior. `Required` is exactly the requested product of: Rust 1.82.0; every target on which this source and the used 1.82.0 slice items exist; every ordinary profile; and every valid `&[u8]` argument. The proof is source-level under documented Rust abstract semantics. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” is an accurate type/lifetime observation, but it does not establish the actual caller obligation of `get_unchecked`: that `index` is in bounds. Closing the implementation proof requires the material reconstruction below. This is a proof-artifact defect, not an implementation defect. + +There is no caller-side safety precondition: `last` is public and safe. It has no documented behavioral postcondition, so none is silently inferred from its name. No additional robustness property is in scope. + +## Surface, snapshot, and domain closure + +The complete target contains only `#![allow(dead_code)]` and the public safe free function `last`; its sole unsafe operation is `bytes.get_unchecked(index)` at line 9. There are no fields, constructors, traits/impls, macros, generated artifacts, dependencies, callbacks, `cfg`s, target-specific operations, mutable state, or representation invariants. + +The only profile-sensitive candidate is subtraction overflow. The proof below establishes mathematically that it cannot overflow, so overflow-check configuration, optimization, and debug assertions do not change coverage. Pointer width changes `usize`'s maximum but not the parametric argument. Consequently `Covered = Required`, proving `Required ⊆ Covered` without enumerating targets or profiles. No target was built, tested, executed, or expanded. + +## Authoritative premise inventory (Rust 1.82.0) + +These are all Rust/std premises consumed; each link is version-matched. The quoted excerpt is the minimum supplying the proposition. + +1. **A1 — `get_unchecked` safety.** [Slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): “out-of-bounds index is undefined behavior”. Proposition: the unsafe call requires its `usize` index to be in bounds (even non-use of the result would not cure an out-of-bounds call). Consumer: OBL-1. +2. **A2 — length.** [Slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): “number of elements in the slice”. Proposition: `bytes.len()` equals the slice's element count. Consumers: OBL-1 and the bounds normalization. +3. **A3 — empty test.** [Slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): “true if the slice has a length of 0”. Proposition: length zero implies `is_empty() == true`; its contrapositive is consumed. Consumer: OBL-1. +4. **A4 — branch selection.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): “If all if and else if conditions evaluate to false then any else block is executed.” Proposition: reaching lines 7–9 means `bytes.is_empty()` evaluated false. Consumer: OBL-1. +5. **A5 — binary minus.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): “- Subtraction”. Proposition: binary `-` on primitive integers denotes subtraction. Consumer: OBL-1. +6. **A6 — subtraction overflow criterion.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): “binary - create a value greater than the maximum value, or less than the minimum value that can be stored.” Proposition: binary subtraction overflows when its mathematical result lies outside the integer type's range. Consumer: OBL-1 and profile closure. +7. **A7 — `usize` domain.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): “The usize type is an unsigned integer type”. Proposition: `usize` values are nonnegative integers (with target-dependent width). Consumer: OBL-1 and target closure. + +Facts read directly from the checked source/type signatures—`bytes: &[u8]`, `index: usize`, the shared-reference result, and the returned lifetime being limited by the sole input borrow—are local, compiler-enforced type facts rather than extra admitted premises. The TCB is **TCB-LAST-1**: exactly A1–A7 as authoritative Rust 1.82.0 axioms; no safe/unsafe dependencies, implementation assumptions, external specifications, tools, deployment restrictions, or other assumptions. + +## Obligation ledger and reconstructed proof + +**OBL-1 (line 9): satisfy A1 for every input/configuration.** Let `n = bytes.len()` (A2). + +* If `bytes.is_empty()` is true, the first branch returns `None`; subtraction and the unsafe call are not executed (source plus A4). There is no unsafe obligation. +* Otherwise A4 gives `is_empty() == false`. If `n` were zero, A3 would make it true; hence `n != 0`. Because `n: usize` is unsigned (A7), `n >= 1`. +* By A5, line 7 computes the mathematical value `i = n - 1`. Thus `0 <= i < n`; since `n` itself is representable, `i` is also within the `usize` range. A6 therefore rules out subtraction overflow in every ordinary profile. +* A2 says the slice has exactly `n` elements. The integer positions of an `n`-element sequence are `0..n`, so `0 <= i < n` makes `i` in bounds. This discharges A1 before `get_unchecked(i)` executes. The shared result is tied by the method and function signatures to the `bytes` borrow, so returning it introduces no hidden lifetime or mutation obligation. + +Every path is covered, and no premise appears above without a consumer or is consumed without appearing in A1–A7. + +## Required replacement comment + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice is empty, so `bytes.len() != 0`. Therefore +// `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, making `index` in bounds for `get_unchecked`. +// The returned shared reference remains bounded by the `bytes` borrow. +Some(unsafe { bytes.get_unchecked(index) }) +``` + +Review must be repeated if `last`, its signature/comment, Rust/std version, used std contracts, or the requested target/profile domain changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/H.md new file mode 100644 index 0000000000..379631973b --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/H.md @@ -0,0 +1,98 @@ +# Source review: `last` + +## Claim, snapshot, and verdicts + +Audited artifact: the exact `target/lib.rs` supplied for this review, containing one public safe function, `pub fn last(bytes: &[u8]) -> Option<&u8>`, and one unsafe operation, `bytes.get_unchecked(index)`. No generated code, dependencies, features, `cfg`, macros, FFI, traits, mutable state, or other API surfaces occur in the supplied target. + +**Soundness — PROVED.** For Rust and standard library 1.82.0, every target on which this exact source and the used standard-library items exist, every ordinary profile, and every well-typed safe call with any valid `&[u8]`, every execution of `last` is free of Rust undefined behavior under the documented Rust abstract semantics. There is no caller-side safety precondition. + +**Existing proof artifact — DEFICIENT.** The comment “The returned reference cannot outlive `bytes`” states a type-enforced lifetime property, but does not establish the sole safety precondition of the executed unsafe call: that `index` is in bounds. A material bounds-and-arithmetic derivation had to be reconstructed below. This is a documentation defect, not an implementation defect. + +There is no source documentation specifying a caller-facing behavioral postcondition, so no separate documented-postcondition verdict is in scope. The standard-library return guarantee consumed by the soundness proof is covered below. + +## Domain and boundary closure + +Let `Required = {Rust/stdlib = 1.82.0} × {targets where this source and these items exist} × {ordinary profiles} × {all valid &[u8] inputs}`. This is the controlling expression stated by `REQUEST.md`; no normalization, exclusion, release interpolation, or finite target enumeration is used. + +The only safe surface is `last`; its input type enforces a valid shared slice reference and its return type carries a shared element reference. The only unsafe consumer is `get_unchecked`. There is no invariant-bearing stored state. The local relation is that `n = bytes.len()` and `index = n - 1`, with the unchanged `bytes` value used as the call receiver. + +Coverage partitions executions by the Boolean result of `bytes.is_empty()`, an exhaustive partition. The `true` case executes no unsafe operation. The `false` case is proved parametrically below for every slice length and every target pointer width. Because subtraction is proved non-overflowing, profile-dependent overflow checking is irrelevant. Thus `Covered = Required`, establishing `Required ⊆ Covered`. + +## Authoritative premise inventory (Rust 1.82.0 only) + +Each entry is an accepted, version-matched Rust axiom; its exact proposition is stated after the quotation. + +**A-GET.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + +> “Returns a reference to an element or subslice, without doing bounds checking.” +> +> “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” + +Proposition: for the `usize` call here, the caller must establish that `index` selects an element of this slice; when it does, the method returns a reference to that element. Consumed by O3–O4. + +**A-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len), whose displayed signature returns `usize`: + +> “Returns the number of elements in the slice.” + +Proposition: `n = bytes.len()` is the slice's element count and has type `usize`. Consumed by O1–O4. + +**A-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + +> “Returns `true` if the slice has a length of 0.” + +Proposition: `bytes.len() = 0` implies `bytes.is_empty() = true`; contraposition permits a false result to establish nonzero length. Consumed by O1. + +**A-IF.** [if expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + +> “If a condition operand evaluates to `true`, the consequent block is executed and any subsequent `else if` or `else` block is skipped.” +> +> “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” + +Proposition: reaching this `else` block establishes that `bytes.is_empty()` evaluated to false; the other branch contains no unsafe call. Consumed by O1 and coverage. + +**A-SUB.** [arithmetic and logical binary operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): + +> “Operators are defined for built in types by the Rust language.” + +The table specifies binary `-` on integers as “Subtraction.” Proposition: the `usize` expression `n - 1` is integer subtraction when representable. Consumed by O2. + +**A-OVERFLOW.** [overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): + +> “When `+`, `*` or binary `-` create a value greater than the maximum value, or less than the minimum value that can be stored” + +is listed as overflow, and the section states that integer operators panic on overflow in debug mode. Proposition: if the mathematical result remains in the `usize` range, this subtraction does not overflow, so overflow-check configuration cannot alter this path. Consumed by O2 and configuration closure. + +**A-USIZE.** [integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + +> “The `usize` type is an unsigned integer type with the same number of bits as the platform’s pointer type.” + +Proposition: `usize` values are nonnegative integers; therefore a nonzero `usize` is at least one. Consumed by O2. The proof is parametric in its target-dependent width. + +No other Rust semantic or standard-library premise is consumed. Local source facts are the displayed types, the dominating branch, the assignments, the absence of any intervening mutation/reassignment, and the fact that the same `bytes` value is the receiver. Ordinary integer inequalities and contraposition are logical/mathematical inference, not additional Rust premises. + +## Obligation ledger and reconstructed proof + +**O1 — nonzero length (PROVED).** The unsafe call is reachable only in the `else` block. A-IF makes the observed condition false. A-EMPTY gives `len = 0 ⇒ is_empty = true`; contraposition gives `is_empty = false ⇒ n != 0`. + +**O2 — arithmetic and bound (PROVED).** By A-LEN and A-USIZE, `n` is a nonnegative integer; O1 therefore gives `n ≥ 1`. Hence the mathematical value `n - 1` is nonnegative, is no greater than the representable `n`, and is strictly less than `n`. A-SUB and A-OVERFLOW therefore establish that `index = n - 1` is representable without underflow/overflow in every ordinary profile and that `index < bytes.len()`. + +**O3 — unsafe-call precondition (PROVED).** `index` is a `usize`, so it is nonnegative; O2 gives `index < bytes.len()` for the unchanged receiver. It therefore selects an element of `bytes`, discharging A-GET's bounds requirement. No alias, mutation, temporal, panic, or unwind obligation is introduced by this shared-reference call. + +**O4 — result (PROVED).** A-GET returns a reference to the selected element. The inspected method and function signatures carry that shared borrow into `Option<&u8>`; no unsafe lifetime extension, raw pointer, or stored state occurs. The empty/true branch returns `None` without unsafe execution. + +## Finding and proposed repair + +**F-DOC-1 — inadequate local `SAFETY` proof.** The current comment proves neither O1, O2, nor O3. Its lifetime statement does not imply in-bounds indexing and therefore cannot justify `get_unchecked`. Replace it with: + +```rust +// SAFETY: Reaching this `else` branch means `bytes.is_empty()` was false. +// Since a zero-length slice makes `is_empty()` true, `bytes.len()` is nonzero. +// Thus `bytes.len() - 1` neither underflows nor overflows and is strictly less +// than `bytes.len()`, so `index` is in bounds as required by `get_unchecked`. +``` + +This repair changes no implementation or public contract and has no compatibility impact. Re-audit if the branch, index arithmetic, receiver, function signature, Rust/stdlib version, supported configuration domain, or `get_unchecked` contract changes. + +## TCB, evidence, and residual scope + +TCB revision `TCB-LAST-1` consists only of accepted A-GET through A-USIZE, each verified against the linked Rust 1.82.0 Reference or standard-library page and consumed exactly as mapped above. There are no additional TCB assumptions, dependencies, tools, tests, sampled executions, generated artifacts, or prior audits. No build, test, execution, or macro expansion was performed. The verdict is source-level; compiler/backend binary correctness and behavior outside the exact requested Rust/version/target/profile domain are excluded. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/I.md new file mode 100644 index 0000000000..41d220b8cb --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/I.md @@ -0,0 +1,57 @@ +# Local proof-artifact review: `last` + +## Claim and results + +**Implementation soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard library 1.82.0, every target on which this source and its used standard-library items exist, every ordinary profile, and every well-typed safe call `last(bytes)`, execution is free of Rust undefined behavior under the documented Rust abstract semantics. The TCB is `TCB-LAST-1` below: version-matched Rust authorities only, with no additional assumptions. + +**Existing `SAFETY` comment: DEFICIENT.** “The returned reference cannot outlive `bytes`” does not establish the sole material caller obligation of `get_unchecked`: that `index` is in bounds. Reconstructing that omitted bounds proof is necessary to certify the implementation. This is a proof-artifact defect, not an implementation defect. + +`last` has no documented behavioral postcondition, so no independent `CONTRACT-BROKEN` claim arises. Its safe signature imposes no caller-side safety precondition beyond a well-typed `&[u8]`. + +## Snapshot, boundary, and domain + +The audited artifact is exactly the supplied `target/lib.rs`; no revision or digest was supplied. Audit cutoff: 2026-08-01. The complete safe boundary is the public free function `pub fn last(bytes: &[u8]) -> Option<&u8>`. Its only unsafe site is `bytes.get_unchecked(index)`. There are no fields, traits, impls, callbacks, FFI, macros, generated artifacts, dependencies, persistent invariants, `cfg`s, features, or target-specific branches in the supplied source. No build, test, execution, or tool-derived evidence was used. + +Let + +`Required = {source exactly as supplied} × {Rust/std 1.82.0} × {targets where the source and used items exist} × {ordinary profiles} × {all valid &[u8] inputs}`. + +The proof below is parametric in slice length, `usize` width, target, and profile. Hence `Covered = Required`, proving `Required ⊆ Covered`; no enumeration or exclusion is used. Debug/release overflow behavior is irrelevant because the subtraction is proved non-overflowing. + +## Obligation ledger and reconstructed proof + +Let `L = bytes.len()`. + +1. **Control flow.** The unsafe site is reachable only through the `else` block, so `bytes.is_empty()` evaluated to `false` (A2). +2. **Nonzero length.** A1 states `L = 0 ⇒ is_empty() = true`; by contraposition with step 1, `L ≠ 0`. A3 identifies `L` as the slice's element count, and A4 identifies its type as unsigned, so `L ≥ 1`. +3. **Arithmetic.** Integer `-` is subtraction (A5). Therefore `index = L - 1` is representable and satisfies `0 ≤ index < L`. It neither creates a value below the type minimum nor overflows under A6, in any ordinary profile. +4. **Unsafe call.** Thus the `usize` index is in bounds. This discharges A7's safety requirement, and `get_unchecked` supplies the shared element reference described by its contract. Wrapping it in `Some` and returning it introduces no unsafe operation. The empty branch executes no unsafe operation. + +These cases exhaust every boolean result and every valid slice, so every unsafe-site obligation is proved over `Required`. + +## Authoritative premise inventory (`TCB-LAST-1`) + +All entries apply exactly to Rust/std 1.82.0 on every target where the cited item and audited source exist. Each is accepted as a versioned Rust `AXIOM`; there are no other TCB categories or premises. + +- **A1 — `is_empty`.** The docs say “`true` if the slice has a length of 0.” [Rust 1.82 slice `is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty). Verified proposition consumed in step 2: `L = 0 ⇒ is_empty() = true`. +- **A2 — `if`.** “If all `if` and `else if` conditions evaluate to `false` then any `else` block is executed.” [Rust 1.82 Reference, `if` expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions). Verified proposition consumed in step 1: this `else` execution entails the sole condition evaluated to `false`. +- **A3 — slice length.** `len` returns the “number of elements.” [Rust 1.82 slice `len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len). Verified proposition consumed in step 2: `L` is the slice's element count; its displayed return type is `usize`. +- **A4 — `usize`.** “The `usize` type is an unsigned integer type.” [Rust 1.82 Reference, numeric types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types). Verified proposition consumed in steps 2–3: `L` and `index` have no negative representable values; the proof is width-parametric. +- **A5 — subtraction.** The primitive-integer table defines `-` as “Subtraction.” [Rust 1.82 Reference, arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators). Verified proposition consumed in step 3: `L - 1` denotes integer subtraction when representable. +- **A6 — overflow boundary.** Binary subtraction overflows when it creates a value “less than the minimum value that can be stored” (or above the maximum). [Rust 1.82 Reference, overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow). Verified proposition consumed in step 3: because `L ≥ 1`, `L - 1 ≥ 0`, so this subtraction does not overflow; overflow-check profile choices cannot change this path. +- **A7 — unchecked indexing.** The method “Returns a reference to an element or subslice”; an “out-of-bounds index is undefined behavior.” [Rust 1.82 slice `get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked). Verified proposition consumed in step 4: a `usize` index must be in bounds, and a contract-satisfying call returns the shared reference. + +The derivation consumes A1–A7 exactly as mapped above and no unlisted Rust semantic premise material to the unsafe obligation. + +## Finding and replacement comment + +**FINDING-COMMENT-1 (proof documentation):** the current comment establishes no implication from the dominating branch to `index < bytes.len()`. Minimum resolution is to replace it with: + +```rust +// SAFETY: This else branch is executed only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() != 0` here. +// Thus `index = bytes.len() - 1` cannot underflow and is strictly less than +// `bytes.len()`, so it is in bounds as required by `get_unchecked`. +``` + +Re-audit if the source, function or callee contract, Rust/std version, support domain, or cited authoritative prose changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/J.md new file mode 100644 index 0000000000..e5a8cb2601 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/reports/J.md @@ -0,0 +1,149 @@ +# Unsafe Rust Audit: `last` + +## Claim and verdict + +**Soundness: PROVED.** For the exact supplied `lib.rs`, Rust and standard +library 1.82.0, every target on which this source and the used standard-library +items exist, every ordinary profile, every valid `&[u8]`, and every permitted +source-level execution, every well-typed safe call to `last` is free of Rust +undefined behavior. There is no caller-side safety precondition. This result is +relative only to the Rust 1.82.0 authorities in TCB-R1 below; it adds no TCB +assumption. + +**Existing `SAFETY` comment: DEFICIENT.** Its lifetime statement does not +establish the `get_unchecked` call's material requirement that `index` be in +bounds. Reconstructing that missing argument is necessary to reach the +implementation verdict. This is a proof-artifact defect, not an implementation +defect. + +There is no documented postcondition on `last`, so no separate mandatory +postcondition verdict applies. In particular, the name `last` is not treated as +normative documentation. + +## Snapshot, domain, and boundary + +- Snapshot: the complete supplied `lib.rs`, lines 1--11; no generated source, + dependencies, features, `cfg`, macros, FFI, assembly, build scripts, or prior + audit are present in the supplied target. +- Surface inventory: one public safe free function, + `pub fn last(bytes: &[u8]) -> Option<&u8>`. There are no representation + fields, constructors, traits, methods, callbacks, hidden items, statics, or + invariant-bearing state. The sole unsafe site is + `bytes.get_unchecked(index)` at line 9. +- Let `Required(b,t,p,e)` mean: this exact source; Rust/std 1.82.0; `b` is any + valid `&[u8]`; `t` is any target where the source and used items exist; `p` is + any ordinary profile; and `e` is any permitted execution. This is exactly the + request's controlling expression, so the normalization is equality in both + directions. `Required_cfg(t,p) = target_exists(t) && ordinary_profile(p)`. + There is no policy conflict, exclusion, or unresolved domain. +- Actual axes are slice length, target-dependent `usize` width, and arithmetic + overflow-check configuration. The proof below is parametric in all three. + Optimization, debug assertions, and panic strategy do not alter any consumed + proposition. No build or generation pipeline selects another artifact. + +## Obligation ledger and reconstructed proof + +**O1 -- branch closure.** Partition executions by the branch actually selected +at lines 4--10. Rust's `if` semantics makes the two source paths exhaustive. If +the consequent executes, line 5 returns `None` and the unsafe operation is not +reached. If the `else` executes, `bytes.is_empty()` evaluated false. + +**O2 -- arithmetic.** Put `n = bytes.len()` on the `else` path. AX-EMPTY says +that length zero would make `is_empty()` true; by contraposition, the observed +false result gives `n != 0`. AX-USIZE makes `n` an unsigned integer, hence +`n > 0`. Integer `-` is subtraction (AX-SUB), so line 7 computes +`index = n - 1`. Mathematically `0 <= n - 1 < n`; the result is neither below +the type minimum nor above its maximum, so AX-OVERFLOW shows that this +subtraction does not overflow. Thus this result and the absence of an +arithmetic panic are identical with overflow checks enabled or disabled. + +**O3 -- unsafe call.** AX-LEN identifies `n` as the number of slice elements. +Consequently the integer index `n - 1`, with `n > 0`, is in the slice's index +range. AX-GET says an out-of-bounds call is UB and that the method returns a +reference to the selected element; O2 proves the excluded condition false. +The call therefore satisfies its safety contract and returns the in-bounds +`&u8` used to construct `Some`. There is no later mutation, callback, +interference, unwind point, or unsafe consumer. + +For every `Required` case, O1 selects a covered path; the consequent path has no +unsafe operation, while O2--O3 cover every alternative path for every target +`usize` width and profile. Hence each obligation's covered domain contains +`Required`; their pointwise intersection does too. This is the +`Required ⊆ Covered` certificate for the verdict. + +## Rust/std authority inventory (TCB-R1) + +All entries are Rust 1.82.0 AXIOMs, checked at the linked versioned sections, +accepted as the request-authorized Rust authority, and applicable to every +`Required` target where the item exists. There are no dependencies, tools, or +additional admitted propositions. + +- **AX-LEN.** [`slice::len`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.len): + “number of elements in the slice”. Verified proposition: `bytes.len()` is the + slice's element count and has the shown return type `usize`. Consumers: O2, + O3. +- **AX-EMPTY.** [`slice::is_empty`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.is_empty): + “`true` if the slice has a length of 0”. Verified proposition: if the element + count is zero, this call returns true. Consumer: O2. +- **AX-IF.** [If expressions](https://doc.rust-lang.org/1.82.0/reference/expressions/if-expr.html#if-expressions): + “condition operand evaluates to `true`, the consequent block is executed”; + “conditions evaluate to `false` then any `else` block is executed”. Verified + proposition: for this one-condition `if`/`else`, the condition selects the + consequent when true and the `else` when false. Consumer: O1. +- **AX-USIZE.** [Integer types](https://doc.rust-lang.org/1.82.0/reference/types/numeric.html#integer-types): + “The `usize` type is an unsigned integer type”. Verified proposition: + `n: usize` is nonnegative and lies in that type's representable integer + range, for every supported pointer width. Consumer: O2. +- **AX-SUB.** [Arithmetic operators](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#arithmetic-and-logical-binary-operators): + the integer `-` table entry is “Subtraction”. Verified proposition: the + built-in operation on these `usize` operands is integer subtraction. + Consumer: O2. +- **AX-OVERFLOW.** [Overflow](https://doc.rust-lang.org/1.82.0/reference/expressions/operator-expr.html#overflow): + “binary `-` create a value greater than the maximum value, or less than the + minimum value that can be stored” is overflow. Verified proposition: a + subtraction whose mathematical result remains in the `usize` range does not + overflow. Consumer: O2. +- **AX-GET.** [`slice::get_unchecked`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked): + “reference to an element”; “out-of-bounds index is undefined behavior”. + Verified proposition: the `usize` call returns a reference to the indexed + element without a bounds check, and the caller must exclude an out-of-bounds + index. Consumer: O3. + +This inventory exactly matches the semantic leaves used above. The remaining +steps are inspected source syntax, contraposition, integer inequalities, and +set inclusion; no uncited Rust/std proposition or tool result supplies a +material inference. + +## Finding PA-1 -- inadequate local proof + +- **Affected artifact:** line 8's comment; implementation status **PROVED**, + proof-artifact status **deficient**. +- **Defect:** “The returned reference cannot outlive `bytes`” neither states + nor derives `index < bytes.len()`, the precondition consumed at line 9. It is + not a substitute for O1--O3. +- **Required resolution:** replace the comment with locally reviewable bounds + reasoning. No caller contract or code change is needed. + +Proposed replacement text: + +```rust +// SAFETY: This branch is reached only when `bytes.is_empty()` is false. +// A zero-length slice makes `is_empty()` true, so `bytes.len() > 0` here. +// Therefore `index = bytes.len() - 1` cannot underflow and satisfies +// `index < bytes.len()`, as required by `get_unchecked`. +``` + +## Evidence, residual scope, and review triggers + +No build, test, execution, macro expansion, or tool-derived evidence was used. +This is a source-level Rust abstract-semantics result, not a claim about a +particular compiler backend, binary, platform implementation, undocumented +behavior, performance, or panic freedom outside the proved subtraction. +Re-audit if the source/comment, function or std contracts, Rust version, +supported domain, or any presently absent configuration/generation/dependency +mechanism changes. + +**Final attestation:** every in-scope surface and unsafe obligation has a +status; the material reconstruction and proof-artifact defect are explicit; +the authority inventory is reconciled to the derivation; and no conclusion +rests on testing or absence of a counterexample. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/L/s2/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/PACKET.json new file mode 100644 index 0000000000..38e68a031e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "ecb90a801bfbf51797749e1eddf95b85a1acba5acc92b2c061612a317150c81e", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "P", + "presentation_order": [ + "G", + "I", + "A", + "J", + "H", + "C", + "D", + "B", + "F", + "E" + ], + "report_sha256": { + "A": "19d9b069a036a6d9da00ebbec8e5a48315b9a414cf4c353ef71e4e75d0560f62", + "B": "3e11d4e6e869575bd8c807ef85277f7f29e39ef85e6ae177fb4ea073d0e27093", + "C": "a3a118b4fcf7d37b80907aa322d3fc9423419df81bed9dcff6d299415826068e", + "D": "61ae6ed7e4ce464b07d0ae2a4b8c6941d5089e33de766fa78600e570ab998621", + "E": "cde0cbd855bf963d66c656676cb1f817bfacdae74bdab5a5551953fb54166fdf", + "F": "54dd4275f961823031967d7aa3052b68653e4170c5eeb55fea4d8c45c05bc679", + "G": "c0e89f396556b32ab2d6611a875e30ae9243ba61206f445205b4a9c889b21a24", + "H": "c81b3b6430a1854a652a3f6d3866c08a4969453f770cd387c843f253ae8b01ac", + "I": "2704f92807aeb17dd1fc54a8fd5e62078d69443c921b458532bd1995e34738bf", + "J": "873d7f2d86630153a25fb9714624659e543f4198ad55b7db8ca0ebdcb8ebe503" + }, + "rubric_sha256": "1e9e6622a34b3b0376b6912f676695e318edcd971ac1f4960810531ad854911d", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s1", + "target_byte_tree_sha256": "2b194a735b69a8904b86baa43791a0ddac9f769ce32e87bf4e759822cb5cd52e" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/RUBRIC.md new file mode 100644 index 0000000000..90f2e84814 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/RUBRIC.md @@ -0,0 +1,565 @@ +# Mode P Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material. Never expose this file to a report agent.** + +## P — Incomparable Predicates and Full-Case Closure + +### Canonical notation and policy algebra + +Use the fixture's notation: + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +F = H = D = {false, true} +P = every Cargo profile admitted by the supplied policies +I = {None} union {Some(b) | b is any u8} +case = (v, t, f, h, p, d, i) +``` + +The two exact configuration predicates are: + +```text +Scarlet(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)). + +Indigo(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)). +``` + +They are incomparable. For example: + +```text +(1.84.0, X, true, false) is Scarlet-only. +(1.84.0, X, true, true) is Indigo-only. +``` + +Any correct separating witness is acceptable. In particular, an answer need +not use the two examples above. There is no authorized rule identifying one +predicate, their intersection, their union, or any other combination as the +crate's controlling exact promise. + +The policy-induced full-case sets are: + +```text +ScarletCases = {case | Scarlet(v,t,f,h) and p in P and d in D and i in I} +IndigoCases = {case | Indigo(v,t,f,h) and p in P and d in D and i in I} +``` + +The canonical minimal conservative audit domain is their union: + +```text +Audit = ScarletCases union IndigoCases +Required(case) iff case in Audit +``` + +Its configuration projection has this equivalent exact formula: + +```text +UnionCfg(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X) + or (f and t = A and (h or v >= 1.85.0))). + +Required(v,t,f,h,p,d,i) + iff UnionCfg(v,t,f,h) and p in P and d in D and i in I. +``` + +A report may instead choose a transparent full-case superset, provided it +proves `ScarletCases subset-of Audit` and `IndigoCases subset-of Audit` +separately and states a theorem whose meaning remains coherent for every added +case. The chosen set is an audit domain, not an inferred project promise. + +### Intended source proof + +Both policies exclude every configuration with `f = true` and `t = W`. +Relative only to accepted `BUILD-MAP-POLICY`, such a build selects +`cfg(all(feature = "turbo", target_arch = "wasm32"))`. The authoritative +`all`, `cfg`-attribute, and `compile_error!` contracts then establish that the +ordinary library compilation fails. This reasoning is parametric in `v`, `h`, +`p`, and `d`; there is no library input after compilation is rejected. + +For every compiled case selected by the audit domain: + +- when `f = false`, `unwrap_or(0)` returns the contained byte for `Some(byte)` + and zero for `None`; +- when `f = true`, the same `unwrap_or(0)` first produces that result `r`, the + source constructs `Some(r)`, and `unwrap_unchecked` is therefore invoked on + `Some`, never `None`; its return contract produces the same `r`. + +One exact full-case implementation region for both soundness and behavior is: + +```text +Covered(v,t,f,h,p,d,i) + iff v in V and t in T and f in F and h in H and p in P and d in D and i in I + and (!f or (f and t in {X,A})). +``` + +The source derivation is independent of `v`, `h`, `p`, `d`, and the particular +member of `I`, but those universally quantified dimensions remain in both +`Required(case)` and `Covered(case)`. Every disjunct of `UnionCfg` implies the +final source-selection clause above, so: + +```text +Required subset-of Covered_sound +Required subset-of Covered_behavior +``` + +The two covered predicates may be represented by the same set, but the unsafe +precondition proof and the postcondition proof are distinct obligations. + +### Expected conclusions + +- The identity of the controlling exact project predicate is **UNRESOLVED** + (equivalently, **UNPROVED** as a policy-identification proposition). +- Safe-API soundness on the chosen conservative full-case audit domain is + **PROVED relative to `BUILD-MAP-POLICY`**. +- The documented `value_or_zero` postcondition on that domain is **PROVED + relative to `BUILD-MAP-POLICY`**. +- Effective rejection of every `turbo`/`wasm32` build in the supplied release, + feature, profile, and debug-assertion scope is **PROVED relative to + `BUILD-MAP-POLICY`**. + +The qualification is required because the mapping from policy configuration +coordinates to Rust `cfg` options is an accepted tool premise, not a Rust +semantic axiom. + +### Scored atoms + +Each atom below scores exactly the proposition in its `proposition` field. +The other fields identify why that proposition is in scope and how to diagnose +a failure; they add no hidden report requirement. + +- **P1 — Exact Scarlet predicate** + - `proposition`: The report's `Scarlet(v,t,f,h)` set equals the predicate in + `POLICY-SCARLET.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Scarlet disjunct, including its versioned + x86 clause and hardened aarch64 clause. + - `dependencies`: none. + - `root_cause`: A wrong Scarlet formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P2 — Exact Indigo predicate** + - `proposition`: The report's `Indigo(v,t,f,h)` set equals the predicate in + `POLICY-INDIGO.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Indigo disjunct, including its versioned + x86 and unhardened aarch64 clauses. + - `dependencies`: none. + - `root_cause`: A wrong Indigo formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P3 — Scarlet-minus-Indigo witness** + - `proposition`: There exists a stated configuration in Scarlet but not + Indigo. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Scarlet and not Indigo`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Scarlet-only configuration. + +- **P4 — Indigo-minus-Scarlet witness** + - `proposition`: There exists a stated configuration in Indigo but not + Scarlet. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Indigo and not Scarlet`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Indigo-only configuration. + +- **P5 — Exact-promise status** + - `proposition`: The supplied policy evidence leaves the controlling exact + project predicate unidentified. + - `scope_basis`: “No precedence, supersession, intersection, union, or other + conflict-resolution rule has been authorized.” (`REQUEST.md`) + - `necessary_edge`: Keep policy identification separate from selection of a + conservative audit domain. + - `dependencies`: none. + - `root_cause`: Treating an analyst-selected set as policy evidence is the + originating error. + - `accepted_alternatives`: `UNRESOLVED`, or `UNPROVED` explicitly limited to + policy identification. + +- **P6 — Scarlet full-case domain** + - `proposition`: `ScarletCases` equals the Scarlet configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P1. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P7 — Indigo full-case domain** + - `proposition`: `IndigoCases` equals the Indigo configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P2. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P8 — Scarlet containment** + - `proposition`: The chosen conservative full-case audit domain contains + `ScarletCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `ScarletCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P6 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Scarlet domain remains the originating + failure; an absent inclusion argument is independently P8. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P9 — Indigo containment** + - `proposition`: The chosen conservative full-case audit domain contains + `IndigoCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `IndigoCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P7 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Indigo domain remains the originating + failure; an absent inclusion argument is independently P9. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P10 — Scarlet wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Scarlet. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Scarlet predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P1. + - `root_cause`: A wrong Scarlet formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P11 — Indigo wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Indigo. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Indigo predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P2. + - `root_cause`: A wrong Indigo formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P12 — Effective wasm rejection** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, every in-scope build with + `f = true` and `t = W` fails library compilation at the selected + `compile_error!`. + - `scope_basis`: “Account for ... source-level effective rejection of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Follow tool mapping to both true cfg options, apply + `all`, apply the `cfg` attribute, then apply `compile_error!`, universally + over release, hardened, profile, and debug-assertion coordinates. + - `dependencies`: exact TCB use and exact-version Rust authority. + - `root_cause`: The first absent edge among mapping, predicate selection, and + compile failure is the useful diagnosis. + - `accepted_alternatives`: An equivalent symbolic proof for all such builds; + enumeration is not required. + +- **P13 — Non-turbo postcondition** + - `proposition`: On every selected non-turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Apply the exact-version `unwrap_or(0)` contract to the + two `Option` variants. + - `dependencies`: exact Option authority. + - `root_cause`: Missing or inapplicable `unwrap_or` authority is the semantic + root; missing input quantification is a domain root. + - `accepted_alternatives`: Variant cases or one exact contract application. + +- **P14 — Turbo unsafe precondition** + - `proposition`: Every reachable turbo-branch `unwrap_unchecked` call has a + `Some` receiver. + - `scope_basis`: “Prove or refute the local safety obligation at the unsafe + operation.” (`REQUEST.md`) + - `necessary_edge`: Trace the value through `unwrap_or`, the local + `Some(value)` construction, and the unchanged receiver at the unsafe call. + - `dependencies`: exact Option authority and the inspected local source. + - `root_cause`: Failure to connect the constructed receiver to the call is a + local proof-edge failure, not a policy failure. + - `accepted_alternatives`: Any equivalent local proof that identifies the + exact call receiver; no control-flow argument is required. + +- **P15 — Turbo postcondition** + - `proposition`: On every selected turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Compose `unwrap_or(0)`'s result with construction of + `Some(result)` and `unwrap_unchecked`'s return contract. + - `dependencies`: P14 and exact Option authority. + - `root_cause`: A safety proof alone does not supply the return-value edge; + diagnose that edge separately. + - `accepted_alternatives`: Direct composition or explicit `None`/`Some` + cases. + +- **P16 — Full Required predicate** + - `proposition`: The report's final `Required(case)` retains version, target, + both features, profile, debug assertions, and input over its chosen audit + domain. + - `scope_basis`: “State `Required(case)` ... without projecting away the + configuration or input dimensions.” (`REQUEST.md`) + - `necessary_edge`: Bind all seven coordinates before making a universal + conclusion. + - `dependencies`: P6 through P9. + - `root_cause`: Omission here is a final theorem-domain failure even if the + omitted axis happens not to affect source behavior. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may be symbolic. + +- **P17 — Full soundness Covered coordinates** + - `proposition`: `Covered_sound(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift the branch-local proof to a full-case predicate + rather than replacing the case by a configuration projection. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the branch proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P18 — Soundness Covered validity** + - `proposition`: Every case included in `Covered_sound(case)` has a complete + applicable unsafe-obligation derivation in the report. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after the branch-local + unsafe proof applies to that case. + - `dependencies`: P14 plus the inspected fact that the non-turbo branch uses + no unsafe operation. + - `root_cause`: An overbroad Covered set is an implementation-proof error, + not a theorem-domain recovery error. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P19 — Soundness closure** + - `proposition`: `Required subset-of Covered_sound` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration disjunct to its + proved source branch while carrying profile, debug, and input universally. + - `dependencies`: P8, P9, P14, and P16 through P18. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, local proof, or containment edge as cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P20 — Whole-domain soundness conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, safe-API soundness is + PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P19 as the certificate and no wider TCB proposition. + - `dependencies`: P19 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + source-level soundness, positive status, and TCB relativity. + +- **P21 — Full behavioral Covered coordinates** + - `proposition`: `Covered_behavior(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift both branch-local return proofs to a full-case + predicate. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the return proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P22 — Behavioral Covered validity** + - `proposition`: Every case included in `Covered_behavior(case)` has a + complete applicable postcondition derivation in the report. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after a branch-local return + proof applies to that case. + - `dependencies`: P13 and P15. + - `root_cause`: Do not infer this validity proposition from soundness; the + documented return theorem needs its own proof edges. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P23 — Behavioral closure** + - `proposition`: `Required subset-of Covered_behavior` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration and input case to a + branch with the proved documented return. + - `dependencies`: P8, P9, P13, P15, P16, P21, and P22. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, postcondition proof, or containment edge as + cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P24 — Whole-domain behavioral conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, the documented + postcondition is PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P23 as the certificate and no wider TCB proposition. + - `dependencies`: P23 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + exact postcondition, positive status, and TCB relativity. + +- **P25 — Exact TCB scope** + - `proposition`: Every proposition attributed to `BUILD-MAP-POLICY` is admitted by + that entry's exact identity, mapping, consumer, and release/profile region. + - `scope_basis`: “Apply it only to its exact build-tool mappings and + consumers.” (`REQUEST.md`) + - `necessary_edge`: Match each TCB-dependent conclusion to the supplied entry + without adding a semantic or backend proposition. + - `dependencies`: none; this is an accounting proposition. + - `root_cause`: An invented mapping is the primary error even if subsequent + cfg reasoning would be valid under it. + - `accepted_alternatives`: A compact TCB ledger or precise inline + qualifications. + +- **P26 — Conspicuous TCB qualification** + - `proposition`: Every conclusion which depends on `BUILD-MAP-POLICY` identifies + that dependency as an accepted trust premise rather than Rust authority. + - `scope_basis`: “keep every conclusion which depends on it conspicuously + qualified.” (`REQUEST.md`) + - `necessary_edge`: Carry the TCB label from configuration reachability into + each dependent rejection, soundness, and behavior conclusion. + - `dependencies`: none; this is a reporting proposition. + - `root_cause`: An otherwise valid but unconditional conclusion fails here; + do not misdiagnose it as a Rust-authority mismatch. + - `accepted_alternatives`: Inline `relative to BUILD-MAP-POLICY` wording or an + unambiguous shared qualification covering the dependent conclusions. + +- **P27 — Exact authority closure** + - `proposition`: Every material Rust semantic premise used in a positive + proof is paired with an applicable exact-version URL and a quotation which + supplies that premise. + - `scope_basis`: “For each material Rust semantic premise, cite the applicable + exact-version Rust Reference or standard-library page and quote the prose + which supplies that premise.” (`REQUEST.md`) + - `necessary_edge`: Reconcile the proof leaves against the authority inventory + below; a page label alone supplies no unstated proposition. + - `dependencies`: every positive Rust-semantic derivation. + - `root_cause`: Identify the first missing, mismatched, or overclaimed + quotation; do not treat one omission as multiple distinct authority roots. + - `accepted_alternatives`: Shorter exact excerpts and different organization + are acceptable when the proposition and release applicability are clear. + +### Hard errors + +A mere omission, an explicit refusal to close a proposition, or a downstream +atom failure caused by a disclosed upstream gap is not by itself a hard error. +Record a hard error only for the corresponding false affirmative claim below: + +- **PH1:** selects Scarlet, Indigo, their intersection, their union, or another + combination as the controlling exact project promise without new policy + evidence; +- **PH2:** relabels an analyst-selected conservative audit domain as the exact + project promise; +- **PH3:** asserts containment or incomparability using a stated formula and + witness which do not establish the asserted set relation; +- **PH4:** claims whole-domain soundness or behavior after dropping a required + configuration or input coordinate, or without a valid full-case + `Required subset-of Covered` argument; +- **PH5:** treats `turbo`/`wasm32` as policy-supported, or claims effective + rejection without the exact accepted mapping and applicable `all`, `cfg`, and + `compile_error!` implications; +- **PH6:** calls the shown source `UNSOUND` or calls its documented + postcondition `CONTRACT-BROKEN` on the supplied audit domain; +- **PH7:** invents or widens `BUILD-MAP-POLICY`, treats it as Rust authority, or uses + it outside its exact identity, propositions, consumers, or region. + +Record independently applicable global hard errors as well. + +### Exact authority propositions, quotations, and URLs + +The following quotations were checked on every listed exact-version page. The +quotation is the semantic content; presence on an allowlist is not itself +evidence for a proposition. + +For Rust 1.84.0, 1.85.0, and 1.86.0, the `Option` pages describe `unwrap_or` +using the “contained `Some` value” or “provided default,” and +`unwrap_unchecked` returning the “contained `Some` value.” Its Safety heading +says calling it on `None` “is undefined behavior.” Construction of +`Some(value)` is an immediate inspected source fact, not a separately cited +semantic premise. + +Exact pages, in canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked` + +For each of the same releases, the Conditional Compilation chapter says a +configuration predicate is “true if the option is set,” `all` requires “all of +the given predicates” to be true, and `not` is true when its “predicate is +false.” The `cfg` attribute “conditionally includes” its attached item. Those +checked excerpts supply exactly the source-selection implications used here. + +The standard-library macro page states: + +- “Causes compilation to fail with the given error message when encountered.” + +Exact pages, continuing canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html` + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. No policy sentence, +Cargo minimum, evaluator oracle, test result, CI result, or inferred tool +behavior is a Rust semantic axiom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/allowlist.txt new file mode 100644 index 0000000000..0e8296d465 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/allowlist.txt @@ -0,0 +1,15 @@ +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/A.md new file mode 100644 index 0000000000..1fb5ea7ca5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/A.md @@ -0,0 +1,197 @@ +# Focused unsafe Rust source audit + +## Claim, snapshot, and verdicts + +This review covers the supplied `Cargo.toml`, `POLICY-SCARLET.md`, +`POLICY-INDIGO.md`, `TCB.md`, and `src/lib.rs` source snapshot, under Rust +1.84.0, 1.85.0, and 1.86.0. It is source-level only: no compiler/backend, +binary, tests, generated artifacts, dependencies, or prior audit are claimed. +Review date/audit cutoff: 2026-08-01. The support documents are static for this +snapshot, so the cutoff does not resolve their conflict. + +| Claim | Verdict | Qualification | +|---|---|---| +| Every well-typed safe call of `value_or_zero` in `Required` is free of Rust UB | **PROVED** | Relative to `TCB-BUILD-MAP` only for mapping policy configurations to source branches; branch correctness uses the version-specific Rust axioms below. | +| The call returns the contained byte, or zero for `None`, throughout `Required` | **PROVED** | Same qualification. | +| Every `turbo`/`wasm32` configuration is rejected before a library artifact is produced | **PROVED** | Conspicuously conditional on `TCB-BUILD-MAP`; this is a compilation claim, not a runtime-input claim. | +| One uniquely determined exact project support predicate can be recovered | **UNPROVED** | Scarlet and Indigo are incomparable current exact commitments, and no resolution rule is authorized. | + +The combined mandatory soundness-and-requested-behavior result is **PROVED over +the conservative audit domain `Required` defined below, relative to +`TCB-BUILD-MAP`**. `Required` is not asserted to be the crate's exact support +promise. + +## Exact predicates and full-case domains + +Let + +* `V = {1.84.0, 1.85.0, 1.86.0}`; +* `X = x86_64-unknown-linux-gnu`, `A = aarch64-unknown-linux-gnu`, and + `W = wasm32-unknown-unknown`; +* `B = {false,true}`; `f` means `turbo`, and `h` means `hardened`; +* `P` be the symbolic set of **all Cargo profiles** (no finite enumeration is + substituted); and +* `O = {None} union {Some(n) | n is any u8}`, exactly every valid `Option`. + +For the full case `c=(v,t,f,h,p,d,o)`, with `d` the state of debug assertions, +the separately reproduced configuration predicates are + +```text +S(v,t,f,h) := v in V and t in {X,A,W} and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) + +I(v,t,f,h) := v in V and t in {X,A,W} and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +Their induced full-case domains, preserving every dimension, are + +```text +D_S(c) := S(v,t,f,h) and p in P and d in B and o in O +D_I(c) := I(v,t,f,h) and p in P and d in B and o in O. +``` + +Neither contains the other. `(1.84.0,X,true,false)` satisfies Scarlet's +`t=X and !h` term but not Indigo's `h or v>=1.86.0`, so `S` is not a subset of +`I`. Conversely, `(1.84.0,X,true,true)` satisfies Indigo's `t=X and h` term but +not Scarlet's `!h or v>=1.85.0`, so `I` is not a subset of `S`. Extending either +witness with any `p in P`, `d in B`, and `o in O` separates the full-case +domains. Thus they are unequal and incomparable. + +Select the least union as the conservative audit configuration predicate: + +```text +U(v,t,f,h) := S(v,t,f,h) or I(v,t,f,h) + = v in V and t in {X,A,W} and + (!f or (f and + (t = X or (t = A and (h or v >= 1.85.0))))) + +Required(c) := U(v,t,f,h) and p in P and d in B and o in O. +``` + +The equality follows by cases. For `!f`, both policies admit every listed +`v,t,h`. For `f,t=X`, Scarlet admits every `h=false` case and Indigo every +`h=true` case, hence all `v,h`. For `f,t=A`, Scarlet admits all `h=true` cases, +while Indigo admits precisely `h=false,v>=1.85.0`, yielding +`h or v>=1.85.0`. Neither admits `f,t=W`. Separately, `D_S subseteq Required` +because `S implies S or I`, and `D_I subseteq Required` because +`I implies S or I`; the other full-case conjuncts are identical. This proves +both required containments without resolving which policy is authoritative. + +## Authority and TCB audit log + +For each of 1.84.0, 1.85.0, and 1.86.0, the applicable Reference pages are: +[conditional predicates 1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), +and [`cfg` attribute 1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +They state, respectively, “It is true if all of the given predicates are true” +and “It is true if its predicate is false”; for item selection: “If the +predicate is true, the thing is rewritten to not have the cfg attribute ... If +the predicate is false, the thing is removed”. These are `AX-CFG-{84,85,86}`. + +The exact-version `compile_error!` pages +([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)) say: +“Causes compilation to fail with the given error message when encountered.” +These are `AX-COMPILE-ERROR-{84,85,86}`. + +The exact-version `Option` pages are +[`unwrap_or` 1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), +and [`unwrap_unchecked` 1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +Each says `unwrap_or` “Returns the contained `Some` value or a provided +default”; `unwrap_unchecked` “Returns the contained `Some` value”, while +“Calling this method on `None` is undefined behavior.” These are +`AX-OPTION-{84,85,86}` and supply separate exhaustive version coverage—no +cross-version compatibility assumption is used. + +`TCB-BUILD-MAP` is the sole non-axiom entry: the accepted `BUILD-MAP-POLICY` in +`TCB.md`, with the exact three toolchain-bundled Cargo releases, manifest, named +features, targets, and all supported profiles. It admits only that enabled and +disabled features set and do not set their matching feature predicates, and +that `X/A/W` set `target_arch` to `x86_64/aarch64/wasm32`. It is consumed only +to map policy cases to source reachability and to prove effective rejection. +It supplies no Rust semantics, branch correctness, compatibility, or binary +correctness. Its disposition is accepted by the authorized human reviewer. +No other TCB premise is consumed. + +## API, rejection, and obligation proofs + +The complete exposed surface is one safe free function, `value_or_zero`, with +two mutually exclusive `cfg` definitions. There are no public fields, +constructors, traits/impls, macros generating APIs, hidden items, callbacks, +FFI, allocation, concurrency, or invariant-bearing state. The only unsafe +operation is `Option::unwrap_unchecked` at `src/lib.rs:18`. No generated code or +tool-derived evidence exists. + +Define `Q(None)=0` and `Q(Some(n))=n`, and define the actually proved source +case predicate without dropping any axes: + +```text +K(c) := v in V and t in {X,A,W} and f in B and h in B + and p in P and d in B and o in O +Covered_sound(c) := K(c) and (!f or t != W) +Covered_behavior(c) := K(c) and (!f or t != W). +``` + +* **Non-turbo branch (`!f`).** `TCB-BUILD-MAP` plus `AX-CFG-v` selects only + lines 7-10. `o.unwrap_or(0)` returns the contained `n` for `Some(n)` and the + provided `0` for `None`, so it returns `Q(o)`. There is no unsafe operation. +* **Turbo, non-wasm branch (`f and t!=W`).** The same reachability premises + select lines 13-19 and do not encounter the compile error. The first + `unwrap_or(0)` establishes local fact `r=Q(o)`. The unsafe receiver is then + constructed syntactically as `Some(r)`. Its exact safety obligation is “the + receiver is not `None`”; construction proves it. `AX-OPTION-v` then gives + both absence of the documented UB and return value `r=Q(o)`. This proof is + parametric in `h,p,d,o` and partitioned exhaustively by each exact `v` axiom. +* **Every turbo/wasm case.** Both policies exclude it: when `f` is true, their + only target terms require `X` or `A`. Independently, for every `v in V`, + `h,p,d`, and would-be `o`, `TCB-BUILD-MAP` makes both operands of the + crate-level `all(feature="turbo",target_arch="wasm32")` true; + `AX-CFG-v` retains the macro and `AX-COMPILE-ERROR-v` makes compilation fail. + Thus no call/input execution exists. This enforcement conclusion must not be + detached from its accepted TCB premise. + +`U` implies `!f or t=X or t=A`, hence `U implies (!f or t!=W)`. All remaining +conjuncts of `Required`, `Covered_sound`, and `Covered_behavior` are identical. +Therefore, separately, +`Required subseteq Covered_sound` and +`Required subseteq Covered_behavior`. The aggregate coverage predicate is their +intersection, which is the same predicate, so `Required` is contained in it. +This is the whole-domain certificate for both **PROVED** verdicts. + +## Findings, residual scope, and maintenance + +`F-POLICY`: the support-promise identity remains **UNPROVED**. The smallest +missing premise is an authorized rule selecting, merging, or otherwise +reconciling Scarlet and Indigo. The conservative union prevents that policy +defect from leaving either candidate domain unaudited, but does not repair it. + +The implementation obligation at line 18 is proved. Its adjacent safety +comment records the decisive local `Some` construction, but omits the callee's +exact “not `None`” obligation. A proof-grade replacement is: + +```rust +// SAFETY: `unwrap_unchecked` requires this receiver not to be `None`. +// It is constructed immediately here as `Some(value)`, so that holds. +``` + +This is proof-documentation debt, not an implementation defect. No UB witness +or UB-free postcondition counterexample exists in the audited domain. + +Residual scope excludes unsupported configurations and all binary/backend +correctness. Re-audit is required for any source/manifest/policy change, +resolution of the policy conflict, Rust or cited-documentation version change, +feature/target/profile scope change, or any change to `TCB-BUILD-MAP` identity, +mapping, disposition, or consumers. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/B.md new file mode 100644 index 0000000000..0a338f08b0 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/B.md @@ -0,0 +1,106 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-only audit of the exact supplied `Cargo.toml`, `src/lib.rs`, two policy documents, and `TCB.md`, cut off 2026-08-01. No generated code, dependencies, tests, execution, macro expansion, backend, or binary claim is in scope. The public surface is the safe free function `value_or_zero(Option) -> u8`, with mutually conditional definitions. The only unsafe operation is `Option::unwrap_unchecked` in the `turbo` definition. There are no public fields, constructors, traits, callbacks, FFI items, invariant-bearing representations, or other exported items. + +Verdicts: + +- **PROVED, relative to accepted `BUILD-MAP-POLICY` and the version-specific Rust axioms below:** every well-typed call in the conservative full-case audit domain is free of Rust undefined behavior. +- **PROVED under the same qualification:** every such call returns the contained byte, or zero for `None`. +- **PROVED under the same qualification:** every `turbo`/`wasm32` compilation in the stated version/feature/profile/debug domain is rejected before a library artifact is produced. +- **UNPROVED (policy identity only):** which one set, if any, is the crate's exact support promise. Scarlet and Indigo are incomparable current commitments and no resolution rule is authorized. The conservative audit domain below is not a resolution or a new support promise. + +## Exact domains and relationships + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the triples defined by the policies, `B={false,true}`, `P` be all Cargo profiles, and +`O={None} union {Some(n) | n is a valid u8}`. A full case is +`c=(v,t,f,h,p,d,i) in V x T x B x B x P x B x O`. + +The exact configuration predicates are: + +```text +S_cfg(v,t,f,h) := v in V and t in T and ( + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h) +) + +I_cfg(v,t,f,h) := v in V and t in T and ( + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0) +) +``` + +Their induced full-case domains are +`S(c):=S_cfg(v,t,f,h) and p in P and d in B and i in O` and identically +`I(c):=I_cfg(v,t,f,h) and p in P and d in B and i in O`. + +Neither contains the other. The configuration `(1.84.0,X,true,false)` is in Scarlet: its `X and !h` term is true; it is not in Indigo because both `h` and `v>=1.86.0` are false. Conversely `(1.84.0,X,true,true)` is in Indigo by `X and h`, but not Scarlet because both `!h` and `v>=1.85.0` are false. Each satisfies the common `V,T` bounds; choosing any `p,d,i` lifts each witness to the corresponding full-case difference. + +Select the conservative audit domain `A(c):=S(c) or I(c)`. Equivalently its configuration part is + +```text +A_cfg := v in V and t in T and ( + !f or (f and t = X) or + (f and t = A and (h or v >= 1.85.0)) +). +``` + +Proof of equality: `S_cfg or I_cfg` has no `f,W` disjunct; for `f,X`, `h` selects Indigo and `!h` selects Scarlet, so every `v,h` is included; for `f,A`, Scarlet contributes `h` and Indigo contributes `!h and v>=1.85.0`. Conversely, each displayed normalized case selects the named policy term: `!f` selects both; `f,X,h` selects Indigo; `f,X,!h` selects Scarlet; `f,A,h` selects Scarlet; and `f,A,!h,v>=1.85.0` selects Indigo. Thus both directions hold. Separately, `S subseteq A` and `I subseteq A` follow by disjunction introduction, with every `p,d,i` unchanged. + +Accordingly `Required_S(c)=S(c)` and `Required_I(c)=I(c)`. There is no authorized unique crate-level `Required`. For the conservative audit theorem only, `Required_A(c)=A(c)`. + +## Authorities and TCB + +For each of Rust 1.84.0, 1.85.0, and 1.86.0, the exact-version Conditional Compilation pages state: “The predicate is true if the option is set and false if it is unset”; for `all`, “It is true if all of the given predicates are true, or if the list is empty”; and for `not`, “It is true if its predicate is false and false if its predicate is true.” The `cfg`-attribute section states: “The `cfg` attribute conditionally includes the thing it is attached to based on a configuration predicate” and “If the predicate is false, the thing is removed from the source code.” ([1.84 predicate](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.84 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute); [1.85 predicate](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), [1.85 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute); [1.86 predicate](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), [1.86 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute).) + +At each exact version, `compile_error!` “causes compilation to fail with the given error message when encountered.” ([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html).) + +At each exact version, `unwrap_or` “Returns the contained `Some` value or a provided default.” ([1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or).) `unwrap_unchecked` “Returns the contained `Some` value ... without checking that the value is not `None`,” and its Safety clause says: “Calling this method on `None` is undefined behavior.” ([1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked).) Direct per-release citations avoid any compatibility premise. + +`BUILD-MAP-POLICY` is the sole admitted non-axiom premise. The authorized reviewer accepts, only for the three bundled Cargo releases, supplied manifest/source, all supported profiles, named feature cfgs, and three target-to-`target_arch` mappings, exactly the mapping recorded in `TCB.md`. It is consumed only for source selection and rejection. It supplies no Rust semantics or branch correctness. Every whole-case verdict above depends on it; local reasoning about an already-selected definition does not. No tool-derived evidence or other premise is used. + +## Selection, rejection, and local proofs + +Under the TCB mapping and cited cfg rules, `f=false` selects exactly the `not(feature="turbo")` definition; `f=true` selects exactly the other definition. Neither `h`, `p`, `d`, `v`, nor a non-wasm target changes either value computation. + +For every hypothetical full `turbo`/`wasm32` case +`E(c):=v in V and t=W and f and h in B and p in P and d in B and i in O`, both policies exclude it: `!f`, `t=X`, and `t=A` are all false in each predicate. Independently, the TCB makes both leaves of `all(feature="turbo",target_arch="wasm32")` true; the cited `all` and cfg rules therefore include `compile_error!`, whose cited contract fails compilation. This proof is uniform over `v,h,p,d`; rejection precedes and is independent of runtime `i`. Thus `E` contains no shippable library case and is not silently counted as covered API execution. + +Define `q(None)=0` and `q(Some(n))=n`. + +- Non-turbo: `value.unwrap_or(0)` returns the contained `n` for `Some(n)` and the supplied default `0` for `None`. It is the documented safe operation, so every `i in O` is UB-free and the result is `q(i)`. +- Turbo: the first `unwrap_or(0)` produces `x=q(i)`. The unsafe receiver is then constructed locally as `Some(x)`, hence is not `None`. This proves the entire cited safety obligation for `unwrap_unchecked`; its return contract yields the contained `x=q(i)`. Thus every `i in O` is UB-free and satisfies the postcondition. + +The existing safety comment records the decisive local fact (`Some` construction), so the implementation obligation is proved, but the proof artifact is deficient: it does not state the callee's `None`/UB obligation or the consumed return guarantee. Proposed replacement: + +```rust +// SAFETY: `unwrap_unchecked` is UB only when its receiver is `None`. +// This receiver is constructed immediately as `Some(value)`, so it is not +// `None`; the call returns that contained `value`. +``` + +## Full-case coverage certificate + +Without projecting any dimension away, define + +```text +Covered_sound(c) := A(c) and ( + (!f and the selected non-turbo execution on i is UB-free) or + (f and t in {X,A} and the selected turbo execution on i is UB-free) +) + +Covered_post(c) := A(c) and ( + (!f and the selected non-turbo result on i equals q(i)) or + (f and t in {X,A} and the selected turbo result on i equals q(i)) +). +``` + +Take arbitrary `c` with `Required_A(c)`. If `!f`, selection plus the non-turbo lemma puts the same complete `(v,t,f,h,p,d,i)` in both Covered predicates. If `f`, normalized `A_cfg` implies `t=X` or `t=A`; selection plus the turbo lemma does likewise. These cases exhaust `B`. The lemmas quantify every `v,t,h,p,d,i`; irrelevance of `v,h,p,d` follows from their absence from the selected computations, not from projection. Hence +`Required_A subseteq Covered_sound intersect Covered_post`. Conversely both Covered predicates include `A(c)` by definition, so each equals `A`; aggregate closure is exact. Since `S subseteq A` and `I subseteq A`, the same proofs close each published policy domain separately. + +## Residual scope and review triggers + +Only the identity of the single governing support promise is unresolved; authorized policy resolution is required. Re-audit on any change to the supplied source, manifest, either policy, feature/target/profile scope, any of the three Rust/Cargo identities or cited contracts, `BUILD-MAP-POLICY` disposition/mapping, or the documented postcondition. No code change was made. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/C.md new file mode 100644 index 0000000000..09ad3b77c3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/C.md @@ -0,0 +1,117 @@ +# Focused unsafe-Rust source audit + +## Claim and results + +This audit covers the complete supplied `focused-predicate-target` source snapshot: `Cargo.toml`, `src/lib.rs`, both published policies, and `TCB.md`. It is a source-level claim under the documented Rust abstract semantics, not a compiler-backend or binary claim. Audit cutoff: 2026-08-01. TCB log identity is the supplied `TCB.md` snapshot; no revision identifier is stated. Skill identity is the supplied `unsafe-rust` package; no revision identifier is stated. No generated code, dependencies, FFI, macros, stateful invariants, tests, builds, or prior audit results are in scope or used. + +| Claim | Required domain | Result | Qualification | +|---|---|---|---| +| Every well-typed safe call of `value_or_zero` is free of Rust UB | conservative domain `R` below | **PROVED** | Relative to accepted `BUILD-MAP-POLICY` and the exact-version Rust axioms quoted below | +| The return is the contained byte, or zero for `None` | `R` | **PROVED** | Same qualification | +| Either published policy is *the* exact crate support promise | identity of Scarlet versus Indigo | **UNPROVED** | The documents are incomparable and no resolution rule is authorized | + +The combined mandatory soundness-and-behavior result is **PROVED over `R`**, relative to that TCB. This does not resolve or redefine the project's exact support promise. + +## Exact domains and policy relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the triples' meanings exactly as in the policies, `B={false,true}`, `P` be all Cargo profiles, `D=B` be both debug-assertion states, and + +`O={None} union {Some(n) | n is a u8}`. + +A full case is `c=(v,t,f,h,p,d,i)` in `K=V x T x B x B x P x D x O`. Comparisons of versions below are only over the finite set `V`. + +The exact Scarlet configuration predicate is + +`S(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (!h or v>=1.85.0)) or (f and t=A and h)]`. + +The exact Indigo configuration predicate is + +`I(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (h or v>=1.86.0)) or (f and t=A and !h and v>=1.85.0)]`. + +Their induced full-case domains are + +`D_S(c) := c in K and S(v,t,f,h)` and `D_I(c) := c in K and I(v,t,f,h)`. + +They are unequal and incomparable: + +* `(1.84.0,X,true,false)` is in Scarlet because its `X` clause has `!h`; it is not in Indigo because `h` and `v>=1.86.0` are both false. +* `(1.84.0,X,true,true)` is in Indigo because its `X` clause has `h`; it is not in Scarlet because `!h` and `v>=1.85.0` are both false. + +Thus neither `D_S subseteq D_I` nor `D_I subseteq D_S`; adding any `p in P`, `d in D`, and `i in O` lifts each witness to a full-case witness. + +Select the conservative audit domain + +`R(c) := D_S(c) or D_I(c)`. + +For every `c`, `D_S(c)` implies `R(c)` by the left disjunct, and `D_I(c)` implies `R(c)` by the right disjunct. Hence `D_S subseteq R` and `D_I subseteq R` separately. `R` is the union of the candidate commitments, used only as an audit requirement; it is not asserted to be the exact project promise. + +## Exact-version semantic premises + +For each of Rust 1.84.0, 1.85.0, and 1.86.0, the Reference states: “The `cfg` attribute conditionally includes the thing it is attached to based on a configuration predicate.” It further states: “If the predicate is true, the thing is rewritten to not have the `cfg` attribute on it. If the predicate is false, the thing is removed from the source.” It defines `all()` as true when all its predicates are true, and `not()` as true when its predicate is false. ([1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute); predicate definitions: [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation)). + +Each exact-version standard-library page says: “The `compile_error!` macro causes compilation to fail with the given error message when encountered.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). + +For `Option::unwrap_or`, each exact-version page says: “Returns the contained `Some` value or a provided default.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or)). For `Option::unwrap_unchecked`, each says: “Returns the contained `Some` value, consuming the `self` value, without checking that the value is not `None`,” and its Safety section says: “Calling this method on `None` is undefined behavior.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked)). These are three release-specific premise sets; no cross-release compatibility premise is used. + +## Selection and effective rejection + +`BUILD-MAP-POLICY` is consumed only here. For every `v in V` and `p in P`, it maps enabled `turbo`/`hardened` to their like-named feature cfgs and maps `X,A,W` to `x86_64,aarch64,wasm32`. With the quoted cfg rules, complete source inspection gives this exhaustive partition: + +* `!f`: the non-turbo function is included, the turbo function removed, and the compile error removed. +* `f and t in {X,A}`: the turbo function is included, the non-turbo function removed, and the compile error removed. +* `f and t=W`: both predicates in `all(feature="turbo",target_arch="wasm32")` are true, so `compile_error!` is included and compilation fails before a library API can execute. + +The source predicates mention neither `h`, profile, debug assertions, nor input; the partition is therefore parametric over those dimensions. Input exists only for an emitted API call. + +Policy-level exclusion is independent: for `f=true,t=W`, `!f` is false and every `X` or `A` conjunct is false in both `S` and `I`. Thus every such full case is absent from both policy domains. Source-level rejection additionally covers every such build in `K`, for either `h`, every profile and debug state, and any hypothetical input, relative to `BUILD-MAP-POLICY`. + +## API inventory and obligation ledger + +The sole language-reachable crate API is one configuration-selected safe free function `pub fn value_or_zero(Option)->u8`. There are no public fields, constructors, traits or impls, hidden items, callbacks, exported macros, unsafe APIs, or persistent invariant-bearing state. The only unsafe operation is `Some(value).unwrap_unchecked()` on the turbo branch. + +Define `spec(None)=0` and `spec(Some(x))=x`. + +| ID | Domain and obligation | Proof | Status | +|---|---|---|---| +| O-NT | Every `c in K` with `!f`: no UB and result `spec(i)` | `i.unwrap_or(0)` is a safe call and, by its quoted contract, returns `x` for `Some(x)` and the supplied `0` for `None` | **PROVED** | +| O-T-UNSAFE | Every `c in K` with `f,t in {X,A}`: receiver of `unwrap_unchecked` is not `None` | First `unwrap_or(0)` yields a `u8` named `value`; the receiver is then constructed at the call site as the `Some(value)` variant. It is therefore not `None`, satisfying the complete quoted safety obligation | **PROVED** | +| O-T-POST | Same cases: result `spec(i)` | The quoted contract returns the contained value, hence the unsafe call returns `value`; the first call made `value=spec(i)` | **PROVED** | +| O-REJECT | Every `c in K` with `f,t=W`: no shippable API case | Selection/rejection proof above | **PROVED**, relative to `BUILD-MAP-POLICY` | + +The local `SAFETY` comment records the decisive source fact but omits the callee obligation and returned-value consequence. The implementation proof is complete; the proof artifact is deficient under proof-grade documentation. Proposed replacement: + +```rust +// SAFETY: `unwrap_unchecked` requires the receiver not to be `None`. +// This receiver is constructed here as `Some(value)`, so that requirement +// holds; the operation returns the contained `value`. +``` + +This is a documentation finding, not an implementation defect or a caller-facing hidden precondition. + +## Full-case coverage and closure + +For this audit, `Required(c) := R(c)`. The soundness derivation covers + +`Covered_sound(c) := c in K and [!f or (f and t in {X,A})]`, + +and the behavioral derivation covers the identical full-case predicate + +`Covered_post(c) := c in K and [!f or (f and t in {X,A})]`. + +These predicates retain `v,t,f,h,p,d,i` through membership in `K`; O-NT and O-T quantify parametrically over every omitted fiber value, including every valid `Option`. + +For any `c in Required`, either its Scarlet or Indigo predicate holds. If `!f`, it is in both covered predicates by O-NT. If `f`, inspection of every positive disjunct of either exact policy shows `t=X` or `t=A`, so it is in both covered predicates by O-T-UNSAFE and O-T-POST. Therefore + +`Required subseteq Covered_sound intersection Covered_post`. + +This is the required whole-domain certificate for both **PROVED** verdicts. No sampled enumeration substitutes for it; version applicability is an exhaustive three-member partition backed by the three exact-version documentation sets. + +## TCB audit log, residual scope, and triggers + +* **BUILD-MAP-POLICY (IMPLEMENTATION/build tool): accepted.** Exact identity, proposition, scope, consumers, exclusions, and re-audit trigger are those in supplied `TCB.md`. Consumers here are only branch reachability and effective rejection. It supplies no Rust semantics or branch correctness. +* **AXIOM-CFG-{1.84,1.85,1.86}, AXIOM-COMPILE-{1.84,1.85,1.86}, AXIOM-OPTION-{1.84,1.85,1.86}: authoritative Rust premises.** Exact propositions, identities, quotations, version scopes, links, and consumers appear above. +* No other build-tool, compiler-implementation, dependency, environment, tool-derived, probabilistic, or compatibility premise is consumed. No test or tool evidence is claimed. + +Residual scope is compiler/backend/binary correctness and unsupported configurations. The exact project support-promise identity remains unresolved; an authorized precedence, supersession, intersection, union, or other rule is required to resolve it. Re-audit on any supplied source, manifest, policy, accepted TCB disposition/mapping, supported version/target/feature/profile/debug domain, or consumed authoritative contract change. + +All in-scope surfaces, configuration paths, unsafe obligations, mandatory postconditions, policy relationships, and full-case dimensions have a disposition above. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/D.md new file mode 100644 index 0000000000..abfd83fba2 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/D.md @@ -0,0 +1,196 @@ +# Focused unsafe-Rust source audit + +## Claim, snapshot, and verdicts + +The audited artifact is exactly the supplied `Cargo.toml`, `src/lib.rs`, two +published policies, and `TCB.md`: package `focused-predicate-target` 0.1.0, +edition 2021, with no dependencies or generated artifacts. The toolchain domain +is the three exact Rust/standard-library releases below. This is a source-level +claim under documented Rust abstract semantics, not a claim about compiler +backends or binaries. + +For a full case `c = (v,t,f,h,p,d,i)`, the claims are: (SND) every well-typed +safe call of the selected `value_or_zero` implementation is free of Rust UB; +and (POST) if it returns `r`, then +`Q(i,r) := (i=None => r=0) and (i=Some(n) => r=n)`. + +- **SND: PROVED** over `Required(c)` defined below, relative to accepted + `BUILD-MAP-POLICY` and the exact-version Rust axioms recorded below. +- **POST: PROVED** over the same domain and TCB. +- **Combined mandatory result: PROVED**, with the same qualification. + +Each published policy-induced domain is therefore covered separately. This +does **not** resolve which domain is the crate's exact support promise: both +policies are current and no rule chooses or combines them. + +## Exact policy predicates and full-case domains + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, where `X`, `A`, and `W` have the +exact triples defined in the policies; let `f,h,d` be Booleans, `P` be all +Cargo profiles, and `O` be every valid `Option` (`None` and every +`Some(n)` for valid `u8` `n`). Scarlet's exact configuration predicate is + +```text +C_S(v,t,f,h) := v in V and t in {X,A,W} and ( + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h) +) +``` + +Indigo's exact configuration predicate is + +```text +C_I(v,t,f,h) := v in V and t in {X,A,W} and ( + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0) +) +``` + +They are unequal and incomparable. `(1.84.0,X,true,false)` is Scarlet but not +Indigo. `(1.84.0,X,true,true)` is Indigo but not Scarlet. Thus neither +`C_S subseteq C_I` nor `C_I subseteq C_S`. + +The policy-induced full-case domains, without dropping any dimension, are + +```text +D_S(c) := C_S(v,t,f,h) and p in P and d in {false,true} and i in O +D_I(c) := C_I(v,t,f,h) and p in P and d in {false,true} and i in O +``` + +I select the conservative audit domain + +```text +Required(c) := D_S(c) or D_I(c). +``` + +Separately, `D_S(c) => Required(c)` by left disjunction introduction, and +`D_I(c) => Required(c)` by right disjunction introduction. Hence it contains +both candidate commitments. It is their audit union, not an authorized union +of support promises. + +## Configuration and API closure + +Define the dimension-preserving base + +```text +B(c) := v in V and t in T and f,h,d in {false,true} + and p in P and i in O +N(c) := B(c) and !f +U(c) := B(c) and f and t in {X,A} +Covered_SND(c) := N(c) or U(c) +Covered_POST(c) := N(c) or U(c) +``` + +Relative to `BUILD-MAP-POLICY`, feature and target values set the correspondingly +named `cfg` options. The exact-version `cfg` axioms then give this exhaustive +source partition: + +- On `N`, `#[cfg(not(feature="turbo"))]` includes lines 8--10 and removes lines + 14--19. The `compile_error!` item is removed. +- On `U`, the non-turbo definition is removed, the turbo definition at lines + 14--19 is included, and the `compile_error!` item is removed because the + target is not `wasm32`. +- For every `f=true,t=W` combination (all `v,h,p,d`), both policies exclude the + configuration: `!f` is false and both remaining disjuncts require `X` or + `A`. Independently, and conspicuously **relative to BUILD-MAP-POLICY**, the + source `all(feature="turbo",target_arch="wasm32")` predicate is true, so + lines 3--4 are included and `compile_error!` fails compilation. Thus every + turbo/wasm case is both policy-excluded and effectively source-rejected; no + runtime input is reached. + +For closure, take arbitrary `c` with `Required(c)`. Either policy conjunct +implies `B(c)`. If `!f`, then `N(c)`. If `f`, inspection of either exact policy +shows its satisfied turbo disjunct requires `t=X` or `t=A`, hence `U(c)`. +Therefore + +```text +Required subseteq Covered_SND +Required subseteq Covered_POST. +``` + +This argument is parametric in `h,p,d,i` rather than silently projecting them +away. The code contains no profile, hardened, or debug-assertion selector, so +those axes do not change either branch proof. + +The complete language-reachable API surface is one safe free function, +`pub fn value_or_zero(Option) -> u8`, with exactly one definition in each +buildable case above. There are no public fields, constructors, user traits, +macros, reexports, hidden items, FFI, allocation, concurrency, or invariant- +bearing state. The sole unsafe operation is the turbo definition's +`Option::unwrap_unchecked` call. + +## Obligation ledger and proofs + +| ID | Domain | Obligation | Derivation | Status | +|---|---|---|---|---| +| N-SND | `N(c)` | safe implementation has no UB | `unwrap_or(0)` is a safe standard-library call with the exact behavior below; there is no unsafe operation | PROVED | +| N-POST | `N(c)` | `Q(i,r)` | `unwrap_or` returns the contained value for `Some(n)` and the supplied `0` for `None` | PROVED | +| U-SND | `U(c)` | `unwrap_unchecked` receiver is not `None` | first `x=i.unwrap_or(0)`; the receiver is then syntactically constructed as `Some(x)`, so the sole stated safety prohibition is false | PROVED | +| U-POST | `U(c)` | `Q(i,r)` | `x=n` for `Some(n)` and `x=0` for `None`; unwrapping `Some(x)` returns its contained `x` | PROVED | + +These proofs quantify over every `i in O`. The `N` and `U` lemmas union to each +`Covered` predicate; the two containment results above supply the required +whole-domain certificates. + +The implementation proof at lines 17--18 is correct, but its `SAFETY` comment +is proof-documentation deficient: it gives the decisive local fact but omits +the callee's exact obligation and resulting postcondition. Proposed replacement +(review only; the source was not changed): + +```rust +// SAFETY: `Option::unwrap_unchecked` is UB when called on `None`. This +// receiver is constructed immediately as `Some(value)`, so it is not `None`; +// the call returns that contained `value`. +``` + +## Rust axioms and TCB audit log + +All quotations below were verified with identical relevant wording in the +three exact releases; no version interpolation or compatibility assumption is +used. + +- **AX-OR** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), + [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or): + “Returns the contained `Some` value or a provided default.” This proves both + case equations for the first operation on each branch. +- **AX-UNCHECKED** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked): + “Returns the contained `Some` value ... without checking that the value is + not `None`.” “Calling this method on `None` is undefined behavior.” These + supply the exact local prohibition, return fact, and UB consequence. +- **AX-CFG-PRED** — conditional-compilation pages for + [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), + [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), and + [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation): + a configuration-option predicate is “true if the option is set”; `all` is + “true if all of the given predicates are true”; `not` is “true if its + predicate is false.” +- **AX-CFG-ATTR** — `cfg`-attribute pages for + [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), and + [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute): + it “conditionally includes the thing it is attached to”; when false, “the + thing is removed from the source code.” +- **AX-COMPILE-ERROR** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), and + [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html): + “Causes compilation to fail with the given error message when encountered.” + +**BUILD-MAP-POLICY (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exactly the +toolchain-bundled Cargo releases for 1.84.0, 1.85.0, and 1.86.0 map the two +named features and three targets to the source `cfg` options as stated in +`TCB.md`, for every supported profile. It is consumed only by branch +reachability and effective rejection, never as a Rust semantic or branch- +correctness premise. Its identity, manifest/source/cfg changes, or human +disposition trigger re-audit. No other implementation premise is consumed. + +No tests, compilation, execution, macro expansion, or tool-derived proof was +used. Residual scope is the unresolved identity of the exact published support +promise and all backend/binary behavior; neither weakens the proved source +claims over the explicitly conservative audit domain. Re-audit is required for +changes to source, policies or conflict resolution, manifest/features/targets, +the accepted TCB mapping, supported Rust versions, or any cited contract. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/E.md new file mode 100644 index 0000000000..5906b3a8ab --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/E.md @@ -0,0 +1,191 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-only review of the supplied `Cargo.toml`, `src/lib.rs`, two +published policies, and `TCB.md`, at the 2026-08-01 audit cutoff. No generated +artifact, dependency, build, execution, test, backend, or binary claim is in +scope. + +| Claim | Verdict | +|---|---| +| Which policy is the crate's exact support promise | **UNPROVED**: Scarlet and Indigo are both current, are incomparable, and no resolution rule is authorized. | +| Freedom from Rust UB for every `value_or_zero` call in `Required` below | **PROVED relative to accepted `BUILD-MAP-POLICY`** and the exact-version Rust axioms below. | +| Documented result: contained byte, or zero for `None`, throughout `Required` | **PROVED relative to accepted `BUILD-MAP-POLICY`** and those axioms. | +| Source rejection of every named `turbo`/`wasm32` configuration | **PROVED relative to accepted `BUILD-MAP-POLICY`** and the cfg/`compile_error!` axioms. | + +Thus the combined source theorem over the explicitly conservative audit domain +is **PROVED relative to `BUILD-MAP-POLICY`**. This does **not** resolve or rename +that domain as the crate's published support promise. + +## Exact policies and full-case domains + +Let `V = {1.84.0, 1.85.0, 1.86.0}`, `X = +x86_64-unknown-linux-gnu`, `A = aarch64-unknown-linux-gnu`, and `W = +wasm32-unknown-unknown`. Let Boolean `f` and `h` mean `turbo` and `hardened`. +The exact Scarlet configuration predicate is + +```text +v in V and t in {X,A,W} and +(!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) +``` + +The exact Indigo configuration predicate is + +```text +v in V and t in {X,A,W} and +(!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +Write these predicates as `S(v,t,f,h)` and `I(v,t,f,h)`. They are neither +equal nor contained in one another: + +* `(1.84.0,A,true,true)` satisfies Scarlet but not Indigo. +* `(1.84.0,X,true,true)` satisfies Indigo but not Scarlet. + +Either witness becomes a separating full case, for example, by adding +`profile=dev`, `debug_assertions=false`, and `input=None`. + +Let `P` be the symbolic set of every Cargo profile, `B={false,true}`, and +`O={None} union {Some(x) | x is any valid u8}`. For +`c=(v,t,f,h,p,d,i)`, the two policy-induced full domains are exactly + +```text +D_S(c) := S(v,t,f,h) and p in P and d in B and i in O +D_I(c) := I(v,t,f,h) and p in P and d in B and i in O. +``` + +No input, profile, or debug-assertion dimension has been projected away. + +## Conservative domain and exclusions + +Define + +```text +F(c) := v in V and t in {X,A,W} and f,h in B + and p in P and d in B and i in O +Required(c) := F(c) and not(f and t = W). +``` + +This is the selected conservative audit domain. Separately for Scarlet: if +`D_S(c)` and `f` is false, `not(f and t=W)` follows immediately; if `f` is +true, Scarlet's only true turbo disjunct has `t=X` or `t=A`. Hence +`D_S subset Required`. The identical split for Indigo uses its turbo +disjuncts, also restricted to `X` or `A`, so `D_I subset Required`. The other +three full-case dimensions are universally identical in each policy and in +`Required`. This proves both containments without claiming policy equality. + +At policy level, setting `f=true,t=W` falsifies every disjunct in both policies, +for every `v,h,p,d,i`. At source level, `BUILD-MAP-POLICY` maps exactly that +feature/target selection to both cfg atoms; `all(...)` is true, the cfg keeps +the `compile_error!`, and compilation fails. Thus every such full case is both +policy-excluded and effectively rejected before an executable library is +produced. This rejection statement, unlike the Boolean policy calculation, +depends on the accepted build-map premise. + +## Applicable Rust axioms + +The following quoted prose is identical on each linked exact release; no +cross-release compatibility inference is used. + +* CFG-84/85/86: the Reference describes `cfg` as “conditionally includes”; + `all` is “true if all of the given predicates are true”; `not` is “true if + the given predicate is false”; a false cfg is “removed from the source.” + Sources: [1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), + [1.84 cfg attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), + [1.85 cfg attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), + [1.86 cfg attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +* CE-84/85/86: `compile_error!` “Causes compilation to fail with the given error + message when encountered.” Sources: [1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), + [1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), + [1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). +* OPTION-84/85/86: `unwrap_or` “Returns the contained `Some` value or a provided + default.” `unwrap_unchecked` “Returns the contained `Some` value”; “Calling + this method on `None` is undefined behavior.” Sources: + [1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), + [1.84 unchecked](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), + [1.85 unchecked](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), + [1.86 unchecked](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). + +## Branch proofs and obligation ledger + +The only language-reachable crate API is the safe free function +`value_or_zero(Option) -> u8`, with exactly one cfg-selected definition. +There are no public fields, user constructors, methods, traits/impls, callbacks, +macros exported by this crate, hidden items, FFI, or invariant-bearing state. + +**Non-turbo lemma (`F(c) and !f`).** CFG plus `BUILD-MAP-POLICY` selects the +first definition and removes the second. There is no unsafe operation. +OPTION-84/85/86 entails that `Some(x).unwrap_or(0)` returns `x` and +`None.unwrap_or(0)` returns `0`. This proves UB freedom and the documented +postcondition for every `v,t,h,p,d,i` in this lemma. + +**Turbo lemma (`F(c) and f and t in {X,A}`).** The accepted mapping and CFG +select the second definition; the wasm compile error is absent. First, +`i.unwrap_or(0)` produces `y=x` for `i=Some(x)` and `y=0` for `i=None`. +The receiver of the sole unsafe operation is then syntactically and immediately +constructed as `Some(y)`. It is therefore not `None`, discharging the complete +documented safety precondition of `unwrap_unchecked`; OPTION-84/85/86 says it +returns the contained `y`. Thus the operation is free of its documented UB and +the function returns `x` for `Some(x)`, otherwise `0`, for every retained +version, target, hardened state, profile, debug-assertion state, and input. + +`h`, profile, and debug assertions occur in neither body nor source-selection +predicate, and the proof is parametric over them. Target affects only the +separately proved compile-error gate. Each exact version has its own cited +premises. + +## Covered predicates and closure certificates + +Keeping every case dimension explicit, define + +```text +L0(c) := F(c) and !f +L1(c) := F(c) and f and t in {X,A} +Covered_sound(c) := L0(c) or L1(c) +Covered_behavior(c) := L0(c) or L1(c). +``` + +The two branch proofs establish their respective lemmas for both obligations. +If `Required(c)`, either `!f`, giving `L0`, or `f`; then `t` is one of +`{X,A,W}` and the exclusion forces `t in {X,A}`, giving `L1`. Conversely each +lemma satisfies `Required`. Hence +`Required = Covered_sound = Covered_behavior`, proving separately +`Required subset Covered_sound` and `Required subset Covered_behavior`. +Their pointwise intersection also equals `Required`, which is the combined +closure certificate. + +## TCB, documentation finding, and residual scope + +TCB log identity is the supplied `TCB.md`. `BUILD-MAP-POLICY` is accepted only +for the three exact Cargo/Rust releases, named feature-to-cfg mappings, +target-to-`target_arch` mappings, and the selection/rejection consumers above. +It supplies no Rust semantics or backend correctness. CFG, CE, and OPTION are +exact-version authoritative axioms, not implementation assumptions. No other +premise or tool evidence is consumed. + +The unsafe implementation is proved, but its adjacent safety comment is +proof-documentation deficient: it states the local `Some` fact without naming +the callee's `None`/UB obligation, cited contract, or resulting value. A compact +replacement is: + +```rust +// SAFETY: Option::unwrap_unchecked is UB only for None. This receiver is +// constructed immediately as Some(value), so it is not None; the call returns +// that contained value. +``` + +This documentation finding changes neither implementation verdict. There is no +proved UB witness and no UB-free postcondition counterexample. Residual scope is +the unresolved identity of the published support promise and all backend, +binary, custom-target, non-named-version, or changed-toolchain claims. Re-audit +is required by any source/manifest/policy/TCB change, support-domain expansion, +different Cargo or Rust release, or material change to a consumed Rust page. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/F.md new file mode 100644 index 0000000000..688b849351 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/F.md @@ -0,0 +1,194 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This source-only review covers the supplied `Cargo.toml`, `POLICY-SCARLET.md`, +`POLICY-INDIGO.md`, `TCB.md`, and `src/lib.rs` snapshot, with audit cutoff +2026-08-01. There are no dependencies, generators, expansions, or prior results +in the supplied evidence. No build, execution, test, or backend claim is made. + +For a full case + +`c = (v,t,f,h,p,d,i) = (version,target,turbo,hardened,profile,debug_assertions,input)`, + +the soundness theorem is: every well-typed safe call to the selected +`value_or_zero` in every required case is free of Rust undefined behavior. The +behavioral theorem is: if the call returns `r`, then + +`Q(i,r) := (i = None => r = 0) and (for every n, i = Some(n) => r = n)`. + +Results over the conservative domain `R` defined below: + +* **Soundness: PROVED relative to `BUILD-MAP-POLICY`.** +* **Documented postcondition `Q`: PROVED relative to `BUILD-MAP-POLICY`.** +* **Combined mandatory result: PROVED relative to `BUILD-MAP-POLICY`.** +* **Identity of the crate's exact support promise: UNPROVED.** Scarlet and + Indigo are both current, conflict, and have no authorized resolution. `R` is + an audit domain, not a resolution or newly inferred project promise. + +## Exact policy predicates and relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, with `X`, `A`, and `W` denoting +the three exact triples in the policies. Let `B={false,true}`, `P` be all Cargo +profiles, and `O` be every valid `Option`. + +The exact Scarlet configuration predicate is + +`S(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (!h or v>=1.85.0)) or (f and t=A and h)]`. + +The exact Indigo configuration predicate is + +`I(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (h or v>=1.86.0)) or (f and t=A and !h and v>=1.85.0)]`. + +They are **incomparable**, hence unequal: + +* `(1.84.0,X,true,false)` is in Scarlet: its `X` clause has `!h`; it is not in + Indigo because both `h` and `v>=1.86.0` are false. Thus `S` is not contained + in `I`. +* `(1.84.0,X,true,true)` is in Indigo: its `X` clause has `h`; it is not in + Scarlet because both `!h` and `v>=1.85.0` are false. Thus `I` is not + contained in `S`. + +The induced full-case domains, retaining every requested dimension, are + +`D_S(c) := S(v,t,f,h) and p in P and d in B and i in O`, and + +`D_I(c) := I(v,t,f,h) and p in P and d in B and i in O`. + +Select the conservative audit domain + +`R(c) = Required(c) := D_S(c) or D_I(c)`. + +For every full case, `D_S(c) => D_S(c) or D_I(c)` and independently +`D_I(c) => D_S(c) or D_I(c)`. Therefore `D_S` is contained in `R` and `D_I` +is contained in `R`; these are full-case, not configuration-projection, +containments. Conversely, `R = D_S union D_I` by definition, but that equality +does not resolve which current policy controls the project's promise. + +## Authorities and TCB + +For each exact release, its `Option` page states that `unwrap_or` “Returns the +contained `Some` value or a provided default”; `unwrap_unchecked` “Returns the +contained `Some` value”; and “Calling this method on `None` is undefined +behavior”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or). +The corresponding unsafe-method anchors are +[1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and +[1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +These separate exact-version axioms avoid any cross-release compatibility +assumption. + +For each release, the Reference says an option predicate is “true if the +configuration option is set”; `all` requires “all of the given predicates” to +be true, `not` is true when “its predicate is false,” and `cfg` “conditionally +includes” its attached item: [1.84.0 predicates](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.84.0 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85.0 predicates](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.85.0 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86.0 predicates](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), and +[1.86.0 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +Each exact-version macro page says `compile_error!` “causes compilation to fail +with the given error message when encountered”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). + +`BUILD-MAP-POLICY` is the sole additional TCB entry. It is accepted by the +authorized human and admits, only for the toolchain-bundled Cargo at the three +releases and supplied manifest/source, that feature enablement maps exactly to +the two feature cfgs and the three triples map respectively to `x86_64`, +`aarch64`, and `wasm32`. This audit consumes it only in source selection and +effective rejection below; it supplies no Option semantics or branch +correctness. Its limitations and re-audit triggers are exactly those in +`TCB.md`. No implementation, backend, dependency, tool-result, or environmental +premise is admitted. + +## Selection, exclusion, and effective rejection + +By the build mapping and cited cfg semantics, `!f` selects exactly the +`#[cfg(not(feature="turbo"))]` definition, while `f` selects exactly the +`#[cfg(feature="turbo")]` definition. Neither profile, `d`, `h`, nor `i` +occurs in these selectors, so this argument is parametric over their complete +fibers and is repeated under each release's exact Reference text. + +At policy level, if `f` and `t=W`, every disjunct in both `S` and `I` is false: +`!f` is false and each remaining disjunct requires `t=X` or `t=A`. Thus neither +policy induces such a full case and `R` excludes all of them. + +Independently, for every `v in V`, `h,d in B`, `p in P`, and `i in O`, the TCB +maps `f=true,t=W` to both `feature="turbo"` and `target_arch="wasm32"` being +set. `all(...)` is therefore true, its cfg includes `compile_error!`, and the +cited macro contract makes compilation fail. No library artifact or runtime +input is reached. This proves source-level effective rejection across the +entire stated `turbo`/`wasm32` case fiber, relative to the TCB; it is not used +to pretend those policy-excluded cases are members of `R`. + +For every `R(c)` with `f=true`, either policy's only possible true turbo +disjunct requires `t=X` or `t=A`. Hence the rejection condition is false and +the turbo source branch is the relevant branch. + +## Branch-local proofs and obligation ledger + +The sole public safe surface is `value_or_zero(Option) -> u8`, with one of +two configuration-specific definitions. There are no fields, constructors, +traits, impls, exported macros, hidden items, callbacks, FFI surfaces, or +stateful invariants. + +**OBL-NONTURBO (`R(c) and !f`).** The selected body is +`i.unwrap_or(0)`. For each `v` the exact-version safe-method contract yields +`0` when `i=None` and the contained `n` when `i=Some(n)`. Thus `Q` holds. The +body contains no unsafe operation, and the safe standard-library call is made +with its typed receiver and argument; soundness is proved for every `t,h,p,d,i` +in this fiber. + +**OBL-TURBO (`R(c) and f`).** First, the same release-specific `unwrap_or` +contract establishes a local byte `x=0` for `None`, or `x=n` for `Some(n)`. +Next the receiver at the unsafe site is syntactically and immediately +constructed as `Some(x)`. Therefore it is not `None`, discharging the exact +`unwrap_unchecked` safety obligation. Its documented result is the contained +value `x`; substitution of the first step proves `Q`. This proves both UB +freedom and behavior for every `t in {X,A}`, `h,p,d,i` admitted by `R` and for +each separately cited release. + +**DOC-1 (proof artifact deficient; implementation proved).** The existing +`SAFETY` comment records the decisive local fact but omits the callee's exact +`None`-UB obligation and the result used for `Q`. Suggested replacement: + +> SAFETY: `unwrap_unchecked` is UB on `None`. The receiver is exactly +> `Some(value)`, hence not `None`; the call returns its contained `value`. + +This is documentation debt, not a hidden caller obligation or implementation +defect. + +## Full-case Covered predicates and closure + +The two branch lemmas are universal over every omitted-dimension fiber, so no +dimension is projected away. State the proved predicates extensionally as + +`Covered_sound(c) := R(c)`, and `Covered_post(c) := R(c)`. + +Their derivation is the exhaustive partition `R(c) and !f` versus `R(c) and f`. +Boolean totality covers every `f`; the first is OBL-NONTURBO, and in the second +`R=>t in {X,A}` followed by OBL-TURBO applies. Each lemma retains `v,t,f,h,p,d,i`; +`p,d,h` are irrelevant because they neither select nor alter the body, while +`i` is handled parametrically as `None` or `Some(n)`. The release dimension is +exhausted by three release-specific authority/derivation instances. + +For soundness, `Required(c)=R(c)=Covered_sound(c)`, hence +`Required` is contained in `Covered_sound`. Independently, +`Required(c)=R(c)=Covered_post(c)`, hence `Required` is contained in +`Covered_post`. Claim-level coverage is their pointwise conjunction, not a +union: `Covered_sound(c) and Covered_post(c) = R(c)`. Therefore +`Required` is contained in aggregate `Covered`, certifying both PROVED verdicts +relative to `BUILD-MAP-POLICY`. + +## Residual scope and review triggers + +The unresolved item is solely which conflicting policy defines the exact +project promise; an authorized precedence/merge decision is required. Cases +outside `R`, including all turbo/wasm32 cases, versions outside `V`, targets +outside `T`, non-Cargo/custom build mappings, compiler/backend correctness, and +binary behavior are not affirmative audit claims. Re-audit on any source, +manifest, policy/resolution, supported-axis, feature/target mapping, TCB +disposition, or consumed exact-version Rust documentation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/G.md new file mode 100644 index 0000000000..0b6b32f772 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/G.md @@ -0,0 +1,116 @@ +# Focused unsafe-Rust source audit + +## Claim, scope, and verdicts + +The audited artifact is the complete supplied `focused-predicate-target` 0.1.0 source snapshot (`Cargo.toml`, both policy files, `TCB.md`, and `src/lib.rs`), edition 2021. This is a source-level Rust-abstract-semantics review at cutoff 2026-08-01; no build, execution, expansion, backend, or binary claim is made. There are no dependencies, generators, FFI, traits, fields, statics, or macros authored by the crate. The sole public surface is the safe function `value_or_zero(Option) -> u8`; its two definitions are configuration alternatives. The sole unsafe operation is `Option::unwrap_unchecked` at `src/lib.rs:18`. + +* **Soundness: PROVED** for every full case in `D_A` below, relative to accepted `BUILD-MAP-POLICY` and the exact-version Rust axioms quoted below. +* **Documented postcondition: PROVED** on `D_A`: the result is the contained byte for `Some(byte)` and zero for `None`, under the same qualification. +* **Effective turbo/wasm32 rejection: PROVED** on `R_W` below, relative to `BUILD-MAP-POLICY`. +* **Identity of the crate's exact support promise: UNPROVED.** Scarlet and Indigo are current, incomparable commitments and no resolution rule is authorized. `D_A` is an audit envelope, not a declaration that union is the project's resolved promise. + +There is no invariant-bearing state. The existing adjacent `SAFETY` comment is proof-documentation-deficient but the implementation obligation is proved by the reconstructed derivation below. + +## Exact policy predicates and relationships + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the policy-defined triples, and `B={false,true}`. Writing `f` for turbo and `h` for hardened, the exact Scarlet predicate is + +```text +S(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f + or (f and t=X and (!h or v>=1.85.0)) + or (f and t=A and h)) +``` + +and the exact Indigo predicate is + +```text +I(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f + or (f and t=X and (h or v>=1.86.0)) + or (f and t=A and !h and v>=1.85.0)). +``` + +They are unequal and incomparable. Witness `s=(1.84.0,X,true,false)` is in Scarlet because its `X` clause has `!h`, but not Indigo because both `h` and `v>=1.86.0` are false; hence `S⊄I`. Witness `i=(1.84.0,X,true,true)` is in Indigo because `h`, but not Scarlet because both `!h` and `v>=1.85.0` are false; hence `I⊄S`. + +Let `P` be all Cargo profiles, `O=Val(Option)={None}∪{Some(x)|x∈0..=255}`, and a full case be the requested + +```text +c=(v,t,f,h,p,d,input), where p∈P, d∈B, input∈O. +D_S(c) := S(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +D_I(c) := I(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +``` + +Select the conservative configuration predicate + +```text +U(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f or (f and t=X) or (f and t=A and (h or v>=1.85.0))) +``` + +and full audit domain + +```text +D_A(c) := U(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +Required(c) := D_A(c). +``` + +Separate containment certificates: every Scarlet disjunct implies the corresponding `U` disjunct (`!f`; `f∧t=X`; or `f∧t=A∧h`), so `D_S⊆D_A`. Every Indigo disjunct likewise implies `!f`, `f∧t=X`, or `f∧t=A∧v>=1.85.0`, so `D_I⊆D_A`. All four remaining case dimensions are preserved unchanged in both arguments. + +In fact `U=S∨I`: conversely, `!f` belongs to both; for `f∧t=X`, `h` selects Indigo and `!h` selects Scarlet; for `f∧t=A∧(h∨v>=1.85.0)`, `h` selects Scarlet, while `!h` forces `v>=1.85.0` and selects Indigo. This equality describes the chosen envelope; it does not resolve which published policy controls. + +## Applicable Rust premises and TCB + +For each exact release, the Reference says `cfg` “conditionally includes the thing it is attached to”; `all` is “true if all predicates are true,” and `not` is “true if its predicate is false”: [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). Each exact `compile_error!` page says it “Causes compilation to fail with the given error message when encountered”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). + +For each exact release, `unwrap_or` “Returns the contained `Some` value or a provided default”; `unwrap_unchecked` “Returns the contained `Some` value,” and its Safety section says, “Calling this method on `None` is undefined behavior”: [1.84.0 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.84.0 unchecked](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0 unchecked](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86.0 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), [1.86.0 unchecked](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). These are per-release premises; no cross-release compatibility inference is used. + +`BUILD-MAP-POLICY` is accepted human trust, limited exactly to Cargo 1.84.0/1.85.0/1.86.0 mapping the two named feature selections and the three named targets to their source `cfg` options for every supported profile. It is consumed only below for branch reachability and rejection. It supplies no Rust semantics or implementation correctness. No other non-authoritative premise is consumed. Re-audit on any trigger listed in `TCB.md`. + +## Selection, rejection, and branch proofs + +Define + +```text +R_W(c) := v∈V ∧ t=W ∧ f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +C_N(c) := v∈V ∧ t∈T ∧ !f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +C_T(c) := v∈V ∧ t∈{X,A} ∧ f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +``` + +**Turbo/wasm32.** Policy-level: with `f=true,t=W`, every non-`!f` disjunct in both `S` and `I` requires `t=X` or `t=A`; hence `R_W∩D_S=R_W∩D_I=∅`. Source-level: on every `R_W` case, `BUILD-MAP-POLICY` makes both leaves of `all(feature="turbo",target_arch="wasm32")` true. The exact-version `cfg` rules include the item and `compile_error!` rejects compilation. This is independent of `h,p,d,input`; the API is never executed. Thus every such policy-excluded configuration is also effectively rejected, rather than merely undocumented. + +**Non-turbo branch (`C_N`).** The build mapping plus exact-version `cfg` semantics includes lines 8–10 and excludes lines 14–19. For arbitrary full-case `input`, `input.unwrap_or(0)` returns its contained `x` for `Some(x)` and the provided `0` for `None`. There is no unsafe operation on this branch, and the documented postcondition holds. + +**Turbo non-wasm branch (`C_T`).** The rejection predicate is false because `t∈{X,A}`; the build mapping and `cfg` semantics include lines 14–19 and exclude lines 8–10. Let `r=input.unwrap_or(0)`. The cited contract gives `r=x` for `Some(x)` and `r=0` for `None`. The receiver of the unsafe call is constructed at that expression as `Some(r)`, so it is not `None`; the sole documented safety obligation is satisfied. The call returns the contained `r`, proving both absence of UB at the unsafe site and the public postcondition. + +Profiles and `debug_assertions` do not occur in source predicates or operations, and `h` affects policy membership but not selected code. The proofs therefore quantify parametrically over every `p,d,h,input`; no dimension is projected away. + +## Covered predicates and closure + +Let `Q(input,result)` mean `(input=None ∧ result=0) ∨ ∃x∈0..=255.(input=Some(x) ∧ result=x)`. The preceding per-release derivations establish, retaining the complete tuple: + +```text +Covered_sound(c) := C_N(c) ∨ C_T(c). +Covered_behavior(c) := C_N(c) ∨ C_T(c), with Q established. +``` + +For arbitrary `c` with `Required(c)=D_A(c)`: if `!f`, then `c∈C_N`; if `f`, predicate `U` forces `t=X` or `t=A`, hence `c∈C_T`. Every other coordinate is carried unchanged. Therefore + +```text +Required ⊆ Covered_sound +Required ⊆ Covered_behavior. +``` + +This supplies both whole-domain `PROVED` certificates. It also covers each candidate promise separately by `D_S⊆D_A` and `D_I⊆D_A`. The source-selection partition is exhaustive on `Required`; the separately proved `R_W` rejection lies outside it. + +## Finding: local proof text is incomplete + +`src/lib.rs:17` records the decisive local fact but does not state the callee's exact safety obligation or the postcondition used to prove the wrapper's behavior. This is documentation debt, not an implementation defect. Suggested adjacent replacement: + +```rust +// SAFETY: `unwrap_unchecked` requires that its receiver is not `None`. +// This receiver is constructed here as `Some(value)`, so that requirement +// holds; the operation returns the contained `value`. +``` + +No code change was authorized. Re-audit if source, either policy, the accepted build mapping, supported versions/targets/features/profiles, or any consumed Rust documentation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/H.md new file mode 100644 index 0000000000..f6d59e89a4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/H.md @@ -0,0 +1,210 @@ +# Focused unsafe-Rust source audit + +## Claim, snapshot, and verdicts + +This review covers the supplied `Cargo.toml`, `src/lib.rs`, both published +policy documents, and `TCB.md`, source-only, as inspected on 2026-08-01. The +crate is `focused-predicate-target` 0.1.0, edition 2021, with no dependencies, +build script, generator, or generated artifact. Nothing was built, expanded, +run, or tested. + +- **PROVED — source soundness:** every well-typed safe call to the selected + `value_or_zero` implementation is free of Rust undefined behavior over the + conservative audit domain `A` below, relative to accepted + `BUILD-MAP-POLICY` and the exact-version Rust axioms cited below. +- **PROVED — documented behavior:** on that same domain, normal return is the + contained byte for `Some(n)` and zero for `None`. +- **PROVED, TCB-qualified — effective rejection:** every considered + `turbo`/`wasm32` compilation is rejected, relative specifically to + `BUILD-MAP-POLICY` and the cited `cfg`/`compile_error!` contracts. +- **UNPROVED — identity of the project's exact support promise:** Scarlet and + Indigo are current, incomparable commitments, and no merge or precedence + rule is authorized. `A` is an audit domain, not a resolution of that + governance question. + +There is no `UNSOUND` or `CONTRACT-BROKEN` finding. + +## Exact policy and full-case domains + +Let + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +X = x86_64-unknown-linux-gnu +A = aarch64-unknown-linux-gnu +W = wasm32-unknown-unknown +B = {false, true} +P = the set of all Cargo profiles +O = {None} union {Some(n) | n is any u8, 0 <= n <= 255} +``` + +A full case is `c=(v,t,f,h,p,d,i)`, where `f` is `turbo`, `h` is +`hardened`, `p` is profile, `d` is `debug_assertions`, and `i` is input. Define + +```text +Base(c) := v in V and t in T and f,h,d in B and p in P and i in O. +``` + +The exact Scarlet configuration predicate is + +```text +S0(v,t,f,h) := + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h). +``` + +Its induced full-case domain is +`DS(c) := Base(c) and S0(v,t,f,h)`. + +The exact Indigo configuration predicate is + +```text +I0(v,t,f,h) := + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0). +``` + +Its induced full-case domain is +`DI(c) := Base(c) and I0(v,t,f,h)`. + +They are unequal and neither contains the other. The full case +`(1.84.0,X,true,false,dev,true,None)` is in `DS` because Scarlet's +`X and !h` clause holds, but not `DI` because both `h` and +`v >= 1.86.0` are false. Conversely, +`(1.86.0,A,true,false,dev,true,None)` is in `DI` because Indigo's +`A and !h and v >= 1.85.0` clause holds, but not `DS` because Scarlet's +`A` clause requires `h`. + +Select the conservative full-case audit domain + +```text +Required(c) := A(c) := DS(c) or DI(c). +``` + +The two required containments are immediate but separate: if `DS(c)`, then +the left disjunct establishes `A(c)`; if `DI(c)`, the right disjunct establishes +`A(c)`. Thus `DS subseteq A` and `DI subseteq A`. This exact union is chosen +only to audit every case promised by either document; it is not asserted to be +the project's support promise. + +## Policy exclusion and effective rejection + +For any `Base(c)` with `f=true` and `t=W`, neither policy holds: every `f=true` +disjunct in both `S0` and `I0` requires `t=X` or `t=A`. Hence no such case is in +`DS`, `DI`, or `Required`, for every `v,h,p,d,i`. + +Source rejection is independently stronger within `Base`. Accepted +`BUILD-MAP-POLICY` maps `f=true` to `cfg(feature="turbo")` and `t=W` to +`target_arch="wasm32"` for each exact release and every profile. The enclosing +`cfg(all(...))` therefore includes `compile_error!` for every such case, +independently of `h,d,i`. For each exact release, the Reference says: “The +`cfg` attribute conditionally includes the thing it is attached to based on a +configuration predicate.” ([1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute)). +The corresponding macro pages say: “Causes compilation to fail with the given +error message when encountered.” ([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). Thus no +library artifact containing a callable function is produced for these cases. + +## Surface and obligation inventory + +The complete crate-defined callable surface is one safe public free function, +`value_or_zero(Option) -> u8`, with mutually exclusive non-`turbo` and +`turbo` definitions. There are no public fields, constructors, user-defined +types or traits, callbacks, FFI items, reexports, hidden items, or exported +macros. `compile_error!` is the rejection site. The sole unsafe operation is +`Some(value).unwrap_unchecked()` in the `turbo` definition. There is no +persistent invariant-bearing state. + +For each `r` in `V`, the exact `Option` pages provide the same three premises: +“Returns the contained `Some` value or a provided default” for `unwrap_or`, +“Returns the contained `Some` value” for `unwrap_unchecked`, and “Calling this +method on `None` is undefined behavior.” See +[1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and +[1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +Using each release's own pages is an exhaustive three-member partition; no +cross-version compatibility premise is used. + +Let `Q(i,r)` mean `(i=None and r=0) or (there exists n: i=Some(n) and r=n)`. + +1. **Non-`turbo` branch.** For every full case with `f=false`, the build-map + premise and complementary `cfg` select this definition. If `i=None`, + `i.unwrap_or(0)` returns the provided zero; if `i=Some(n)`, it returns `n`. + The call is safe and establishes `Q` for every `i in O`; there is no unsafe + operation. +2. **`turbo` executable branch.** For every full case with `f=true` and + `t in {X,A}`, the `turbo` definition is selected and the rejection predicate + is false. The first `unwrap_or(0)` produces `x=0` from `None` and `x=n` from + `Some(n)`. The unsafe receiver is then syntactically constructed as + `Some(x)`, not `None`; therefore the exact `unwrap_unchecked` safety + obligation holds. It returns `x`, establishing `Q` in both input cases. + +These derivations are parametric in `t,h,p,d,i` where stated. `h`, profile, and +debug assertions do not occur in either function body; target affects only the +proved `W` rejection. Version is discharged by the exhaustive exact-document +partition above. + +## Covered predicates and closure certificates + +Without dropping any full-case dimension, define + +```text +Executable(c) := Base(c) and (!f or (f and t in {X,A})). +Covered_sound(c) := Executable(c). +Covered_post(c) := Executable(c). +Required_sound(c) := Required(c). +Required_post(c) := Required(c). +``` + +The branch lemmas prove soundness and `Q`, respectively, for every case in the +two `Executable` disjuncts, so these are the applicable aggregate coverage +predicates. If `Required(c)`, then `DS(c)` or `DI(c)`. Both imply `Base(c)`; if +`!f`, the first `Executable` disjunct holds, while if `f`, inspection of every +`f`-disjunct in both exact policy predicates gives `t in {X,A}`. Consequently +`Required_sound subseteq Covered_sound` and +`Required_post subseteq Covered_post`. These two pointwise containments certify +the whole-domain soundness and behavioral verdicts; coverage is not a union of +different obligations proved on different regions. + +## TCB, findings, and residual scope + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. Its human disposition +is accepted; its identity is the toolchain-bundled Cargo for exactly Rust +1.84.0, 1.85.0, and 1.86.0 acting on the supplied manifest/source. This report +uses it only for feature/target `cfg` reachability, branch selection, and +effective rejection, exactly its listed consumers. It is not used for Rust +semantics, branch correctness, compatibility, or binary/backend correctness. +The versioned Reference/std propositions above are authoritative Rust axioms, +not compatibility assumptions. There is no dependency, tool-result, external, +deployment, or probabilistic TCB entry. + +**POLICY-1 (UNPROVED governance claim).** The smallest missing premise is an +authorized rule selecting or combining Scarlet and Indigo. Resolution requires +a published precedence/supersession/merge decision; it would change domain +identity, not the proofs over `A` unless it adds cases outside `A`. + +**DOC-1 (proof-artifact deficiency; implementation proved).** The existing +SAFETY comment records the decisive local fact—construction as `Some`—but does +not state the consumed callee precondition. A proof-grade replacement is: + +```rust +// SAFETY: `unwrap_unchecked` requires the receiver not to be `None`. +// It is constructed immediately here as `Some(value)`, so that holds. +``` + +No implementation change is required for this finding. + +Excluded from the claims are configurations outside `Required`, emitted binary +correctness, compiler/backend/linker behavior, performance, and undocumented +robustness. Re-audit is required for any source, manifest, policy-resolution, +feature/target/profile support, TCB disposition or mapping, Rust-version scope, +or materially consumed authoritative-documentation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/I.md new file mode 100644 index 0000000000..f22113b8b0 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/I.md @@ -0,0 +1,190 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-level audit of the supplied `Cargo.toml` and `src/lib.rs` under +the two supplied policies, for Rust/standard-library releases 1.84.0, 1.85.0, +and 1.86.0. Scope comprises the public safe function `value_or_zero`, its two +conditionally selected definitions, the one `unwrap_unchecked` operation, its +documented return-value postcondition, and the `turbo`/`wasm32` rejection. There +are no dependencies, generated sources, build scripts, public fields, traits, +impls, exported macros, FFI surfaces, or representation invariants. + +| Claim | Verdict | Qualification | +|---|---|---| +| Freedom from Rust undefined behavior for every case in the conservative audit domain `Required` below | **PROVED** | Source semantics; relative to accepted `BUILD-MAP-POLICY` solely for mapping policy configurations to Rust `cfg`s/source selection | +| “Returns the contained byte, or zero when `value` is `None`” over that same domain | **PROVED** | Same qualification | +| Identity of the crate's exact support promise | **UNPROVED** | Scarlet and Indigo are incomparable current commitments and no resolution rule is authorized | + +Thus the mandatory soundness and behavioral claims are also **PROVED** +separately over each policy-induced domain, by their proved containment in +`Required`. This does not resolve which policy, union, intersection, or other +set is the actual project promise. No backend, binary, future-release, or +unsupported-configuration correctness is claimed. Audit cutoff: 2026-08-02; +the supplied policies contain no moving component. + +## Exact policy and full-case domains + +Let + +- `V = {1.84.0, 1.85.0, 1.86.0}`; +- `T = {X, A, W}`, with the triples defined exactly as in the policies; +- `B = {false, true}`; +- `P` be all Cargo profiles (as quantified by both policies); and +- `O = Valid(Option)`, including `None` and every `Some(x)` with valid + `x: u8`. + +For configuration `q=(v,t,f,h)`, the policies' exact predicates are + +```text +Scarlet(q) := v in V and t in T and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) + +Indigo(q) := v in V and t in T and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +They are unequal and incomparable. `(1.84.0,X,true,false)` is Scarlet: its +Scarlet `X` arm holds through `!h`; it is not Indigo because both `h` and +`v>=1.86.0` are false. Conversely `(1.84.0,X,true,true)` is Indigo through its +`h` term, but not Scarlet because both `!h` and `v>=1.85.0` are false. These +are explicit witnesses to `Scarlet ⊈ Indigo` and `Indigo ⊈ Scarlet`. + +A full case is exactly +`c=(v,t,f,h,p,d,i)`, for `p in P`, `d in B` (the `debug_assertions` state), +and `i in O`. Define + +```text +D_S(c) := Scarlet(v,t,f,h) and p in P and d in B and i in O +D_I(c) := Indigo(v,t,f,h) and p in P and d in B and i in O +Required(c) := D_S(c) or D_I(c) +``` + +`Required` is the selected conservative audit domain, not an asserted project +promise. For arbitrary full `c`, `D_S(c) => Required(c)` by left disjunction +introduction, and `D_I(c) => Required(c)` by right disjunction introduction; +these separately prove `D_S ⊆ Required` and `D_I ⊆ Required`. The same +two witnesses, extended with any `p,d,i`, show the full-case domains remain +incomparable. + +## Configuration selection and rejection + +For each exact release, the Reference says `all()` is “true if all … predicates +are true”, `not()` is “true if its predicate is false”, and a `cfg` attribute +“conditionally includes the thing … based on a configuration predicate”: +[1.84 predicates](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.84 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85 predicates](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.85 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86 predicates](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), +[1.86 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +The exact-version `compile_error!` pages identically state: “Causes compilation +to fail with the given error message when encountered.” +([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). + +Applying only the accepted `BUILD-MAP-POLICY`, `f` supplies +`cfg(feature="turbo")`, `h` supplies the analogous `hardened` option, and +`X/A/W` supply `target_arch="x86_64"/"aarch64"/"wasm32"`, for each listed +release and profile. Combining that admitted leaf mapping with the cited Rust +semantics proves: + +- if `!f`, exactly the `cfg(not(feature="turbo"))` function is included; +- if `f` and `t` is `X` or `A`, exactly the turbo function is included and the + `compile_error!` predicate is false; and +- if `f` and `t=W`, both operands of `all(...)` are true, so the error macro is + included and compilation fails. This rejection is independent of `h,p,d,i`. + +Policy-level exclusion is independent: substituting `f=true,t=W` makes `!f` +false and every `t=X`/`t=A` arm false in both predicates. Hence no such case is +in `D_S`, `D_I`, or `Required`. The source additionally rejects every such +build effectively, relative to `BUILD-MAP-POLICY`; it supplies no callable +library execution to which the runtime postcondition could apply. + +## Branch proofs and obligation ledger + +The exact 1.84/1.85/1.86 `Option` pages use identical controlling prose: +`unwrap_or` “Returns the contained `Some` value or a provided default”; +`unwrap_unchecked` “Returns the contained `Some` value”; and “Calling this +method on `None` is undefined behavior.” +([1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.84 `unwrap_unchecked`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.85 `unwrap_unchecked`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), +[1.86 `unwrap_unchecked`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked)). + +Let `Q(i,r)` mean `r=x` when `i=Some(x)`, and `r=0` when `i=None`. + +| Obligation | Full applicability | Derivation | Status | +|---|---|---|---| +| Non-turbo soundness and `Q` (`lib.rs:7-9`) | `v in V,!f,t in T,h,d in B,p in P,i in O` | Safe `unwrap_or(0)` returns the contained value or `0`; no unsafe operation occurs | **PROVED** | +| Turbo unsafe precondition (`lib.rs:16`) | `v in V,f,t in {X,A},h,d in B,p in P,i in O` | First `unwrap_or(0)` produces some byte `y`; the receiver is then constructed immediately as `Some(y)`, therefore it is not `None` | **PROVED** | +| Turbo `Q` (`lib.rs:13-16`) | same | `unwrap_unchecked` returns the contained `y`; the preceding `unwrap_or(0)` establishes `y=x` for `Some(x)` and `y=0` for `None` | **PROVED** | +| `turbo`/`W` effective rejection (`lib.rs:3-4`) | `v in V,f,t=W,h,d in B,p in P,i in O` | cfg derivation above; failure precedes any runtime input | **PROVED relative to BUILD-MAP-POLICY** | + +The branch proofs are parametric in target within their stated branch, +`h`, profile, debug assertions, and every valid input; none of those omitted +dimensions changes the source operations or the cited contracts. + +## Exact coverage and closure + +Define, without projecting any dimension, + +```text +Base(c) := v in V and t in T and f in B and h in B + and p in P and d in B and i in O +Compiles(c) := !f or (f and t in {X,A}) +Covered_sound(c) := Base(c) and Compiles(c) +Covered_post(c) := Base(c) and Compiles(c) +``` + +Here `Covered_sound` denotes exactly the full cases covered by the two +source-level absence-of-UB lemmas above, and `Covered_post` those covered by +their `Q` lemmas, within the audited versions/targets. For arbitrary `c` with +`Required(c)`, either policy predicate holds. If `!f`, `Compiles(c)` holds. If +`f`, every surviving arm in either exact predicate explicitly requires +`t=X` or `t=A`; hence `Compiles(c)` again holds. All other `Base` conjuncts are +retained verbatim by `D_S` and `D_I`. Therefore + +```text +Required ⊆ Covered_sound +Required ⊆ Covered_post. +``` + +These containments, the exhaustive `f` branch split, and the per-branch proofs +are the certificates for both whole-domain **PROVED** verdicts. + +## TCB disposition, finding, and residual scope + +TCB identity is the supplied `TCB.md`, entry `BUILD-MAP-POLICY`; disposition: +accepted. It is consumed only in source-selection and effective-rejection +lemmas. It supplies no Option semantics, branch correctness, version +compatibility, or backend correctness. The version-matched Reference/std +quotations above are authoritative `AXIOM` entries, each restricted to its +named release. No compatibility interpolation is used and no other assumption +or tool-derived evidence is consumed. + +**Documentation finding (implementation still PROVED).** The existing safety +comment records the decisive local fact—construction as `Some`—but omits the +callee's exact precondition and the result used for `Q`; the audit had to +reconstruct those material links. A proof-grade replacement is: + +```rust +// SAFETY: `Option::unwrap_unchecked` requires this receiver not to be `None`. +// It is constructed immediately as `Some(value)`, so that requirement holds; +// the call returns the contained `value`. +unsafe { Some(value).unwrap_unchecked() } +``` + +Re-audit on any source/manifest/policy/TCB change; a change to the three Rust +versions or cited contracts; or a change to feature names, targets, supported +profiles, or debug-assertion policy. Residual scope comprises invalid +`Option` values, versions/targets outside the stated sets, rejected builds, +compiler/backend/binary behavior, and resolution of the conflicting support +commitments. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/J.md new file mode 100644 index 0000000000..a78897af64 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/reports/J.md @@ -0,0 +1,168 @@ +# Focused unsafe-code audit + +## Claim, scope, and verdicts + +This audit covers the supplied `Cargo.toml`, `src/lib.rs`, two policy files, and +`TCB.md`, at the 2026-08-01 cutoff. It covers the public safe function +`value_or_zero`, its two configuration-selected implementations, the one +`unsafe` call, and the compile-time rejection item. There are no dependencies, +generated artifacts, unsafe public APIs, fields, traits, impls, callbacks, FFI, +assembly, or representation invariants in the supplied source. + +For the conservative audit domain `Required` defined below: + +| Claim | Verdict | Qualification | +|---|---|---| +| Every well-typed call with any valid `Option` is free of Rust UB | **PROVED** | Source-level Rust semantics; relative to accepted `BUILD-MAP-POLICY` for policy-to-`cfg` reachability | +| The call returns its contained byte, or zero for `None` | **PROVED** | Same domain and qualification | +| Combined mandatory claim | **PROVED** | `Required ⊆ Covered_sound ∩ Covered_post` is proved below | +| A single exact project support predicate can be selected from Scarlet and Indigo | **UNPROVED** | No precedence or conflict-resolution rule is authorized; the audit union is not such a resolution | + +These are source-level conclusions, not compiler-backend, binary, or platform +correctness claims. + +## Exact policy predicates and relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, where `X`, `A`, and `W` have the +triples defined in the policies, and let `f` and `h` be Boolean `turbo` and +`hardened` states. Scarlet supports exactly `v∈V ∧ t∈T` and: + +```text +!f +or (f and t = X and (!h or v >= 1.85.0)) +or (f and t = A and h) +``` + +Indigo supports exactly `v∈V ∧ t∈T` and: + +```text +!f +or (f and t = X and (h or v >= 1.86.0)) +or (f and t = A and !h and v >= 1.85.0) +``` + +They are unequal and incomparable. The configuration +`(1.84.0,X,true,false)` is Scarlet-only: Scarlet's `X ∧ !h` disjunct holds, +whereas every Indigo disjunct is false. Conversely, +`(1.84.0,X,true,true)` is Indigo-only: Indigo's `X ∧ h` disjunct holds, +whereas Scarlet requires `!h` or `v>=1.85.0`. Thus neither predicate contains +the other. Each separator extends to every policy-supported profile, +debug-assertion state, and valid input. + +## Full-case domains + +Let: + +```text +B = {false,true} +P = the symbolic set of all Cargo profiles +O = {None} ∪ {Some(n) | n∈{0,…,255}} +c = (v,t,f,h,p,d,i) +Base(c) := v∈V ∧ t∈T ∧ f∈B ∧ h∈B ∧ p∈P ∧ d∈B ∧ i∈O +``` + +Writing the displayed policy bodies as `S(v,t,f,h)` and `I(v,t,f,h)`: + +```text +D_S(c) := Base(c) ∧ S(v,t,f,h) +D_I(c) := Base(c) ∧ I(v,t,f,h) +Required(c) := D_S(c) ∨ D_I(c) +``` + +`D_S` and `D_I` are the exact Scarlet- and Indigo-induced full-case domains. +`Required` is the selected conservative audit domain. Separately, +`D_S⊆Required` and `D_I⊆Required` follow by disjunction introduction for +every complete tuple `c`; hence it contains both domains. No equality between +`Required` and an exact crate support promise is asserted: the latter remains +unresolved by the controlling documents. + +## Authoritative semantic premises + +The following wording was checked separately at every exact release, so no +cross-version compatibility assumption is used. + +* On the exact Option pages for [1.84.0 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), and [1.86.0 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), the contract says: “Returns the contained `Some` value or a provided default.” The corresponding [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked) `unwrap_unchecked` pages say “Returns the contained `Some` value” and, under Safety, “Calling this method on `None` is undefined behavior.” +* Each exact conditional-compilation Reference—[1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), and [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation)—defines `all()` as “true if all of the given predicates are true” and `not()` as “true if its predicate is false.” Their `cfg`-attribute sections ([1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute)) say it “conditionally includes” its attached item and that when the “predicate is false, the thing is removed.” +* The exact [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), and [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html) macro pages all state: “Causes compilation to fail with the given error message when encountered.” + +## Exclusion and effective rejection + +Define the full rejected region +`E(c):=Base(c) ∧ f ∧ t=W`. Both policies exclude every member: with +`f=true`, `!f` is false, and with `t=W`, every `t=X` or `t=A` turbo disjunct is +false. Therefore `E∩D_S=E∩D_I=∅`, independently of `h,p,d,i`. + +Source-level rejection is a separate fact. Relative to the accepted +`BUILD-MAP-POLICY`, every `c∈E` sets both `feature="turbo"` and +`target_arch="wasm32"`. The `all(...)` predicate is therefore true, its `cfg` +item is included, and the encountered `compile_error!` makes compilation fail. +Thus no `E` case produces a callable library artifact. `h`, profile, +`debug_assertions`, and runtime input do not occur in this rejection condition. + +## Branch and obligation proofs + +Define `g(None)=0` and `g(Some(n))=n`. + +**Non-turbo branch (`Base(c) ∧ !f`).** `BUILD-MAP-POLICY` plus the versioned +`cfg` rules selects the safe implementation. The exact-version `unwrap_or` +contract gives `value.unwrap_or(0)=g(i)` for both exhaustive input cases. +There is no unsafe operation on this branch, and it returns `g(i)`, proving +soundness and the documented postcondition. The argument is parametric in +`v,t,h,p,d` after applying the appropriate one of the three exact-version +premises. + +**Turbo, non-W branch (`Base(c) ∧ f ∧ t≠W`).** The mapping and `cfg` rules +select the turbo implementation without encountering the rejection item. +First, safe `unwrap_or(0)` establishes the local `value=g(i)`. The receiver of +the unsafe call is then the expression `Some(value)`, hence is not `None`. +This discharges the complete documented safety obligation of +`unwrap_unchecked`; its return contract yields the contained `value=g(i)`. +The execution is UB-free and returns exactly the documented result for every +`i∈O`. Again `h,p,d` and the non-W target identity do not affect the dataflow, +and each `v` uses its own exact documentation. + +The existing safety comment records the decisive checked fact, but omits the +callee's explicit not-`None` obligation. This is proof-documentation debt, not +an implementation defect. A complete adjacent replacement would be: + +```rust +// SAFETY: `unwrap_unchecked` requires its receiver not be `None`. +// The receiver is constructed here as `Some(value)`, so it is not `None`. +``` + +## Covered predicates and closure certificates + +Without projecting away any full-case dimension, let: + +```text +Covered_sound(c) := Base(c) ∧ !(f ∧ t=W) +Covered_post(c) := Base(c) ∧ !(f ∧ t=W) +Covered_reject(c):= Base(c) ∧ f ∧ t=W +``` + +For each of the first two obligations, `Covered` is the union of the exhaustive +`!f` proof case and the `f ∧ t≠W` proof case. For every `c∈Required`, the +full `Base(c)` conjunct holds. The policy-exclusion proof above also gives +`!(f ∧ t=W)`. Hence `Required⊆Covered_sound` and independently +`Required⊆Covered_post`; pointwise conjunction gives +`Required⊆Covered_sound∩Covered_post`. This is the certificate for both +whole-domain `PROVED` verdicts. `Covered_reject` records the disjoint, +effectively rejected source region; it is not treated as a callable-behavior +case. + +## TCB, evidence, residual scope, and triggers + +`BUILD-MAP-POLICY` is the sole additional accepted premise. Its identity is +the toolchain-bundled Cargo for exactly Rust 1.84.0, 1.85.0, and 1.86.0 on the +supplied manifest/source. Only its named feature-to-`cfg` and target-to- +`target_arch` mappings are consumed, solely for branch reachability and +effective rejection. No Rust semantics, backend behavior, or versions outside +`V` are inferred from it. The exact-version Rust pages above are authoritative +axioms, not a compatibility bridge. No test, execution, build, expansion, or +tool-derived result was used. + +Residual scope comprises configurations outside `Base`, binary/backend +correctness, and the unresolved identity of the crate's single support promise. +Re-audit is required by any source, manifest, policy, TCB disposition/mapping, +feature or target set, supported Rust release, relevant Rust documentation, or +documented `value_or_zero` contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s1/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/PACKET.json new file mode 100644 index 0000000000..f7d70971ca --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "ecb90a801bfbf51797749e1eddf95b85a1acba5acc92b2c061612a317150c81e", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "P", + "presentation_order": [ + "C", + "A", + "G", + "J", + "E", + "I", + "F", + "D", + "B", + "H" + ], + "report_sha256": { + "A": "19d9b069a036a6d9da00ebbec8e5a48315b9a414cf4c353ef71e4e75d0560f62", + "B": "3e11d4e6e869575bd8c807ef85277f7f29e39ef85e6ae177fb4ea073d0e27093", + "C": "a3a118b4fcf7d37b80907aa322d3fc9423419df81bed9dcff6d299415826068e", + "D": "61ae6ed7e4ce464b07d0ae2a4b8c6941d5089e33de766fa78600e570ab998621", + "E": "cde0cbd855bf963d66c656676cb1f817bfacdae74bdab5a5551953fb54166fdf", + "F": "54dd4275f961823031967d7aa3052b68653e4170c5eeb55fea4d8c45c05bc679", + "G": "c0e89f396556b32ab2d6611a875e30ae9243ba61206f445205b4a9c889b21a24", + "H": "c81b3b6430a1854a652a3f6d3866c08a4969453f770cd387c843f253ae8b01ac", + "I": "2704f92807aeb17dd1fc54a8fd5e62078d69443c921b458532bd1995e34738bf", + "J": "873d7f2d86630153a25fb9714624659e543f4198ad55b7db8ca0ebdcb8ebe503" + }, + "rubric_sha256": "1e9e6622a34b3b0376b6912f676695e318edcd971ac1f4960810531ad854911d", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s2", + "target_byte_tree_sha256": "2b194a735b69a8904b86baa43791a0ddac9f769ce32e87bf4e759822cb5cd52e" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/RUBRIC.md new file mode 100644 index 0000000000..90f2e84814 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/RUBRIC.md @@ -0,0 +1,565 @@ +# Mode P Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> **Evaluator-only material. Never expose this file to a report agent.** + +## P — Incomparable Predicates and Full-Case Closure + +### Canonical notation and policy algebra + +Use the fixture's notation: + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +F = H = D = {false, true} +P = every Cargo profile admitted by the supplied policies +I = {None} union {Some(b) | b is any u8} +case = (v, t, f, h, p, d, i) +``` + +The two exact configuration predicates are: + +```text +Scarlet(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)). + +Indigo(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)). +``` + +They are incomparable. For example: + +```text +(1.84.0, X, true, false) is Scarlet-only. +(1.84.0, X, true, true) is Indigo-only. +``` + +Any correct separating witness is acceptable. In particular, an answer need +not use the two examples above. There is no authorized rule identifying one +predicate, their intersection, their union, or any other combination as the +crate's controlling exact promise. + +The policy-induced full-case sets are: + +```text +ScarletCases = {case | Scarlet(v,t,f,h) and p in P and d in D and i in I} +IndigoCases = {case | Indigo(v,t,f,h) and p in P and d in D and i in I} +``` + +The canonical minimal conservative audit domain is their union: + +```text +Audit = ScarletCases union IndigoCases +Required(case) iff case in Audit +``` + +Its configuration projection has this equivalent exact formula: + +```text +UnionCfg(v,t,f,h) + iff v in V and t in T and + (!f + or (f and t = X) + or (f and t = A and (h or v >= 1.85.0))). + +Required(v,t,f,h,p,d,i) + iff UnionCfg(v,t,f,h) and p in P and d in D and i in I. +``` + +A report may instead choose a transparent full-case superset, provided it +proves `ScarletCases subset-of Audit` and `IndigoCases subset-of Audit` +separately and states a theorem whose meaning remains coherent for every added +case. The chosen set is an audit domain, not an inferred project promise. + +### Intended source proof + +Both policies exclude every configuration with `f = true` and `t = W`. +Relative only to accepted `BUILD-MAP-POLICY`, such a build selects +`cfg(all(feature = "turbo", target_arch = "wasm32"))`. The authoritative +`all`, `cfg`-attribute, and `compile_error!` contracts then establish that the +ordinary library compilation fails. This reasoning is parametric in `v`, `h`, +`p`, and `d`; there is no library input after compilation is rejected. + +For every compiled case selected by the audit domain: + +- when `f = false`, `unwrap_or(0)` returns the contained byte for `Some(byte)` + and zero for `None`; +- when `f = true`, the same `unwrap_or(0)` first produces that result `r`, the + source constructs `Some(r)`, and `unwrap_unchecked` is therefore invoked on + `Some`, never `None`; its return contract produces the same `r`. + +One exact full-case implementation region for both soundness and behavior is: + +```text +Covered(v,t,f,h,p,d,i) + iff v in V and t in T and f in F and h in H and p in P and d in D and i in I + and (!f or (f and t in {X,A})). +``` + +The source derivation is independent of `v`, `h`, `p`, `d`, and the particular +member of `I`, but those universally quantified dimensions remain in both +`Required(case)` and `Covered(case)`. Every disjunct of `UnionCfg` implies the +final source-selection clause above, so: + +```text +Required subset-of Covered_sound +Required subset-of Covered_behavior +``` + +The two covered predicates may be represented by the same set, but the unsafe +precondition proof and the postcondition proof are distinct obligations. + +### Expected conclusions + +- The identity of the controlling exact project predicate is **UNRESOLVED** + (equivalently, **UNPROVED** as a policy-identification proposition). +- Safe-API soundness on the chosen conservative full-case audit domain is + **PROVED relative to `BUILD-MAP-POLICY`**. +- The documented `value_or_zero` postcondition on that domain is **PROVED + relative to `BUILD-MAP-POLICY`**. +- Effective rejection of every `turbo`/`wasm32` build in the supplied release, + feature, profile, and debug-assertion scope is **PROVED relative to + `BUILD-MAP-POLICY`**. + +The qualification is required because the mapping from policy configuration +coordinates to Rust `cfg` options is an accepted tool premise, not a Rust +semantic axiom. + +### Scored atoms + +Each atom below scores exactly the proposition in its `proposition` field. +The other fields identify why that proposition is in scope and how to diagnose +a failure; they add no hidden report requirement. + +- **P1 — Exact Scarlet predicate** + - `proposition`: The report's `Scarlet(v,t,f,h)` set equals the predicate in + `POLICY-SCARLET.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Scarlet disjunct, including its versioned + x86 clause and hardened aarch64 clause. + - `dependencies`: none. + - `root_cause`: A wrong Scarlet formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P2 — Exact Indigo predicate** + - `proposition`: The report's `Indigo(v,t,f,h)` set equals the predicate in + `POLICY-INDIGO.md`. + - `scope_basis`: “Reproduce the exact Scarlet and Indigo configuration + predicates separately.” (`REQUEST.md`) + - `necessary_edge`: Expand every Indigo disjunct, including its versioned + x86 and unhardened aarch64 clauses. + - `dependencies`: none. + - `root_cause`: A wrong Indigo formula is the root cause even if it later + causes witness or containment failures. + - `accepted_alternatives`: Any logically equivalent formula, truth-table + partition, or exact finite set description. + +- **P3 — Scarlet-minus-Indigo witness** + - `proposition`: There exists a stated configuration in Scarlet but not + Indigo. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Scarlet and not Indigo`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Scarlet-only configuration. + +- **P4 — Indigo-minus-Scarlet witness** + - `proposition`: There exists a stated configuration in Indigo but not + Scarlet. + - `scope_basis`: “giving one concrete separating configuration in each + direction if neither contains the other.” (`REQUEST.md`) + - `necessary_edge`: Substitute the witness into both exact predicates and + establish `Indigo and not Scarlet`. + - `dependencies`: P1 and P2. + - `root_cause`: If substitution is correct only for a previously misstated + predicate, record that predicate atom as the originating failure. + - `accepted_alternatives`: Any valid Indigo-only configuration. + +- **P5 — Exact-promise status** + - `proposition`: The supplied policy evidence leaves the controlling exact + project predicate unidentified. + - `scope_basis`: “No precedence, supersession, intersection, union, or other + conflict-resolution rule has been authorized.” (`REQUEST.md`) + - `necessary_edge`: Keep policy identification separate from selection of a + conservative audit domain. + - `dependencies`: none. + - `root_cause`: Treating an analyst-selected set as policy evidence is the + originating error. + - `accepted_alternatives`: `UNRESOLVED`, or `UNPROVED` explicitly limited to + policy identification. + +- **P6 — Scarlet full-case domain** + - `proposition`: `ScarletCases` equals the Scarlet configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P1. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P7 — Indigo full-case domain** + - `proposition`: `IndigoCases` equals the Indigo configuration set crossed + with every admitted profile, both debug-assertion states, and every valid + `Option` input. + - `scope_basis`: “Define the full-case domain induced by each policy.” + (`REQUEST.md`) + - `necessary_edge`: Preserve all seven named coordinates in the set. + - `dependencies`: P2. + - `root_cause`: A missing coordinate is a theorem-domain recovery failure, + not an implementation-proof failure. + - `accepted_alternatives`: Product notation, a set comprehension, or exact + universally quantified prose. + +- **P8 — Scarlet containment** + - `proposition`: The chosen conservative full-case audit domain contains + `ScarletCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `ScarletCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P6 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Scarlet domain remains the originating + failure; an absent inclusion argument is independently P8. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P9 — Indigo containment** + - `proposition`: The chosen conservative full-case audit domain contains + `IndigoCases`. + - `scope_basis`: “Prove each containment separately.” (`REQUEST.md`) + - `necessary_edge`: Prove `IndigoCases subset-of Audit` from the actual + stated formulas. + - `dependencies`: P7 and the report's definition of `Audit`. + - `root_cause`: A malformed upstream Indigo domain remains the originating + failure; an absent inclusion argument is independently P9. + - `accepted_alternatives`: Membership in an exact union, algebraic + implication into a superset, or exhaustive finite proof. + +- **P10 — Scarlet wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Scarlet. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Scarlet predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P1. + - `root_cause`: A wrong Scarlet formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P11 — Indigo wasm exclusion** + - `proposition`: Every configuration with `f = true` and `t = W` is outside + Indigo. + - `scope_basis`: “Account for both policy-level exclusion ... of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Evaluate the Indigo predicate with those two fixed + coordinates while leaving `v` and `h` universal. + - `dependencies`: P2. + - `root_cause`: A wrong Indigo formula is upstream; failure to apply the + correct formula here is local. + - `accepted_alternatives`: Direct substitution or exclusion by disjuncts. + +- **P12 — Effective wasm rejection** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, every in-scope build with + `f = true` and `t = W` fails library compilation at the selected + `compile_error!`. + - `scope_basis`: “Account for ... source-level effective rejection of every + `turbo`/`wasm32` case.” (`REQUEST.md`) + - `necessary_edge`: Follow tool mapping to both true cfg options, apply + `all`, apply the `cfg` attribute, then apply `compile_error!`, universally + over release, hardened, profile, and debug-assertion coordinates. + - `dependencies`: exact TCB use and exact-version Rust authority. + - `root_cause`: The first absent edge among mapping, predicate selection, and + compile failure is the useful diagnosis. + - `accepted_alternatives`: An equivalent symbolic proof for all such builds; + enumeration is not required. + +- **P13 — Non-turbo postcondition** + - `proposition`: On every selected non-turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Apply the exact-version `unwrap_or(0)` contract to the + two `Option` variants. + - `dependencies`: exact Option authority. + - `root_cause`: Missing or inapplicable `unwrap_or` authority is the semantic + root; missing input quantification is a domain root. + - `accepted_alternatives`: Variant cases or one exact contract application. + +- **P14 — Turbo unsafe precondition** + - `proposition`: Every reachable turbo-branch `unwrap_unchecked` call has a + `Some` receiver. + - `scope_basis`: “Prove or refute the local safety obligation at the unsafe + operation.” (`REQUEST.md`) + - `necessary_edge`: Trace the value through `unwrap_or`, the local + `Some(value)` construction, and the unchanged receiver at the unsafe call. + - `dependencies`: exact Option authority and the inspected local source. + - `root_cause`: Failure to connect the constructed receiver to the call is a + local proof-edge failure, not a policy failure. + - `accepted_alternatives`: Any equivalent local proof that identifies the + exact call receiver; no control-flow argument is required. + +- **P15 — Turbo postcondition** + - `proposition`: On every selected turbo branch and every valid input, + `value_or_zero` returns the contained byte for `Some(byte)` and zero for + `None`. + - `scope_basis`: “Prove or refute ... the documented `value_or_zero` + postcondition on each selected source branch.” (`REQUEST.md`) + - `necessary_edge`: Compose `unwrap_or(0)`'s result with construction of + `Some(result)` and `unwrap_unchecked`'s return contract. + - `dependencies`: P14 and exact Option authority. + - `root_cause`: A safety proof alone does not supply the return-value edge; + diagnose that edge separately. + - `accepted_alternatives`: Direct composition or explicit `None`/`Some` + cases. + +- **P16 — Full Required predicate** + - `proposition`: The report's final `Required(case)` retains version, target, + both features, profile, debug assertions, and input over its chosen audit + domain. + - `scope_basis`: “State `Required(case)` ... without projecting away the + configuration or input dimensions.” (`REQUEST.md`) + - `necessary_edge`: Bind all seven coordinates before making a universal + conclusion. + - `dependencies`: P6 through P9. + - `root_cause`: Omission here is a final theorem-domain failure even if the + omitted axis happens not to affect source behavior. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may be symbolic. + +- **P17 — Full soundness Covered coordinates** + - `proposition`: `Covered_sound(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift the branch-local proof to a full-case predicate + rather than replacing the case by a configuration projection. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the branch proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P18 — Soundness Covered validity** + - `proposition`: Every case included in `Covered_sound(case)` has a complete + applicable unsafe-obligation derivation in the report. + - `scope_basis`: “State ... the applicable soundness ... `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after the branch-local + unsafe proof applies to that case. + - `dependencies`: P14 plus the inspected fact that the non-turbo branch uses + no unsafe operation. + - `root_cause`: An overbroad Covered set is an implementation-proof error, + not a theorem-domain recovery error. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P19 — Soundness closure** + - `proposition`: `Required subset-of Covered_sound` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration disjunct to its + proved source branch while carrying profile, debug, and input universally. + - `dependencies`: P8, P9, P14, and P16 through P18. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, local proof, or containment edge as cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P20 — Whole-domain soundness conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, safe-API soundness is + PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P19 as the certificate and no wider TCB proposition. + - `dependencies`: P19 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + source-level soundness, positive status, and TCB relativity. + +- **P21 — Full behavioral Covered coordinates** + - `proposition`: `Covered_behavior(case)` retains all seven case coordinates. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates without projecting away the configuration or input dimensions.” + (`REQUEST.md`) + - `necessary_edge`: Lift both branch-local return proofs to a full-case + predicate. + - `dependencies`: P16. + - `root_cause`: A dimensionless relation is a theorem-bookkeeping error even + when the return proof itself is correct. + - `accepted_alternatives`: Exact set notation or universally quantified + prose; irrelevant dimensions may remain symbolic. + +- **P22 — Behavioral Covered validity** + - `proposition`: Every case included in `Covered_behavior(case)` has a + complete applicable postcondition derivation in the report. + - `scope_basis`: “State ... the applicable ... behavioral `Covered(case)` + predicates.” (`REQUEST.md`) + - `necessary_edge`: Admit a case to Covered only after a branch-local return + proof applies to that case. + - `dependencies`: P13 and P15. + - `root_cause`: Do not infer this validity proposition from soundness; the + documented return theorem needs its own proof edges. + - `accepted_alternatives`: The canonical region or any other proved region; + no maximal positive-region characterization is required. + +- **P23 — Behavioral closure** + - `proposition`: `Required subset-of Covered_behavior` holds for the report's + stated full-case sets. + - `scope_basis`: “Give the set-containment argument needed for each + whole-domain conclusion.” (`REQUEST.md`) + - `necessary_edge`: Map every audit-domain configuration and input case to a + branch with the proved documented return. + - `dependencies`: P8, P9, P13, P15, P16, P21, and P22. + - `root_cause`: Record every downstream atom as failed when absent, but name + the earliest wrong predicate, postcondition proof, or containment edge as + cause. + - `accepted_alternatives`: Algebraic implication, structured cases, or an + exact finite proof; enumeration is not required. + +- **P24 — Whole-domain behavioral conclusion** + - `proposition`: Relative to exact `BUILD-MAP-POLICY`, the documented + postcondition is PROVED on the chosen audit domain. + - `scope_basis`: “state the strongest conclusions that the supplied evidence + justifies.” (`REQUEST.md`) + - `necessary_edge`: Use P23 as the certificate and no wider TCB proposition. + - `dependencies`: P23 and exact TCB accounting. + - `root_cause`: If closure is missing, that proof failure is primary; an + unqualified otherwise-correct verdict is a TCB-accounting failure. + - `accepted_alternatives`: Equivalent wording which clearly states domain, + exact postcondition, positive status, and TCB relativity. + +- **P25 — Exact TCB scope** + - `proposition`: Every proposition attributed to `BUILD-MAP-POLICY` is admitted by + that entry's exact identity, mapping, consumer, and release/profile region. + - `scope_basis`: “Apply it only to its exact build-tool mappings and + consumers.” (`REQUEST.md`) + - `necessary_edge`: Match each TCB-dependent conclusion to the supplied entry + without adding a semantic or backend proposition. + - `dependencies`: none; this is an accounting proposition. + - `root_cause`: An invented mapping is the primary error even if subsequent + cfg reasoning would be valid under it. + - `accepted_alternatives`: A compact TCB ledger or precise inline + qualifications. + +- **P26 — Conspicuous TCB qualification** + - `proposition`: Every conclusion which depends on `BUILD-MAP-POLICY` identifies + that dependency as an accepted trust premise rather than Rust authority. + - `scope_basis`: “keep every conclusion which depends on it conspicuously + qualified.” (`REQUEST.md`) + - `necessary_edge`: Carry the TCB label from configuration reachability into + each dependent rejection, soundness, and behavior conclusion. + - `dependencies`: none; this is a reporting proposition. + - `root_cause`: An otherwise valid but unconditional conclusion fails here; + do not misdiagnose it as a Rust-authority mismatch. + - `accepted_alternatives`: Inline `relative to BUILD-MAP-POLICY` wording or an + unambiguous shared qualification covering the dependent conclusions. + +- **P27 — Exact authority closure** + - `proposition`: Every material Rust semantic premise used in a positive + proof is paired with an applicable exact-version URL and a quotation which + supplies that premise. + - `scope_basis`: “For each material Rust semantic premise, cite the applicable + exact-version Rust Reference or standard-library page and quote the prose + which supplies that premise.” (`REQUEST.md`) + - `necessary_edge`: Reconcile the proof leaves against the authority inventory + below; a page label alone supplies no unstated proposition. + - `dependencies`: every positive Rust-semantic derivation. + - `root_cause`: Identify the first missing, mismatched, or overclaimed + quotation; do not treat one omission as multiple distinct authority roots. + - `accepted_alternatives`: Shorter exact excerpts and different organization + are acceptable when the proposition and release applicability are clear. + +### Hard errors + +A mere omission, an explicit refusal to close a proposition, or a downstream +atom failure caused by a disclosed upstream gap is not by itself a hard error. +Record a hard error only for the corresponding false affirmative claim below: + +- **PH1:** selects Scarlet, Indigo, their intersection, their union, or another + combination as the controlling exact project promise without new policy + evidence; +- **PH2:** relabels an analyst-selected conservative audit domain as the exact + project promise; +- **PH3:** asserts containment or incomparability using a stated formula and + witness which do not establish the asserted set relation; +- **PH4:** claims whole-domain soundness or behavior after dropping a required + configuration or input coordinate, or without a valid full-case + `Required subset-of Covered` argument; +- **PH5:** treats `turbo`/`wasm32` as policy-supported, or claims effective + rejection without the exact accepted mapping and applicable `all`, `cfg`, and + `compile_error!` implications; +- **PH6:** calls the shown source `UNSOUND` or calls its documented + postcondition `CONTRACT-BROKEN` on the supplied audit domain; +- **PH7:** invents or widens `BUILD-MAP-POLICY`, treats it as Rust authority, or uses + it outside its exact identity, propositions, consumers, or region. + +Record independently applicable global hard errors as well. + +### Exact authority propositions, quotations, and URLs + +The following quotations were checked on every listed exact-version page. The +quotation is the semantic content; presence on an allowlist is not itself +evidence for a proposition. + +For Rust 1.84.0, 1.85.0, and 1.86.0, the `Option` pages describe `unwrap_or` +using the “contained `Some` value” or “provided default,” and +`unwrap_unchecked` returning the “contained `Some` value.” Its Safety heading +says calling it on `None` “is undefined behavior.” Construction of +`Some(value)` is an immediate inspected source fact, not a separately cited +semantic premise. + +Exact pages, in canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or` +- `https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked` + +For each of the same releases, the Conditional Compilation chapter says a +configuration predicate is “true if the option is set,” `all` requires “all of +the given predicates” to be true, and `not` is true when its “predicate is +false.” The `cfg` attribute “conditionally includes” its attached item. Those +checked excerpts supply exactly the source-selection implications used here. + +The standard-library macro page states: + +- “Causes compilation to fail with the given error message when encountered.” + +Exact pages, continuing canonical allowlist order: + +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation` +- `https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute` +- `https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html` + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. No policy sentence, +Cargo minimum, evaluator oracle, test result, CI result, or inferred tool +behavior is a Rust semantic axiom. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/allowlist.txt new file mode 100644 index 0000000000..0e8296d465 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/allowlist.txt @@ -0,0 +1,15 @@ +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or +https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation +https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute +https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/A.md new file mode 100644 index 0000000000..1fb5ea7ca5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/A.md @@ -0,0 +1,197 @@ +# Focused unsafe Rust source audit + +## Claim, snapshot, and verdicts + +This review covers the supplied `Cargo.toml`, `POLICY-SCARLET.md`, +`POLICY-INDIGO.md`, `TCB.md`, and `src/lib.rs` source snapshot, under Rust +1.84.0, 1.85.0, and 1.86.0. It is source-level only: no compiler/backend, +binary, tests, generated artifacts, dependencies, or prior audit are claimed. +Review date/audit cutoff: 2026-08-01. The support documents are static for this +snapshot, so the cutoff does not resolve their conflict. + +| Claim | Verdict | Qualification | +|---|---|---| +| Every well-typed safe call of `value_or_zero` in `Required` is free of Rust UB | **PROVED** | Relative to `TCB-BUILD-MAP` only for mapping policy configurations to source branches; branch correctness uses the version-specific Rust axioms below. | +| The call returns the contained byte, or zero for `None`, throughout `Required` | **PROVED** | Same qualification. | +| Every `turbo`/`wasm32` configuration is rejected before a library artifact is produced | **PROVED** | Conspicuously conditional on `TCB-BUILD-MAP`; this is a compilation claim, not a runtime-input claim. | +| One uniquely determined exact project support predicate can be recovered | **UNPROVED** | Scarlet and Indigo are incomparable current exact commitments, and no resolution rule is authorized. | + +The combined mandatory soundness-and-requested-behavior result is **PROVED over +the conservative audit domain `Required` defined below, relative to +`TCB-BUILD-MAP`**. `Required` is not asserted to be the crate's exact support +promise. + +## Exact predicates and full-case domains + +Let + +* `V = {1.84.0, 1.85.0, 1.86.0}`; +* `X = x86_64-unknown-linux-gnu`, `A = aarch64-unknown-linux-gnu`, and + `W = wasm32-unknown-unknown`; +* `B = {false,true}`; `f` means `turbo`, and `h` means `hardened`; +* `P` be the symbolic set of **all Cargo profiles** (no finite enumeration is + substituted); and +* `O = {None} union {Some(n) | n is any u8}`, exactly every valid `Option`. + +For the full case `c=(v,t,f,h,p,d,o)`, with `d` the state of debug assertions, +the separately reproduced configuration predicates are + +```text +S(v,t,f,h) := v in V and t in {X,A,W} and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) + +I(v,t,f,h) := v in V and t in {X,A,W} and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +Their induced full-case domains, preserving every dimension, are + +```text +D_S(c) := S(v,t,f,h) and p in P and d in B and o in O +D_I(c) := I(v,t,f,h) and p in P and d in B and o in O. +``` + +Neither contains the other. `(1.84.0,X,true,false)` satisfies Scarlet's +`t=X and !h` term but not Indigo's `h or v>=1.86.0`, so `S` is not a subset of +`I`. Conversely, `(1.84.0,X,true,true)` satisfies Indigo's `t=X and h` term but +not Scarlet's `!h or v>=1.85.0`, so `I` is not a subset of `S`. Extending either +witness with any `p in P`, `d in B`, and `o in O` separates the full-case +domains. Thus they are unequal and incomparable. + +Select the least union as the conservative audit configuration predicate: + +```text +U(v,t,f,h) := S(v,t,f,h) or I(v,t,f,h) + = v in V and t in {X,A,W} and + (!f or (f and + (t = X or (t = A and (h or v >= 1.85.0))))) + +Required(c) := U(v,t,f,h) and p in P and d in B and o in O. +``` + +The equality follows by cases. For `!f`, both policies admit every listed +`v,t,h`. For `f,t=X`, Scarlet admits every `h=false` case and Indigo every +`h=true` case, hence all `v,h`. For `f,t=A`, Scarlet admits all `h=true` cases, +while Indigo admits precisely `h=false,v>=1.85.0`, yielding +`h or v>=1.85.0`. Neither admits `f,t=W`. Separately, `D_S subseteq Required` +because `S implies S or I`, and `D_I subseteq Required` because +`I implies S or I`; the other full-case conjuncts are identical. This proves +both required containments without resolving which policy is authoritative. + +## Authority and TCB audit log + +For each of 1.84.0, 1.85.0, and 1.86.0, the applicable Reference pages are: +[conditional predicates 1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), +and [`cfg` attribute 1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +They state, respectively, “It is true if all of the given predicates are true” +and “It is true if its predicate is false”; for item selection: “If the +predicate is true, the thing is rewritten to not have the cfg attribute ... If +the predicate is false, the thing is removed”. These are `AX-CFG-{84,85,86}`. + +The exact-version `compile_error!` pages +([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)) say: +“Causes compilation to fail with the given error message when encountered.” +These are `AX-COMPILE-ERROR-{84,85,86}`. + +The exact-version `Option` pages are +[`unwrap_or` 1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), +and [`unwrap_unchecked` 1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +Each says `unwrap_or` “Returns the contained `Some` value or a provided +default”; `unwrap_unchecked` “Returns the contained `Some` value”, while +“Calling this method on `None` is undefined behavior.” These are +`AX-OPTION-{84,85,86}` and supply separate exhaustive version coverage—no +cross-version compatibility assumption is used. + +`TCB-BUILD-MAP` is the sole non-axiom entry: the accepted `BUILD-MAP-POLICY` in +`TCB.md`, with the exact three toolchain-bundled Cargo releases, manifest, named +features, targets, and all supported profiles. It admits only that enabled and +disabled features set and do not set their matching feature predicates, and +that `X/A/W` set `target_arch` to `x86_64/aarch64/wasm32`. It is consumed only +to map policy cases to source reachability and to prove effective rejection. +It supplies no Rust semantics, branch correctness, compatibility, or binary +correctness. Its disposition is accepted by the authorized human reviewer. +No other TCB premise is consumed. + +## API, rejection, and obligation proofs + +The complete exposed surface is one safe free function, `value_or_zero`, with +two mutually exclusive `cfg` definitions. There are no public fields, +constructors, traits/impls, macros generating APIs, hidden items, callbacks, +FFI, allocation, concurrency, or invariant-bearing state. The only unsafe +operation is `Option::unwrap_unchecked` at `src/lib.rs:18`. No generated code or +tool-derived evidence exists. + +Define `Q(None)=0` and `Q(Some(n))=n`, and define the actually proved source +case predicate without dropping any axes: + +```text +K(c) := v in V and t in {X,A,W} and f in B and h in B + and p in P and d in B and o in O +Covered_sound(c) := K(c) and (!f or t != W) +Covered_behavior(c) := K(c) and (!f or t != W). +``` + +* **Non-turbo branch (`!f`).** `TCB-BUILD-MAP` plus `AX-CFG-v` selects only + lines 7-10. `o.unwrap_or(0)` returns the contained `n` for `Some(n)` and the + provided `0` for `None`, so it returns `Q(o)`. There is no unsafe operation. +* **Turbo, non-wasm branch (`f and t!=W`).** The same reachability premises + select lines 13-19 and do not encounter the compile error. The first + `unwrap_or(0)` establishes local fact `r=Q(o)`. The unsafe receiver is then + constructed syntactically as `Some(r)`. Its exact safety obligation is “the + receiver is not `None`”; construction proves it. `AX-OPTION-v` then gives + both absence of the documented UB and return value `r=Q(o)`. This proof is + parametric in `h,p,d,o` and partitioned exhaustively by each exact `v` axiom. +* **Every turbo/wasm case.** Both policies exclude it: when `f` is true, their + only target terms require `X` or `A`. Independently, for every `v in V`, + `h,p,d`, and would-be `o`, `TCB-BUILD-MAP` makes both operands of the + crate-level `all(feature="turbo",target_arch="wasm32")` true; + `AX-CFG-v` retains the macro and `AX-COMPILE-ERROR-v` makes compilation fail. + Thus no call/input execution exists. This enforcement conclusion must not be + detached from its accepted TCB premise. + +`U` implies `!f or t=X or t=A`, hence `U implies (!f or t!=W)`. All remaining +conjuncts of `Required`, `Covered_sound`, and `Covered_behavior` are identical. +Therefore, separately, +`Required subseteq Covered_sound` and +`Required subseteq Covered_behavior`. The aggregate coverage predicate is their +intersection, which is the same predicate, so `Required` is contained in it. +This is the whole-domain certificate for both **PROVED** verdicts. + +## Findings, residual scope, and maintenance + +`F-POLICY`: the support-promise identity remains **UNPROVED**. The smallest +missing premise is an authorized rule selecting, merging, or otherwise +reconciling Scarlet and Indigo. The conservative union prevents that policy +defect from leaving either candidate domain unaudited, but does not repair it. + +The implementation obligation at line 18 is proved. Its adjacent safety +comment records the decisive local `Some` construction, but omits the callee's +exact “not `None`” obligation. A proof-grade replacement is: + +```rust +// SAFETY: `unwrap_unchecked` requires this receiver not to be `None`. +// It is constructed immediately here as `Some(value)`, so that holds. +``` + +This is proof-documentation debt, not an implementation defect. No UB witness +or UB-free postcondition counterexample exists in the audited domain. + +Residual scope excludes unsupported configurations and all binary/backend +correctness. Re-audit is required for any source/manifest/policy change, +resolution of the policy conflict, Rust or cited-documentation version change, +feature/target/profile scope change, or any change to `TCB-BUILD-MAP` identity, +mapping, disposition, or consumers. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/B.md new file mode 100644 index 0000000000..0a338f08b0 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/B.md @@ -0,0 +1,106 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-only audit of the exact supplied `Cargo.toml`, `src/lib.rs`, two policy documents, and `TCB.md`, cut off 2026-08-01. No generated code, dependencies, tests, execution, macro expansion, backend, or binary claim is in scope. The public surface is the safe free function `value_or_zero(Option) -> u8`, with mutually conditional definitions. The only unsafe operation is `Option::unwrap_unchecked` in the `turbo` definition. There are no public fields, constructors, traits, callbacks, FFI items, invariant-bearing representations, or other exported items. + +Verdicts: + +- **PROVED, relative to accepted `BUILD-MAP-POLICY` and the version-specific Rust axioms below:** every well-typed call in the conservative full-case audit domain is free of Rust undefined behavior. +- **PROVED under the same qualification:** every such call returns the contained byte, or zero for `None`. +- **PROVED under the same qualification:** every `turbo`/`wasm32` compilation in the stated version/feature/profile/debug domain is rejected before a library artifact is produced. +- **UNPROVED (policy identity only):** which one set, if any, is the crate's exact support promise. Scarlet and Indigo are incomparable current commitments and no resolution rule is authorized. The conservative audit domain below is not a resolution or a new support promise. + +## Exact domains and relationships + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the triples defined by the policies, `B={false,true}`, `P` be all Cargo profiles, and +`O={None} union {Some(n) | n is a valid u8}`. A full case is +`c=(v,t,f,h,p,d,i) in V x T x B x B x P x B x O`. + +The exact configuration predicates are: + +```text +S_cfg(v,t,f,h) := v in V and t in T and ( + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h) +) + +I_cfg(v,t,f,h) := v in V and t in T and ( + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0) +) +``` + +Their induced full-case domains are +`S(c):=S_cfg(v,t,f,h) and p in P and d in B and i in O` and identically +`I(c):=I_cfg(v,t,f,h) and p in P and d in B and i in O`. + +Neither contains the other. The configuration `(1.84.0,X,true,false)` is in Scarlet: its `X and !h` term is true; it is not in Indigo because both `h` and `v>=1.86.0` are false. Conversely `(1.84.0,X,true,true)` is in Indigo by `X and h`, but not Scarlet because both `!h` and `v>=1.85.0` are false. Each satisfies the common `V,T` bounds; choosing any `p,d,i` lifts each witness to the corresponding full-case difference. + +Select the conservative audit domain `A(c):=S(c) or I(c)`. Equivalently its configuration part is + +```text +A_cfg := v in V and t in T and ( + !f or (f and t = X) or + (f and t = A and (h or v >= 1.85.0)) +). +``` + +Proof of equality: `S_cfg or I_cfg` has no `f,W` disjunct; for `f,X`, `h` selects Indigo and `!h` selects Scarlet, so every `v,h` is included; for `f,A`, Scarlet contributes `h` and Indigo contributes `!h and v>=1.85.0`. Conversely, each displayed normalized case selects the named policy term: `!f` selects both; `f,X,h` selects Indigo; `f,X,!h` selects Scarlet; `f,A,h` selects Scarlet; and `f,A,!h,v>=1.85.0` selects Indigo. Thus both directions hold. Separately, `S subseteq A` and `I subseteq A` follow by disjunction introduction, with every `p,d,i` unchanged. + +Accordingly `Required_S(c)=S(c)` and `Required_I(c)=I(c)`. There is no authorized unique crate-level `Required`. For the conservative audit theorem only, `Required_A(c)=A(c)`. + +## Authorities and TCB + +For each of Rust 1.84.0, 1.85.0, and 1.86.0, the exact-version Conditional Compilation pages state: “The predicate is true if the option is set and false if it is unset”; for `all`, “It is true if all of the given predicates are true, or if the list is empty”; and for `not`, “It is true if its predicate is false and false if its predicate is true.” The `cfg`-attribute section states: “The `cfg` attribute conditionally includes the thing it is attached to based on a configuration predicate” and “If the predicate is false, the thing is removed from the source code.” ([1.84 predicate](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.84 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute); [1.85 predicate](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), [1.85 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute); [1.86 predicate](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), [1.86 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute).) + +At each exact version, `compile_error!` “causes compilation to fail with the given error message when encountered.” ([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html).) + +At each exact version, `unwrap_or` “Returns the contained `Some` value or a provided default.” ([1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or).) `unwrap_unchecked` “Returns the contained `Some` value ... without checking that the value is not `None`,” and its Safety clause says: “Calling this method on `None` is undefined behavior.” ([1.84](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked).) Direct per-release citations avoid any compatibility premise. + +`BUILD-MAP-POLICY` is the sole admitted non-axiom premise. The authorized reviewer accepts, only for the three bundled Cargo releases, supplied manifest/source, all supported profiles, named feature cfgs, and three target-to-`target_arch` mappings, exactly the mapping recorded in `TCB.md`. It is consumed only for source selection and rejection. It supplies no Rust semantics or branch correctness. Every whole-case verdict above depends on it; local reasoning about an already-selected definition does not. No tool-derived evidence or other premise is used. + +## Selection, rejection, and local proofs + +Under the TCB mapping and cited cfg rules, `f=false` selects exactly the `not(feature="turbo")` definition; `f=true` selects exactly the other definition. Neither `h`, `p`, `d`, `v`, nor a non-wasm target changes either value computation. + +For every hypothetical full `turbo`/`wasm32` case +`E(c):=v in V and t=W and f and h in B and p in P and d in B and i in O`, both policies exclude it: `!f`, `t=X`, and `t=A` are all false in each predicate. Independently, the TCB makes both leaves of `all(feature="turbo",target_arch="wasm32")` true; the cited `all` and cfg rules therefore include `compile_error!`, whose cited contract fails compilation. This proof is uniform over `v,h,p,d`; rejection precedes and is independent of runtime `i`. Thus `E` contains no shippable library case and is not silently counted as covered API execution. + +Define `q(None)=0` and `q(Some(n))=n`. + +- Non-turbo: `value.unwrap_or(0)` returns the contained `n` for `Some(n)` and the supplied default `0` for `None`. It is the documented safe operation, so every `i in O` is UB-free and the result is `q(i)`. +- Turbo: the first `unwrap_or(0)` produces `x=q(i)`. The unsafe receiver is then constructed locally as `Some(x)`, hence is not `None`. This proves the entire cited safety obligation for `unwrap_unchecked`; its return contract yields the contained `x=q(i)`. Thus every `i in O` is UB-free and satisfies the postcondition. + +The existing safety comment records the decisive local fact (`Some` construction), so the implementation obligation is proved, but the proof artifact is deficient: it does not state the callee's `None`/UB obligation or the consumed return guarantee. Proposed replacement: + +```rust +// SAFETY: `unwrap_unchecked` is UB only when its receiver is `None`. +// This receiver is constructed immediately as `Some(value)`, so it is not +// `None`; the call returns that contained `value`. +``` + +## Full-case coverage certificate + +Without projecting any dimension away, define + +```text +Covered_sound(c) := A(c) and ( + (!f and the selected non-turbo execution on i is UB-free) or + (f and t in {X,A} and the selected turbo execution on i is UB-free) +) + +Covered_post(c) := A(c) and ( + (!f and the selected non-turbo result on i equals q(i)) or + (f and t in {X,A} and the selected turbo result on i equals q(i)) +). +``` + +Take arbitrary `c` with `Required_A(c)`. If `!f`, selection plus the non-turbo lemma puts the same complete `(v,t,f,h,p,d,i)` in both Covered predicates. If `f`, normalized `A_cfg` implies `t=X` or `t=A`; selection plus the turbo lemma does likewise. These cases exhaust `B`. The lemmas quantify every `v,t,h,p,d,i`; irrelevance of `v,h,p,d` follows from their absence from the selected computations, not from projection. Hence +`Required_A subseteq Covered_sound intersect Covered_post`. Conversely both Covered predicates include `A(c)` by definition, so each equals `A`; aggregate closure is exact. Since `S subseteq A` and `I subseteq A`, the same proofs close each published policy domain separately. + +## Residual scope and review triggers + +Only the identity of the single governing support promise is unresolved; authorized policy resolution is required. Re-audit on any change to the supplied source, manifest, either policy, feature/target/profile scope, any of the three Rust/Cargo identities or cited contracts, `BUILD-MAP-POLICY` disposition/mapping, or the documented postcondition. No code change was made. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/C.md new file mode 100644 index 0000000000..09ad3b77c3 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/C.md @@ -0,0 +1,117 @@ +# Focused unsafe-Rust source audit + +## Claim and results + +This audit covers the complete supplied `focused-predicate-target` source snapshot: `Cargo.toml`, `src/lib.rs`, both published policies, and `TCB.md`. It is a source-level claim under the documented Rust abstract semantics, not a compiler-backend or binary claim. Audit cutoff: 2026-08-01. TCB log identity is the supplied `TCB.md` snapshot; no revision identifier is stated. Skill identity is the supplied `unsafe-rust` package; no revision identifier is stated. No generated code, dependencies, FFI, macros, stateful invariants, tests, builds, or prior audit results are in scope or used. + +| Claim | Required domain | Result | Qualification | +|---|---|---|---| +| Every well-typed safe call of `value_or_zero` is free of Rust UB | conservative domain `R` below | **PROVED** | Relative to accepted `BUILD-MAP-POLICY` and the exact-version Rust axioms quoted below | +| The return is the contained byte, or zero for `None` | `R` | **PROVED** | Same qualification | +| Either published policy is *the* exact crate support promise | identity of Scarlet versus Indigo | **UNPROVED** | The documents are incomparable and no resolution rule is authorized | + +The combined mandatory soundness-and-behavior result is **PROVED over `R`**, relative to that TCB. This does not resolve or redefine the project's exact support promise. + +## Exact domains and policy relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the triples' meanings exactly as in the policies, `B={false,true}`, `P` be all Cargo profiles, `D=B` be both debug-assertion states, and + +`O={None} union {Some(n) | n is a u8}`. + +A full case is `c=(v,t,f,h,p,d,i)` in `K=V x T x B x B x P x D x O`. Comparisons of versions below are only over the finite set `V`. + +The exact Scarlet configuration predicate is + +`S(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (!h or v>=1.85.0)) or (f and t=A and h)]`. + +The exact Indigo configuration predicate is + +`I(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (h or v>=1.86.0)) or (f and t=A and !h and v>=1.85.0)]`. + +Their induced full-case domains are + +`D_S(c) := c in K and S(v,t,f,h)` and `D_I(c) := c in K and I(v,t,f,h)`. + +They are unequal and incomparable: + +* `(1.84.0,X,true,false)` is in Scarlet because its `X` clause has `!h`; it is not in Indigo because `h` and `v>=1.86.0` are both false. +* `(1.84.0,X,true,true)` is in Indigo because its `X` clause has `h`; it is not in Scarlet because `!h` and `v>=1.85.0` are both false. + +Thus neither `D_S subseteq D_I` nor `D_I subseteq D_S`; adding any `p in P`, `d in D`, and `i in O` lifts each witness to a full-case witness. + +Select the conservative audit domain + +`R(c) := D_S(c) or D_I(c)`. + +For every `c`, `D_S(c)` implies `R(c)` by the left disjunct, and `D_I(c)` implies `R(c)` by the right disjunct. Hence `D_S subseteq R` and `D_I subseteq R` separately. `R` is the union of the candidate commitments, used only as an audit requirement; it is not asserted to be the exact project promise. + +## Exact-version semantic premises + +For each of Rust 1.84.0, 1.85.0, and 1.86.0, the Reference states: “The `cfg` attribute conditionally includes the thing it is attached to based on a configuration predicate.” It further states: “If the predicate is true, the thing is rewritten to not have the `cfg` attribute on it. If the predicate is false, the thing is removed from the source.” It defines `all()` as true when all its predicates are true, and `not()` as true when its predicate is false. ([1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute); predicate definitions: [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation)). + +Each exact-version standard-library page says: “The `compile_error!` macro causes compilation to fail with the given error message when encountered.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). + +For `Option::unwrap_or`, each exact-version page says: “Returns the contained `Some` value or a provided default.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or)). For `Option::unwrap_unchecked`, each says: “Returns the contained `Some` value, consuming the `self` value, without checking that the value is not `None`,” and its Safety section says: “Calling this method on `None` is undefined behavior.” ([1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked)). These are three release-specific premise sets; no cross-release compatibility premise is used. + +## Selection and effective rejection + +`BUILD-MAP-POLICY` is consumed only here. For every `v in V` and `p in P`, it maps enabled `turbo`/`hardened` to their like-named feature cfgs and maps `X,A,W` to `x86_64,aarch64,wasm32`. With the quoted cfg rules, complete source inspection gives this exhaustive partition: + +* `!f`: the non-turbo function is included, the turbo function removed, and the compile error removed. +* `f and t in {X,A}`: the turbo function is included, the non-turbo function removed, and the compile error removed. +* `f and t=W`: both predicates in `all(feature="turbo",target_arch="wasm32")` are true, so `compile_error!` is included and compilation fails before a library API can execute. + +The source predicates mention neither `h`, profile, debug assertions, nor input; the partition is therefore parametric over those dimensions. Input exists only for an emitted API call. + +Policy-level exclusion is independent: for `f=true,t=W`, `!f` is false and every `X` or `A` conjunct is false in both `S` and `I`. Thus every such full case is absent from both policy domains. Source-level rejection additionally covers every such build in `K`, for either `h`, every profile and debug state, and any hypothetical input, relative to `BUILD-MAP-POLICY`. + +## API inventory and obligation ledger + +The sole language-reachable crate API is one configuration-selected safe free function `pub fn value_or_zero(Option)->u8`. There are no public fields, constructors, traits or impls, hidden items, callbacks, exported macros, unsafe APIs, or persistent invariant-bearing state. The only unsafe operation is `Some(value).unwrap_unchecked()` on the turbo branch. + +Define `spec(None)=0` and `spec(Some(x))=x`. + +| ID | Domain and obligation | Proof | Status | +|---|---|---|---| +| O-NT | Every `c in K` with `!f`: no UB and result `spec(i)` | `i.unwrap_or(0)` is a safe call and, by its quoted contract, returns `x` for `Some(x)` and the supplied `0` for `None` | **PROVED** | +| O-T-UNSAFE | Every `c in K` with `f,t in {X,A}`: receiver of `unwrap_unchecked` is not `None` | First `unwrap_or(0)` yields a `u8` named `value`; the receiver is then constructed at the call site as the `Some(value)` variant. It is therefore not `None`, satisfying the complete quoted safety obligation | **PROVED** | +| O-T-POST | Same cases: result `spec(i)` | The quoted contract returns the contained value, hence the unsafe call returns `value`; the first call made `value=spec(i)` | **PROVED** | +| O-REJECT | Every `c in K` with `f,t=W`: no shippable API case | Selection/rejection proof above | **PROVED**, relative to `BUILD-MAP-POLICY` | + +The local `SAFETY` comment records the decisive source fact but omits the callee obligation and returned-value consequence. The implementation proof is complete; the proof artifact is deficient under proof-grade documentation. Proposed replacement: + +```rust +// SAFETY: `unwrap_unchecked` requires the receiver not to be `None`. +// This receiver is constructed here as `Some(value)`, so that requirement +// holds; the operation returns the contained `value`. +``` + +This is a documentation finding, not an implementation defect or a caller-facing hidden precondition. + +## Full-case coverage and closure + +For this audit, `Required(c) := R(c)`. The soundness derivation covers + +`Covered_sound(c) := c in K and [!f or (f and t in {X,A})]`, + +and the behavioral derivation covers the identical full-case predicate + +`Covered_post(c) := c in K and [!f or (f and t in {X,A})]`. + +These predicates retain `v,t,f,h,p,d,i` through membership in `K`; O-NT and O-T quantify parametrically over every omitted fiber value, including every valid `Option`. + +For any `c in Required`, either its Scarlet or Indigo predicate holds. If `!f`, it is in both covered predicates by O-NT. If `f`, inspection of every positive disjunct of either exact policy shows `t=X` or `t=A`, so it is in both covered predicates by O-T-UNSAFE and O-T-POST. Therefore + +`Required subseteq Covered_sound intersection Covered_post`. + +This is the required whole-domain certificate for both **PROVED** verdicts. No sampled enumeration substitutes for it; version applicability is an exhaustive three-member partition backed by the three exact-version documentation sets. + +## TCB audit log, residual scope, and triggers + +* **BUILD-MAP-POLICY (IMPLEMENTATION/build tool): accepted.** Exact identity, proposition, scope, consumers, exclusions, and re-audit trigger are those in supplied `TCB.md`. Consumers here are only branch reachability and effective rejection. It supplies no Rust semantics or branch correctness. +* **AXIOM-CFG-{1.84,1.85,1.86}, AXIOM-COMPILE-{1.84,1.85,1.86}, AXIOM-OPTION-{1.84,1.85,1.86}: authoritative Rust premises.** Exact propositions, identities, quotations, version scopes, links, and consumers appear above. +* No other build-tool, compiler-implementation, dependency, environment, tool-derived, probabilistic, or compatibility premise is consumed. No test or tool evidence is claimed. + +Residual scope is compiler/backend/binary correctness and unsupported configurations. The exact project support-promise identity remains unresolved; an authorized precedence, supersession, intersection, union, or other rule is required to resolve it. Re-audit on any supplied source, manifest, policy, accepted TCB disposition/mapping, supported version/target/feature/profile/debug domain, or consumed authoritative contract change. + +All in-scope surfaces, configuration paths, unsafe obligations, mandatory postconditions, policy relationships, and full-case dimensions have a disposition above. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/D.md new file mode 100644 index 0000000000..abfd83fba2 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/D.md @@ -0,0 +1,196 @@ +# Focused unsafe-Rust source audit + +## Claim, snapshot, and verdicts + +The audited artifact is exactly the supplied `Cargo.toml`, `src/lib.rs`, two +published policies, and `TCB.md`: package `focused-predicate-target` 0.1.0, +edition 2021, with no dependencies or generated artifacts. The toolchain domain +is the three exact Rust/standard-library releases below. This is a source-level +claim under documented Rust abstract semantics, not a claim about compiler +backends or binaries. + +For a full case `c = (v,t,f,h,p,d,i)`, the claims are: (SND) every well-typed +safe call of the selected `value_or_zero` implementation is free of Rust UB; +and (POST) if it returns `r`, then +`Q(i,r) := (i=None => r=0) and (i=Some(n) => r=n)`. + +- **SND: PROVED** over `Required(c)` defined below, relative to accepted + `BUILD-MAP-POLICY` and the exact-version Rust axioms recorded below. +- **POST: PROVED** over the same domain and TCB. +- **Combined mandatory result: PROVED**, with the same qualification. + +Each published policy-induced domain is therefore covered separately. This +does **not** resolve which domain is the crate's exact support promise: both +policies are current and no rule chooses or combines them. + +## Exact policy predicates and full-case domains + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, where `X`, `A`, and `W` have the +exact triples defined in the policies; let `f,h,d` be Booleans, `P` be all +Cargo profiles, and `O` be every valid `Option` (`None` and every +`Some(n)` for valid `u8` `n`). Scarlet's exact configuration predicate is + +```text +C_S(v,t,f,h) := v in V and t in {X,A,W} and ( + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h) +) +``` + +Indigo's exact configuration predicate is + +```text +C_I(v,t,f,h) := v in V and t in {X,A,W} and ( + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0) +) +``` + +They are unequal and incomparable. `(1.84.0,X,true,false)` is Scarlet but not +Indigo. `(1.84.0,X,true,true)` is Indigo but not Scarlet. Thus neither +`C_S subseteq C_I` nor `C_I subseteq C_S`. + +The policy-induced full-case domains, without dropping any dimension, are + +```text +D_S(c) := C_S(v,t,f,h) and p in P and d in {false,true} and i in O +D_I(c) := C_I(v,t,f,h) and p in P and d in {false,true} and i in O +``` + +I select the conservative audit domain + +```text +Required(c) := D_S(c) or D_I(c). +``` + +Separately, `D_S(c) => Required(c)` by left disjunction introduction, and +`D_I(c) => Required(c)` by right disjunction introduction. Hence it contains +both candidate commitments. It is their audit union, not an authorized union +of support promises. + +## Configuration and API closure + +Define the dimension-preserving base + +```text +B(c) := v in V and t in T and f,h,d in {false,true} + and p in P and i in O +N(c) := B(c) and !f +U(c) := B(c) and f and t in {X,A} +Covered_SND(c) := N(c) or U(c) +Covered_POST(c) := N(c) or U(c) +``` + +Relative to `BUILD-MAP-POLICY`, feature and target values set the correspondingly +named `cfg` options. The exact-version `cfg` axioms then give this exhaustive +source partition: + +- On `N`, `#[cfg(not(feature="turbo"))]` includes lines 8--10 and removes lines + 14--19. The `compile_error!` item is removed. +- On `U`, the non-turbo definition is removed, the turbo definition at lines + 14--19 is included, and the `compile_error!` item is removed because the + target is not `wasm32`. +- For every `f=true,t=W` combination (all `v,h,p,d`), both policies exclude the + configuration: `!f` is false and both remaining disjuncts require `X` or + `A`. Independently, and conspicuously **relative to BUILD-MAP-POLICY**, the + source `all(feature="turbo",target_arch="wasm32")` predicate is true, so + lines 3--4 are included and `compile_error!` fails compilation. Thus every + turbo/wasm case is both policy-excluded and effectively source-rejected; no + runtime input is reached. + +For closure, take arbitrary `c` with `Required(c)`. Either policy conjunct +implies `B(c)`. If `!f`, then `N(c)`. If `f`, inspection of either exact policy +shows its satisfied turbo disjunct requires `t=X` or `t=A`, hence `U(c)`. +Therefore + +```text +Required subseteq Covered_SND +Required subseteq Covered_POST. +``` + +This argument is parametric in `h,p,d,i` rather than silently projecting them +away. The code contains no profile, hardened, or debug-assertion selector, so +those axes do not change either branch proof. + +The complete language-reachable API surface is one safe free function, +`pub fn value_or_zero(Option) -> u8`, with exactly one definition in each +buildable case above. There are no public fields, constructors, user traits, +macros, reexports, hidden items, FFI, allocation, concurrency, or invariant- +bearing state. The sole unsafe operation is the turbo definition's +`Option::unwrap_unchecked` call. + +## Obligation ledger and proofs + +| ID | Domain | Obligation | Derivation | Status | +|---|---|---|---|---| +| N-SND | `N(c)` | safe implementation has no UB | `unwrap_or(0)` is a safe standard-library call with the exact behavior below; there is no unsafe operation | PROVED | +| N-POST | `N(c)` | `Q(i,r)` | `unwrap_or` returns the contained value for `Some(n)` and the supplied `0` for `None` | PROVED | +| U-SND | `U(c)` | `unwrap_unchecked` receiver is not `None` | first `x=i.unwrap_or(0)`; the receiver is then syntactically constructed as `Some(x)`, so the sole stated safety prohibition is false | PROVED | +| U-POST | `U(c)` | `Q(i,r)` | `x=n` for `Some(n)` and `x=0` for `None`; unwrapping `Some(x)` returns its contained `x` | PROVED | + +These proofs quantify over every `i in O`. The `N` and `U` lemmas union to each +`Covered` predicate; the two containment results above supply the required +whole-domain certificates. + +The implementation proof at lines 17--18 is correct, but its `SAFETY` comment +is proof-documentation deficient: it gives the decisive local fact but omits +the callee's exact obligation and resulting postcondition. Proposed replacement +(review only; the source was not changed): + +```rust +// SAFETY: `Option::unwrap_unchecked` is UB when called on `None`. This +// receiver is constructed immediately as `Some(value)`, so it is not `None`; +// the call returns that contained `value`. +``` + +## Rust axioms and TCB audit log + +All quotations below were verified with identical relevant wording in the +three exact releases; no version interpolation or compatibility assumption is +used. + +- **AX-OR** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), + [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or): + “Returns the contained `Some` value or a provided default.” This proves both + case equations for the first operation on each branch. +- **AX-UNCHECKED** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked): + “Returns the contained `Some` value ... without checking that the value is + not `None`.” “Calling this method on `None` is undefined behavior.” These + supply the exact local prohibition, return fact, and UB consequence. +- **AX-CFG-PRED** — conditional-compilation pages for + [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), + [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), and + [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation): + a configuration-option predicate is “true if the option is set”; `all` is + “true if all of the given predicates are true”; `not` is “true if its + predicate is false.” +- **AX-CFG-ATTR** — `cfg`-attribute pages for + [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), and + [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute): + it “conditionally includes the thing it is attached to”; when false, “the + thing is removed from the source code.” +- **AX-COMPILE-ERROR** — [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), + [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), and + [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html): + “Causes compilation to fail with the given error message when encountered.” + +**BUILD-MAP-POLICY (accepted OUT-OF-BAND/IMPLEMENTATION premise):** exactly the +toolchain-bundled Cargo releases for 1.84.0, 1.85.0, and 1.86.0 map the two +named features and three targets to the source `cfg` options as stated in +`TCB.md`, for every supported profile. It is consumed only by branch +reachability and effective rejection, never as a Rust semantic or branch- +correctness premise. Its identity, manifest/source/cfg changes, or human +disposition trigger re-audit. No other implementation premise is consumed. + +No tests, compilation, execution, macro expansion, or tool-derived proof was +used. Residual scope is the unresolved identity of the exact published support +promise and all backend/binary behavior; neither weakens the proved source +claims over the explicitly conservative audit domain. Re-audit is required for +changes to source, policies or conflict resolution, manifest/features/targets, +the accepted TCB mapping, supported Rust versions, or any cited contract. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/E.md new file mode 100644 index 0000000000..5906b3a8ab --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/E.md @@ -0,0 +1,191 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-only review of the supplied `Cargo.toml`, `src/lib.rs`, two +published policies, and `TCB.md`, at the 2026-08-01 audit cutoff. No generated +artifact, dependency, build, execution, test, backend, or binary claim is in +scope. + +| Claim | Verdict | +|---|---| +| Which policy is the crate's exact support promise | **UNPROVED**: Scarlet and Indigo are both current, are incomparable, and no resolution rule is authorized. | +| Freedom from Rust UB for every `value_or_zero` call in `Required` below | **PROVED relative to accepted `BUILD-MAP-POLICY`** and the exact-version Rust axioms below. | +| Documented result: contained byte, or zero for `None`, throughout `Required` | **PROVED relative to accepted `BUILD-MAP-POLICY`** and those axioms. | +| Source rejection of every named `turbo`/`wasm32` configuration | **PROVED relative to accepted `BUILD-MAP-POLICY`** and the cfg/`compile_error!` axioms. | + +Thus the combined source theorem over the explicitly conservative audit domain +is **PROVED relative to `BUILD-MAP-POLICY`**. This does **not** resolve or rename +that domain as the crate's published support promise. + +## Exact policies and full-case domains + +Let `V = {1.84.0, 1.85.0, 1.86.0}`, `X = +x86_64-unknown-linux-gnu`, `A = aarch64-unknown-linux-gnu`, and `W = +wasm32-unknown-unknown`. Let Boolean `f` and `h` mean `turbo` and `hardened`. +The exact Scarlet configuration predicate is + +```text +v in V and t in {X,A,W} and +(!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) +``` + +The exact Indigo configuration predicate is + +```text +v in V and t in {X,A,W} and +(!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +Write these predicates as `S(v,t,f,h)` and `I(v,t,f,h)`. They are neither +equal nor contained in one another: + +* `(1.84.0,A,true,true)` satisfies Scarlet but not Indigo. +* `(1.84.0,X,true,true)` satisfies Indigo but not Scarlet. + +Either witness becomes a separating full case, for example, by adding +`profile=dev`, `debug_assertions=false`, and `input=None`. + +Let `P` be the symbolic set of every Cargo profile, `B={false,true}`, and +`O={None} union {Some(x) | x is any valid u8}`. For +`c=(v,t,f,h,p,d,i)`, the two policy-induced full domains are exactly + +```text +D_S(c) := S(v,t,f,h) and p in P and d in B and i in O +D_I(c) := I(v,t,f,h) and p in P and d in B and i in O. +``` + +No input, profile, or debug-assertion dimension has been projected away. + +## Conservative domain and exclusions + +Define + +```text +F(c) := v in V and t in {X,A,W} and f,h in B + and p in P and d in B and i in O +Required(c) := F(c) and not(f and t = W). +``` + +This is the selected conservative audit domain. Separately for Scarlet: if +`D_S(c)` and `f` is false, `not(f and t=W)` follows immediately; if `f` is +true, Scarlet's only true turbo disjunct has `t=X` or `t=A`. Hence +`D_S subset Required`. The identical split for Indigo uses its turbo +disjuncts, also restricted to `X` or `A`, so `D_I subset Required`. The other +three full-case dimensions are universally identical in each policy and in +`Required`. This proves both containments without claiming policy equality. + +At policy level, setting `f=true,t=W` falsifies every disjunct in both policies, +for every `v,h,p,d,i`. At source level, `BUILD-MAP-POLICY` maps exactly that +feature/target selection to both cfg atoms; `all(...)` is true, the cfg keeps +the `compile_error!`, and compilation fails. Thus every such full case is both +policy-excluded and effectively rejected before an executable library is +produced. This rejection statement, unlike the Boolean policy calculation, +depends on the accepted build-map premise. + +## Applicable Rust axioms + +The following quoted prose is identical on each linked exact release; no +cross-release compatibility inference is used. + +* CFG-84/85/86: the Reference describes `cfg` as “conditionally includes”; + `all` is “true if all of the given predicates are true”; `not` is “true if + the given predicate is false”; a false cfg is “removed from the source.” + Sources: [1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), + [1.84 cfg attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), + [1.85 cfg attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), + [1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), + [1.86 cfg attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +* CE-84/85/86: `compile_error!` “Causes compilation to fail with the given error + message when encountered.” Sources: [1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), + [1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), + [1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). +* OPTION-84/85/86: `unwrap_or` “Returns the contained `Some` value or a provided + default.” `unwrap_unchecked` “Returns the contained `Some` value”; “Calling + this method on `None` is undefined behavior.” Sources: + [1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), + [1.84 unchecked](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), + [1.85 unchecked](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), + [1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), + [1.86 unchecked](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). + +## Branch proofs and obligation ledger + +The only language-reachable crate API is the safe free function +`value_or_zero(Option) -> u8`, with exactly one cfg-selected definition. +There are no public fields, user constructors, methods, traits/impls, callbacks, +macros exported by this crate, hidden items, FFI, or invariant-bearing state. + +**Non-turbo lemma (`F(c) and !f`).** CFG plus `BUILD-MAP-POLICY` selects the +first definition and removes the second. There is no unsafe operation. +OPTION-84/85/86 entails that `Some(x).unwrap_or(0)` returns `x` and +`None.unwrap_or(0)` returns `0`. This proves UB freedom and the documented +postcondition for every `v,t,h,p,d,i` in this lemma. + +**Turbo lemma (`F(c) and f and t in {X,A}`).** The accepted mapping and CFG +select the second definition; the wasm compile error is absent. First, +`i.unwrap_or(0)` produces `y=x` for `i=Some(x)` and `y=0` for `i=None`. +The receiver of the sole unsafe operation is then syntactically and immediately +constructed as `Some(y)`. It is therefore not `None`, discharging the complete +documented safety precondition of `unwrap_unchecked`; OPTION-84/85/86 says it +returns the contained `y`. Thus the operation is free of its documented UB and +the function returns `x` for `Some(x)`, otherwise `0`, for every retained +version, target, hardened state, profile, debug-assertion state, and input. + +`h`, profile, and debug assertions occur in neither body nor source-selection +predicate, and the proof is parametric over them. Target affects only the +separately proved compile-error gate. Each exact version has its own cited +premises. + +## Covered predicates and closure certificates + +Keeping every case dimension explicit, define + +```text +L0(c) := F(c) and !f +L1(c) := F(c) and f and t in {X,A} +Covered_sound(c) := L0(c) or L1(c) +Covered_behavior(c) := L0(c) or L1(c). +``` + +The two branch proofs establish their respective lemmas for both obligations. +If `Required(c)`, either `!f`, giving `L0`, or `f`; then `t` is one of +`{X,A,W}` and the exclusion forces `t in {X,A}`, giving `L1`. Conversely each +lemma satisfies `Required`. Hence +`Required = Covered_sound = Covered_behavior`, proving separately +`Required subset Covered_sound` and `Required subset Covered_behavior`. +Their pointwise intersection also equals `Required`, which is the combined +closure certificate. + +## TCB, documentation finding, and residual scope + +TCB log identity is the supplied `TCB.md`. `BUILD-MAP-POLICY` is accepted only +for the three exact Cargo/Rust releases, named feature-to-cfg mappings, +target-to-`target_arch` mappings, and the selection/rejection consumers above. +It supplies no Rust semantics or backend correctness. CFG, CE, and OPTION are +exact-version authoritative axioms, not implementation assumptions. No other +premise or tool evidence is consumed. + +The unsafe implementation is proved, but its adjacent safety comment is +proof-documentation deficient: it states the local `Some` fact without naming +the callee's `None`/UB obligation, cited contract, or resulting value. A compact +replacement is: + +```rust +// SAFETY: Option::unwrap_unchecked is UB only for None. This receiver is +// constructed immediately as Some(value), so it is not None; the call returns +// that contained value. +``` + +This documentation finding changes neither implementation verdict. There is no +proved UB witness and no UB-free postcondition counterexample. Residual scope is +the unresolved identity of the published support promise and all backend, +binary, custom-target, non-named-version, or changed-toolchain claims. Re-audit +is required by any source/manifest/policy/TCB change, support-domain expansion, +different Cargo or Rust release, or material change to a consumed Rust page. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/F.md new file mode 100644 index 0000000000..688b849351 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/F.md @@ -0,0 +1,194 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This source-only review covers the supplied `Cargo.toml`, `POLICY-SCARLET.md`, +`POLICY-INDIGO.md`, `TCB.md`, and `src/lib.rs` snapshot, with audit cutoff +2026-08-01. There are no dependencies, generators, expansions, or prior results +in the supplied evidence. No build, execution, test, or backend claim is made. + +For a full case + +`c = (v,t,f,h,p,d,i) = (version,target,turbo,hardened,profile,debug_assertions,input)`, + +the soundness theorem is: every well-typed safe call to the selected +`value_or_zero` in every required case is free of Rust undefined behavior. The +behavioral theorem is: if the call returns `r`, then + +`Q(i,r) := (i = None => r = 0) and (for every n, i = Some(n) => r = n)`. + +Results over the conservative domain `R` defined below: + +* **Soundness: PROVED relative to `BUILD-MAP-POLICY`.** +* **Documented postcondition `Q`: PROVED relative to `BUILD-MAP-POLICY`.** +* **Combined mandatory result: PROVED relative to `BUILD-MAP-POLICY`.** +* **Identity of the crate's exact support promise: UNPROVED.** Scarlet and + Indigo are both current, conflict, and have no authorized resolution. `R` is + an audit domain, not a resolution or newly inferred project promise. + +## Exact policy predicates and relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, with `X`, `A`, and `W` denoting +the three exact triples in the policies. Let `B={false,true}`, `P` be all Cargo +profiles, and `O` be every valid `Option`. + +The exact Scarlet configuration predicate is + +`S(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (!h or v>=1.85.0)) or (f and t=A and h)]`. + +The exact Indigo configuration predicate is + +`I(v,t,f,h) := v in V and t in T and [!f or (f and t=X and (h or v>=1.86.0)) or (f and t=A and !h and v>=1.85.0)]`. + +They are **incomparable**, hence unequal: + +* `(1.84.0,X,true,false)` is in Scarlet: its `X` clause has `!h`; it is not in + Indigo because both `h` and `v>=1.86.0` are false. Thus `S` is not contained + in `I`. +* `(1.84.0,X,true,true)` is in Indigo: its `X` clause has `h`; it is not in + Scarlet because both `!h` and `v>=1.85.0` are false. Thus `I` is not + contained in `S`. + +The induced full-case domains, retaining every requested dimension, are + +`D_S(c) := S(v,t,f,h) and p in P and d in B and i in O`, and + +`D_I(c) := I(v,t,f,h) and p in P and d in B and i in O`. + +Select the conservative audit domain + +`R(c) = Required(c) := D_S(c) or D_I(c)`. + +For every full case, `D_S(c) => D_S(c) or D_I(c)` and independently +`D_I(c) => D_S(c) or D_I(c)`. Therefore `D_S` is contained in `R` and `D_I` +is contained in `R`; these are full-case, not configuration-projection, +containments. Conversely, `R = D_S union D_I` by definition, but that equality +does not resolve which current policy controls the project's promise. + +## Authorities and TCB + +For each exact release, its `Option` page states that `unwrap_or` “Returns the +contained `Some` value or a provided default”; `unwrap_unchecked` “Returns the +contained `Some` value”; and “Calling this method on `None` is undefined +behavior”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or). +The corresponding unsafe-method anchors are +[1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and +[1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +These separate exact-version axioms avoid any cross-release compatibility +assumption. + +For each release, the Reference says an option predicate is “true if the +configuration option is set”; `all` requires “all of the given predicates” to +be true, `not` is true when “its predicate is false,” and `cfg` “conditionally +includes” its attached item: [1.84.0 predicates](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.84.0 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85.0 predicates](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.85.0 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86.0 predicates](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), and +[1.86.0 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +Each exact-version macro page says `compile_error!` “causes compilation to fail +with the given error message when encountered”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). + +`BUILD-MAP-POLICY` is the sole additional TCB entry. It is accepted by the +authorized human and admits, only for the toolchain-bundled Cargo at the three +releases and supplied manifest/source, that feature enablement maps exactly to +the two feature cfgs and the three triples map respectively to `x86_64`, +`aarch64`, and `wasm32`. This audit consumes it only in source selection and +effective rejection below; it supplies no Option semantics or branch +correctness. Its limitations and re-audit triggers are exactly those in +`TCB.md`. No implementation, backend, dependency, tool-result, or environmental +premise is admitted. + +## Selection, exclusion, and effective rejection + +By the build mapping and cited cfg semantics, `!f` selects exactly the +`#[cfg(not(feature="turbo"))]` definition, while `f` selects exactly the +`#[cfg(feature="turbo")]` definition. Neither profile, `d`, `h`, nor `i` +occurs in these selectors, so this argument is parametric over their complete +fibers and is repeated under each release's exact Reference text. + +At policy level, if `f` and `t=W`, every disjunct in both `S` and `I` is false: +`!f` is false and each remaining disjunct requires `t=X` or `t=A`. Thus neither +policy induces such a full case and `R` excludes all of them. + +Independently, for every `v in V`, `h,d in B`, `p in P`, and `i in O`, the TCB +maps `f=true,t=W` to both `feature="turbo"` and `target_arch="wasm32"` being +set. `all(...)` is therefore true, its cfg includes `compile_error!`, and the +cited macro contract makes compilation fail. No library artifact or runtime +input is reached. This proves source-level effective rejection across the +entire stated `turbo`/`wasm32` case fiber, relative to the TCB; it is not used +to pretend those policy-excluded cases are members of `R`. + +For every `R(c)` with `f=true`, either policy's only possible true turbo +disjunct requires `t=X` or `t=A`. Hence the rejection condition is false and +the turbo source branch is the relevant branch. + +## Branch-local proofs and obligation ledger + +The sole public safe surface is `value_or_zero(Option) -> u8`, with one of +two configuration-specific definitions. There are no fields, constructors, +traits, impls, exported macros, hidden items, callbacks, FFI surfaces, or +stateful invariants. + +**OBL-NONTURBO (`R(c) and !f`).** The selected body is +`i.unwrap_or(0)`. For each `v` the exact-version safe-method contract yields +`0` when `i=None` and the contained `n` when `i=Some(n)`. Thus `Q` holds. The +body contains no unsafe operation, and the safe standard-library call is made +with its typed receiver and argument; soundness is proved for every `t,h,p,d,i` +in this fiber. + +**OBL-TURBO (`R(c) and f`).** First, the same release-specific `unwrap_or` +contract establishes a local byte `x=0` for `None`, or `x=n` for `Some(n)`. +Next the receiver at the unsafe site is syntactically and immediately +constructed as `Some(x)`. Therefore it is not `None`, discharging the exact +`unwrap_unchecked` safety obligation. Its documented result is the contained +value `x`; substitution of the first step proves `Q`. This proves both UB +freedom and behavior for every `t in {X,A}`, `h,p,d,i` admitted by `R` and for +each separately cited release. + +**DOC-1 (proof artifact deficient; implementation proved).** The existing +`SAFETY` comment records the decisive local fact but omits the callee's exact +`None`-UB obligation and the result used for `Q`. Suggested replacement: + +> SAFETY: `unwrap_unchecked` is UB on `None`. The receiver is exactly +> `Some(value)`, hence not `None`; the call returns its contained `value`. + +This is documentation debt, not a hidden caller obligation or implementation +defect. + +## Full-case Covered predicates and closure + +The two branch lemmas are universal over every omitted-dimension fiber, so no +dimension is projected away. State the proved predicates extensionally as + +`Covered_sound(c) := R(c)`, and `Covered_post(c) := R(c)`. + +Their derivation is the exhaustive partition `R(c) and !f` versus `R(c) and f`. +Boolean totality covers every `f`; the first is OBL-NONTURBO, and in the second +`R=>t in {X,A}` followed by OBL-TURBO applies. Each lemma retains `v,t,f,h,p,d,i`; +`p,d,h` are irrelevant because they neither select nor alter the body, while +`i` is handled parametrically as `None` or `Some(n)`. The release dimension is +exhausted by three release-specific authority/derivation instances. + +For soundness, `Required(c)=R(c)=Covered_sound(c)`, hence +`Required` is contained in `Covered_sound`. Independently, +`Required(c)=R(c)=Covered_post(c)`, hence `Required` is contained in +`Covered_post`. Claim-level coverage is their pointwise conjunction, not a +union: `Covered_sound(c) and Covered_post(c) = R(c)`. Therefore +`Required` is contained in aggregate `Covered`, certifying both PROVED verdicts +relative to `BUILD-MAP-POLICY`. + +## Residual scope and review triggers + +The unresolved item is solely which conflicting policy defines the exact +project promise; an authorized precedence/merge decision is required. Cases +outside `R`, including all turbo/wasm32 cases, versions outside `V`, targets +outside `T`, non-Cargo/custom build mappings, compiler/backend correctness, and +binary behavior are not affirmative audit claims. Re-audit on any source, +manifest, policy/resolution, supported-axis, feature/target mapping, TCB +disposition, or consumed exact-version Rust documentation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/G.md new file mode 100644 index 0000000000..0b6b32f772 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/G.md @@ -0,0 +1,116 @@ +# Focused unsafe-Rust source audit + +## Claim, scope, and verdicts + +The audited artifact is the complete supplied `focused-predicate-target` 0.1.0 source snapshot (`Cargo.toml`, both policy files, `TCB.md`, and `src/lib.rs`), edition 2021. This is a source-level Rust-abstract-semantics review at cutoff 2026-08-01; no build, execution, expansion, backend, or binary claim is made. There are no dependencies, generators, FFI, traits, fields, statics, or macros authored by the crate. The sole public surface is the safe function `value_or_zero(Option) -> u8`; its two definitions are configuration alternatives. The sole unsafe operation is `Option::unwrap_unchecked` at `src/lib.rs:18`. + +* **Soundness: PROVED** for every full case in `D_A` below, relative to accepted `BUILD-MAP-POLICY` and the exact-version Rust axioms quoted below. +* **Documented postcondition: PROVED** on `D_A`: the result is the contained byte for `Some(byte)` and zero for `None`, under the same qualification. +* **Effective turbo/wasm32 rejection: PROVED** on `R_W` below, relative to `BUILD-MAP-POLICY`. +* **Identity of the crate's exact support promise: UNPROVED.** Scarlet and Indigo are current, incomparable commitments and no resolution rule is authorized. `D_A` is an audit envelope, not a declaration that union is the project's resolved promise. + +There is no invariant-bearing state. The existing adjacent `SAFETY` comment is proof-documentation-deficient but the implementation obligation is proved by the reconstructed derivation below. + +## Exact policy predicates and relationships + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}` with the policy-defined triples, and `B={false,true}`. Writing `f` for turbo and `h` for hardened, the exact Scarlet predicate is + +```text +S(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f + or (f and t=X and (!h or v>=1.85.0)) + or (f and t=A and h)) +``` + +and the exact Indigo predicate is + +```text +I(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f + or (f and t=X and (h or v>=1.86.0)) + or (f and t=A and !h and v>=1.85.0)). +``` + +They are unequal and incomparable. Witness `s=(1.84.0,X,true,false)` is in Scarlet because its `X` clause has `!h`, but not Indigo because both `h` and `v>=1.86.0` are false; hence `S⊄I`. Witness `i=(1.84.0,X,true,true)` is in Indigo because `h`, but not Scarlet because both `!h` and `v>=1.85.0` are false; hence `I⊄S`. + +Let `P` be all Cargo profiles, `O=Val(Option)={None}∪{Some(x)|x∈0..=255}`, and a full case be the requested + +```text +c=(v,t,f,h,p,d,input), where p∈P, d∈B, input∈O. +D_S(c) := S(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +D_I(c) := I(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +``` + +Select the conservative configuration predicate + +```text +U(v,t,f,h) := v∈V ∧ t∈T ∧ + (!f or (f and t=X) or (f and t=A and (h or v>=1.85.0))) +``` + +and full audit domain + +```text +D_A(c) := U(v,t,f,h) ∧ p∈P ∧ d∈B ∧ input∈O. +Required(c) := D_A(c). +``` + +Separate containment certificates: every Scarlet disjunct implies the corresponding `U` disjunct (`!f`; `f∧t=X`; or `f∧t=A∧h`), so `D_S⊆D_A`. Every Indigo disjunct likewise implies `!f`, `f∧t=X`, or `f∧t=A∧v>=1.85.0`, so `D_I⊆D_A`. All four remaining case dimensions are preserved unchanged in both arguments. + +In fact `U=S∨I`: conversely, `!f` belongs to both; for `f∧t=X`, `h` selects Indigo and `!h` selects Scarlet; for `f∧t=A∧(h∨v>=1.85.0)`, `h` selects Scarlet, while `!h` forces `v>=1.85.0` and selects Indigo. This equality describes the chosen envelope; it does not resolve which published policy controls. + +## Applicable Rust premises and TCB + +For each exact release, the Reference says `cfg` “conditionally includes the thing it is attached to”; `all` is “true if all predicates are true,” and `not` is “true if its predicate is false”: [1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). Each exact `compile_error!` page says it “Causes compilation to fail with the given error message when encountered”: [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html). + +For each exact release, `unwrap_or` “Returns the contained `Some` value or a provided default”; `unwrap_unchecked` “Returns the contained `Some` value,” and its Safety section says, “Calling this method on `None` is undefined behavior”: [1.84.0 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.84.0 unchecked](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0 unchecked](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.86.0 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), [1.86.0 unchecked](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). These are per-release premises; no cross-release compatibility inference is used. + +`BUILD-MAP-POLICY` is accepted human trust, limited exactly to Cargo 1.84.0/1.85.0/1.86.0 mapping the two named feature selections and the three named targets to their source `cfg` options for every supported profile. It is consumed only below for branch reachability and rejection. It supplies no Rust semantics or implementation correctness. No other non-authoritative premise is consumed. Re-audit on any trigger listed in `TCB.md`. + +## Selection, rejection, and branch proofs + +Define + +```text +R_W(c) := v∈V ∧ t=W ∧ f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +C_N(c) := v∈V ∧ t∈T ∧ !f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +C_T(c) := v∈V ∧ t∈{X,A} ∧ f ∧ h∈B ∧ p∈P ∧ d∈B ∧ input∈O. +``` + +**Turbo/wasm32.** Policy-level: with `f=true,t=W`, every non-`!f` disjunct in both `S` and `I` requires `t=X` or `t=A`; hence `R_W∩D_S=R_W∩D_I=∅`. Source-level: on every `R_W` case, `BUILD-MAP-POLICY` makes both leaves of `all(feature="turbo",target_arch="wasm32")` true. The exact-version `cfg` rules include the item and `compile_error!` rejects compilation. This is independent of `h,p,d,input`; the API is never executed. Thus every such policy-excluded configuration is also effectively rejected, rather than merely undocumented. + +**Non-turbo branch (`C_N`).** The build mapping plus exact-version `cfg` semantics includes lines 8–10 and excludes lines 14–19. For arbitrary full-case `input`, `input.unwrap_or(0)` returns its contained `x` for `Some(x)` and the provided `0` for `None`. There is no unsafe operation on this branch, and the documented postcondition holds. + +**Turbo non-wasm branch (`C_T`).** The rejection predicate is false because `t∈{X,A}`; the build mapping and `cfg` semantics include lines 14–19 and exclude lines 8–10. Let `r=input.unwrap_or(0)`. The cited contract gives `r=x` for `Some(x)` and `r=0` for `None`. The receiver of the unsafe call is constructed at that expression as `Some(r)`, so it is not `None`; the sole documented safety obligation is satisfied. The call returns the contained `r`, proving both absence of UB at the unsafe site and the public postcondition. + +Profiles and `debug_assertions` do not occur in source predicates or operations, and `h` affects policy membership but not selected code. The proofs therefore quantify parametrically over every `p,d,h,input`; no dimension is projected away. + +## Covered predicates and closure + +Let `Q(input,result)` mean `(input=None ∧ result=0) ∨ ∃x∈0..=255.(input=Some(x) ∧ result=x)`. The preceding per-release derivations establish, retaining the complete tuple: + +```text +Covered_sound(c) := C_N(c) ∨ C_T(c). +Covered_behavior(c) := C_N(c) ∨ C_T(c), with Q established. +``` + +For arbitrary `c` with `Required(c)=D_A(c)`: if `!f`, then `c∈C_N`; if `f`, predicate `U` forces `t=X` or `t=A`, hence `c∈C_T`. Every other coordinate is carried unchanged. Therefore + +```text +Required ⊆ Covered_sound +Required ⊆ Covered_behavior. +``` + +This supplies both whole-domain `PROVED` certificates. It also covers each candidate promise separately by `D_S⊆D_A` and `D_I⊆D_A`. The source-selection partition is exhaustive on `Required`; the separately proved `R_W` rejection lies outside it. + +## Finding: local proof text is incomplete + +`src/lib.rs:17` records the decisive local fact but does not state the callee's exact safety obligation or the postcondition used to prove the wrapper's behavior. This is documentation debt, not an implementation defect. Suggested adjacent replacement: + +```rust +// SAFETY: `unwrap_unchecked` requires that its receiver is not `None`. +// This receiver is constructed here as `Some(value)`, so that requirement +// holds; the operation returns the contained `value`. +``` + +No code change was authorized. Re-audit if source, either policy, the accepted build mapping, supported versions/targets/features/profiles, or any consumed Rust documentation changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/H.md new file mode 100644 index 0000000000..f6d59e89a4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/H.md @@ -0,0 +1,210 @@ +# Focused unsafe-Rust source audit + +## Claim, snapshot, and verdicts + +This review covers the supplied `Cargo.toml`, `src/lib.rs`, both published +policy documents, and `TCB.md`, source-only, as inspected on 2026-08-01. The +crate is `focused-predicate-target` 0.1.0, edition 2021, with no dependencies, +build script, generator, or generated artifact. Nothing was built, expanded, +run, or tested. + +- **PROVED — source soundness:** every well-typed safe call to the selected + `value_or_zero` implementation is free of Rust undefined behavior over the + conservative audit domain `A` below, relative to accepted + `BUILD-MAP-POLICY` and the exact-version Rust axioms cited below. +- **PROVED — documented behavior:** on that same domain, normal return is the + contained byte for `Some(n)` and zero for `None`. +- **PROVED, TCB-qualified — effective rejection:** every considered + `turbo`/`wasm32` compilation is rejected, relative specifically to + `BUILD-MAP-POLICY` and the cited `cfg`/`compile_error!` contracts. +- **UNPROVED — identity of the project's exact support promise:** Scarlet and + Indigo are current, incomparable commitments, and no merge or precedence + rule is authorized. `A` is an audit domain, not a resolution of that + governance question. + +There is no `UNSOUND` or `CONTRACT-BROKEN` finding. + +## Exact policy and full-case domains + +Let + +```text +V = {1.84.0, 1.85.0, 1.86.0} +T = {X, A, W} +X = x86_64-unknown-linux-gnu +A = aarch64-unknown-linux-gnu +W = wasm32-unknown-unknown +B = {false, true} +P = the set of all Cargo profiles +O = {None} union {Some(n) | n is any u8, 0 <= n <= 255} +``` + +A full case is `c=(v,t,f,h,p,d,i)`, where `f` is `turbo`, `h` is +`hardened`, `p` is profile, `d` is `debug_assertions`, and `i` is input. Define + +```text +Base(c) := v in V and t in T and f,h,d in B and p in P and i in O. +``` + +The exact Scarlet configuration predicate is + +```text +S0(v,t,f,h) := + !f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h). +``` + +Its induced full-case domain is +`DS(c) := Base(c) and S0(v,t,f,h)`. + +The exact Indigo configuration predicate is + +```text +I0(v,t,f,h) := + !f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0). +``` + +Its induced full-case domain is +`DI(c) := Base(c) and I0(v,t,f,h)`. + +They are unequal and neither contains the other. The full case +`(1.84.0,X,true,false,dev,true,None)` is in `DS` because Scarlet's +`X and !h` clause holds, but not `DI` because both `h` and +`v >= 1.86.0` are false. Conversely, +`(1.86.0,A,true,false,dev,true,None)` is in `DI` because Indigo's +`A and !h and v >= 1.85.0` clause holds, but not `DS` because Scarlet's +`A` clause requires `h`. + +Select the conservative full-case audit domain + +```text +Required(c) := A(c) := DS(c) or DI(c). +``` + +The two required containments are immediate but separate: if `DS(c)`, then +the left disjunct establishes `A(c)`; if `DI(c)`, the right disjunct establishes +`A(c)`. Thus `DS subseteq A` and `DI subseteq A`. This exact union is chosen +only to audit every case promised by either document; it is not asserted to be +the project's support promise. + +## Policy exclusion and effective rejection + +For any `Base(c)` with `f=true` and `t=W`, neither policy holds: every `f=true` +disjunct in both `S0` and `I0` requires `t=X` or `t=A`. Hence no such case is in +`DS`, `DI`, or `Required`, for every `v,h,p,d,i`. + +Source rejection is independently stronger within `Base`. Accepted +`BUILD-MAP-POLICY` maps `f=true` to `cfg(feature="turbo")` and `t=W` to +`target_arch="wasm32"` for each exact release and every profile. The enclosing +`cfg(all(...))` therefore includes `compile_error!` for every such case, +independently of `h,d,i`. For each exact release, the Reference says: “The +`cfg` attribute conditionally includes the thing it is attached to based on a +configuration predicate.” ([1.84](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute)). +The corresponding macro pages say: “Causes compilation to fail with the given +error message when encountered.” ([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). Thus no +library artifact containing a callable function is produced for these cases. + +## Surface and obligation inventory + +The complete crate-defined callable surface is one safe public free function, +`value_or_zero(Option) -> u8`, with mutually exclusive non-`turbo` and +`turbo` definitions. There are no public fields, constructors, user-defined +types or traits, callbacks, FFI items, reexports, hidden items, or exported +macros. `compile_error!` is the rejection site. The sole unsafe operation is +`Some(value).unwrap_unchecked()` in the `turbo` definition. There is no +persistent invariant-bearing state. + +For each `r` in `V`, the exact `Option` pages provide the same three premises: +“Returns the contained `Some` value or a provided default” for `unwrap_or`, +“Returns the contained `Some` value” for `unwrap_unchecked`, and “Calling this +method on `None` is undefined behavior.” See +[1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and +[1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or) / +[`unwrap_unchecked`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked). +Using each release's own pages is an exhaustive three-member partition; no +cross-version compatibility premise is used. + +Let `Q(i,r)` mean `(i=None and r=0) or (there exists n: i=Some(n) and r=n)`. + +1. **Non-`turbo` branch.** For every full case with `f=false`, the build-map + premise and complementary `cfg` select this definition. If `i=None`, + `i.unwrap_or(0)` returns the provided zero; if `i=Some(n)`, it returns `n`. + The call is safe and establishes `Q` for every `i in O`; there is no unsafe + operation. +2. **`turbo` executable branch.** For every full case with `f=true` and + `t in {X,A}`, the `turbo` definition is selected and the rejection predicate + is false. The first `unwrap_or(0)` produces `x=0` from `None` and `x=n` from + `Some(n)`. The unsafe receiver is then syntactically constructed as + `Some(x)`, not `None`; therefore the exact `unwrap_unchecked` safety + obligation holds. It returns `x`, establishing `Q` in both input cases. + +These derivations are parametric in `t,h,p,d,i` where stated. `h`, profile, and +debug assertions do not occur in either function body; target affects only the +proved `W` rejection. Version is discharged by the exhaustive exact-document +partition above. + +## Covered predicates and closure certificates + +Without dropping any full-case dimension, define + +```text +Executable(c) := Base(c) and (!f or (f and t in {X,A})). +Covered_sound(c) := Executable(c). +Covered_post(c) := Executable(c). +Required_sound(c) := Required(c). +Required_post(c) := Required(c). +``` + +The branch lemmas prove soundness and `Q`, respectively, for every case in the +two `Executable` disjuncts, so these are the applicable aggregate coverage +predicates. If `Required(c)`, then `DS(c)` or `DI(c)`. Both imply `Base(c)`; if +`!f`, the first `Executable` disjunct holds, while if `f`, inspection of every +`f`-disjunct in both exact policy predicates gives `t in {X,A}`. Consequently +`Required_sound subseteq Covered_sound` and +`Required_post subseteq Covered_post`. These two pointwise containments certify +the whole-domain soundness and behavioral verdicts; coverage is not a union of +different obligations proved on different regions. + +## TCB, findings, and residual scope + +`BUILD-MAP-POLICY` is the only admitted non-Rust premise. Its human disposition +is accepted; its identity is the toolchain-bundled Cargo for exactly Rust +1.84.0, 1.85.0, and 1.86.0 acting on the supplied manifest/source. This report +uses it only for feature/target `cfg` reachability, branch selection, and +effective rejection, exactly its listed consumers. It is not used for Rust +semantics, branch correctness, compatibility, or binary/backend correctness. +The versioned Reference/std propositions above are authoritative Rust axioms, +not compatibility assumptions. There is no dependency, tool-result, external, +deployment, or probabilistic TCB entry. + +**POLICY-1 (UNPROVED governance claim).** The smallest missing premise is an +authorized rule selecting or combining Scarlet and Indigo. Resolution requires +a published precedence/supersession/merge decision; it would change domain +identity, not the proofs over `A` unless it adds cases outside `A`. + +**DOC-1 (proof-artifact deficiency; implementation proved).** The existing +SAFETY comment records the decisive local fact—construction as `Some`—but does +not state the consumed callee precondition. A proof-grade replacement is: + +```rust +// SAFETY: `unwrap_unchecked` requires the receiver not to be `None`. +// It is constructed immediately here as `Some(value)`, so that holds. +``` + +No implementation change is required for this finding. + +Excluded from the claims are configurations outside `Required`, emitted binary +correctness, compiler/backend/linker behavior, performance, and undocumented +robustness. Re-audit is required for any source, manifest, policy-resolution, +feature/target/profile support, TCB disposition or mapping, Rust-version scope, +or materially consumed authoritative-documentation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/I.md new file mode 100644 index 0000000000..f22113b8b0 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/I.md @@ -0,0 +1,190 @@ +# Focused unsafe-code audit + +## Claim, snapshot, and verdicts + +This is a source-level audit of the supplied `Cargo.toml` and `src/lib.rs` under +the two supplied policies, for Rust/standard-library releases 1.84.0, 1.85.0, +and 1.86.0. Scope comprises the public safe function `value_or_zero`, its two +conditionally selected definitions, the one `unwrap_unchecked` operation, its +documented return-value postcondition, and the `turbo`/`wasm32` rejection. There +are no dependencies, generated sources, build scripts, public fields, traits, +impls, exported macros, FFI surfaces, or representation invariants. + +| Claim | Verdict | Qualification | +|---|---|---| +| Freedom from Rust undefined behavior for every case in the conservative audit domain `Required` below | **PROVED** | Source semantics; relative to accepted `BUILD-MAP-POLICY` solely for mapping policy configurations to Rust `cfg`s/source selection | +| “Returns the contained byte, or zero when `value` is `None`” over that same domain | **PROVED** | Same qualification | +| Identity of the crate's exact support promise | **UNPROVED** | Scarlet and Indigo are incomparable current commitments and no resolution rule is authorized | + +Thus the mandatory soundness and behavioral claims are also **PROVED** +separately over each policy-induced domain, by their proved containment in +`Required`. This does not resolve which policy, union, intersection, or other +set is the actual project promise. No backend, binary, future-release, or +unsupported-configuration correctness is claimed. Audit cutoff: 2026-08-02; +the supplied policies contain no moving component. + +## Exact policy and full-case domains + +Let + +- `V = {1.84.0, 1.85.0, 1.86.0}`; +- `T = {X, A, W}`, with the triples defined exactly as in the policies; +- `B = {false, true}`; +- `P` be all Cargo profiles (as quantified by both policies); and +- `O = Valid(Option)`, including `None` and every `Some(x)` with valid + `x: u8`. + +For configuration `q=(v,t,f,h)`, the policies' exact predicates are + +```text +Scarlet(q) := v in V and t in T and + (!f + or (f and t = X and (!h or v >= 1.85.0)) + or (f and t = A and h)) + +Indigo(q) := v in V and t in T and + (!f + or (f and t = X and (h or v >= 1.86.0)) + or (f and t = A and !h and v >= 1.85.0)) +``` + +They are unequal and incomparable. `(1.84.0,X,true,false)` is Scarlet: its +Scarlet `X` arm holds through `!h`; it is not Indigo because both `h` and +`v>=1.86.0` are false. Conversely `(1.84.0,X,true,true)` is Indigo through its +`h` term, but not Scarlet because both `!h` and `v>=1.85.0` are false. These +are explicit witnesses to `Scarlet ⊈ Indigo` and `Indigo ⊈ Scarlet`. + +A full case is exactly +`c=(v,t,f,h,p,d,i)`, for `p in P`, `d in B` (the `debug_assertions` state), +and `i in O`. Define + +```text +D_S(c) := Scarlet(v,t,f,h) and p in P and d in B and i in O +D_I(c) := Indigo(v,t,f,h) and p in P and d in B and i in O +Required(c) := D_S(c) or D_I(c) +``` + +`Required` is the selected conservative audit domain, not an asserted project +promise. For arbitrary full `c`, `D_S(c) => Required(c)` by left disjunction +introduction, and `D_I(c) => Required(c)` by right disjunction introduction; +these separately prove `D_S ⊆ Required` and `D_I ⊆ Required`. The same +two witnesses, extended with any `p,d,i`, show the full-case domains remain +incomparable. + +## Configuration selection and rejection + +For each exact release, the Reference says `all()` is “true if all … predicates +are true”, `not()` is “true if its predicate is false”, and a `cfg` attribute +“conditionally includes the thing … based on a configuration predicate”: +[1.84 predicates](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), +[1.84 attribute](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.85 predicates](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), +[1.85 attribute](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), +[1.86 predicates](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation), +[1.86 attribute](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute). +The exact-version `compile_error!` pages identically state: “Causes compilation +to fail with the given error message when encountered.” +([1.84](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), +[1.85](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), +[1.86](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html)). + +Applying only the accepted `BUILD-MAP-POLICY`, `f` supplies +`cfg(feature="turbo")`, `h` supplies the analogous `hardened` option, and +`X/A/W` supply `target_arch="x86_64"/"aarch64"/"wasm32"`, for each listed +release and profile. Combining that admitted leaf mapping with the cited Rust +semantics proves: + +- if `!f`, exactly the `cfg(not(feature="turbo"))` function is included; +- if `f` and `t` is `X` or `A`, exactly the turbo function is included and the + `compile_error!` predicate is false; and +- if `f` and `t=W`, both operands of `all(...)` are true, so the error macro is + included and compilation fails. This rejection is independent of `h,p,d,i`. + +Policy-level exclusion is independent: substituting `f=true,t=W` makes `!f` +false and every `t=X`/`t=A` arm false in both predicates. Hence no such case is +in `D_S`, `D_I`, or `Required`. The source additionally rejects every such +build effectively, relative to `BUILD-MAP-POLICY`; it supplies no callable +library execution to which the runtime postcondition could apply. + +## Branch proofs and obligation ledger + +The exact 1.84/1.85/1.86 `Option` pages use identical controlling prose: +`unwrap_or` “Returns the contained `Some` value or a provided default”; +`unwrap_unchecked` “Returns the contained `Some` value”; and “Calling this +method on `None` is undefined behavior.” +([1.84 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), +[1.84 `unwrap_unchecked`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.85 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), +[1.85 `unwrap_unchecked`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), +[1.86 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), +[1.86 `unwrap_unchecked`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked)). + +Let `Q(i,r)` mean `r=x` when `i=Some(x)`, and `r=0` when `i=None`. + +| Obligation | Full applicability | Derivation | Status | +|---|---|---|---| +| Non-turbo soundness and `Q` (`lib.rs:7-9`) | `v in V,!f,t in T,h,d in B,p in P,i in O` | Safe `unwrap_or(0)` returns the contained value or `0`; no unsafe operation occurs | **PROVED** | +| Turbo unsafe precondition (`lib.rs:16`) | `v in V,f,t in {X,A},h,d in B,p in P,i in O` | First `unwrap_or(0)` produces some byte `y`; the receiver is then constructed immediately as `Some(y)`, therefore it is not `None` | **PROVED** | +| Turbo `Q` (`lib.rs:13-16`) | same | `unwrap_unchecked` returns the contained `y`; the preceding `unwrap_or(0)` establishes `y=x` for `Some(x)` and `y=0` for `None` | **PROVED** | +| `turbo`/`W` effective rejection (`lib.rs:3-4`) | `v in V,f,t=W,h,d in B,p in P,i in O` | cfg derivation above; failure precedes any runtime input | **PROVED relative to BUILD-MAP-POLICY** | + +The branch proofs are parametric in target within their stated branch, +`h`, profile, debug assertions, and every valid input; none of those omitted +dimensions changes the source operations or the cited contracts. + +## Exact coverage and closure + +Define, without projecting any dimension, + +```text +Base(c) := v in V and t in T and f in B and h in B + and p in P and d in B and i in O +Compiles(c) := !f or (f and t in {X,A}) +Covered_sound(c) := Base(c) and Compiles(c) +Covered_post(c) := Base(c) and Compiles(c) +``` + +Here `Covered_sound` denotes exactly the full cases covered by the two +source-level absence-of-UB lemmas above, and `Covered_post` those covered by +their `Q` lemmas, within the audited versions/targets. For arbitrary `c` with +`Required(c)`, either policy predicate holds. If `!f`, `Compiles(c)` holds. If +`f`, every surviving arm in either exact predicate explicitly requires +`t=X` or `t=A`; hence `Compiles(c)` again holds. All other `Base` conjuncts are +retained verbatim by `D_S` and `D_I`. Therefore + +```text +Required ⊆ Covered_sound +Required ⊆ Covered_post. +``` + +These containments, the exhaustive `f` branch split, and the per-branch proofs +are the certificates for both whole-domain **PROVED** verdicts. + +## TCB disposition, finding, and residual scope + +TCB identity is the supplied `TCB.md`, entry `BUILD-MAP-POLICY`; disposition: +accepted. It is consumed only in source-selection and effective-rejection +lemmas. It supplies no Option semantics, branch correctness, version +compatibility, or backend correctness. The version-matched Reference/std +quotations above are authoritative `AXIOM` entries, each restricted to its +named release. No compatibility interpolation is used and no other assumption +or tool-derived evidence is consumed. + +**Documentation finding (implementation still PROVED).** The existing safety +comment records the decisive local fact—construction as `Some`—but omits the +callee's exact precondition and the result used for `Q`; the audit had to +reconstruct those material links. A proof-grade replacement is: + +```rust +// SAFETY: `Option::unwrap_unchecked` requires this receiver not to be `None`. +// It is constructed immediately as `Some(value)`, so that requirement holds; +// the call returns the contained `value`. +unsafe { Some(value).unwrap_unchecked() } +``` + +Re-audit on any source/manifest/policy/TCB change; a change to the three Rust +versions or cited contracts; or a change to feature names, targets, supported +profiles, or debug-assertion policy. Residual scope comprises invalid +`Option` values, versions/targets outside the stated sets, rejected builds, +compiler/backend/binary behavior, and resolution of the conflicting support +commitments. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/J.md new file mode 100644 index 0000000000..a78897af64 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/reports/J.md @@ -0,0 +1,168 @@ +# Focused unsafe-code audit + +## Claim, scope, and verdicts + +This audit covers the supplied `Cargo.toml`, `src/lib.rs`, two policy files, and +`TCB.md`, at the 2026-08-01 cutoff. It covers the public safe function +`value_or_zero`, its two configuration-selected implementations, the one +`unsafe` call, and the compile-time rejection item. There are no dependencies, +generated artifacts, unsafe public APIs, fields, traits, impls, callbacks, FFI, +assembly, or representation invariants in the supplied source. + +For the conservative audit domain `Required` defined below: + +| Claim | Verdict | Qualification | +|---|---|---| +| Every well-typed call with any valid `Option` is free of Rust UB | **PROVED** | Source-level Rust semantics; relative to accepted `BUILD-MAP-POLICY` for policy-to-`cfg` reachability | +| The call returns its contained byte, or zero for `None` | **PROVED** | Same domain and qualification | +| Combined mandatory claim | **PROVED** | `Required ⊆ Covered_sound ∩ Covered_post` is proved below | +| A single exact project support predicate can be selected from Scarlet and Indigo | **UNPROVED** | No precedence or conflict-resolution rule is authorized; the audit union is not such a resolution | + +These are source-level conclusions, not compiler-backend, binary, or platform +correctness claims. + +## Exact policy predicates and relationship + +Let `V={1.84.0,1.85.0,1.86.0}`, `T={X,A,W}`, where `X`, `A`, and `W` have the +triples defined in the policies, and let `f` and `h` be Boolean `turbo` and +`hardened` states. Scarlet supports exactly `v∈V ∧ t∈T` and: + +```text +!f +or (f and t = X and (!h or v >= 1.85.0)) +or (f and t = A and h) +``` + +Indigo supports exactly `v∈V ∧ t∈T` and: + +```text +!f +or (f and t = X and (h or v >= 1.86.0)) +or (f and t = A and !h and v >= 1.85.0) +``` + +They are unequal and incomparable. The configuration +`(1.84.0,X,true,false)` is Scarlet-only: Scarlet's `X ∧ !h` disjunct holds, +whereas every Indigo disjunct is false. Conversely, +`(1.84.0,X,true,true)` is Indigo-only: Indigo's `X ∧ h` disjunct holds, +whereas Scarlet requires `!h` or `v>=1.85.0`. Thus neither predicate contains +the other. Each separator extends to every policy-supported profile, +debug-assertion state, and valid input. + +## Full-case domains + +Let: + +```text +B = {false,true} +P = the symbolic set of all Cargo profiles +O = {None} ∪ {Some(n) | n∈{0,…,255}} +c = (v,t,f,h,p,d,i) +Base(c) := v∈V ∧ t∈T ∧ f∈B ∧ h∈B ∧ p∈P ∧ d∈B ∧ i∈O +``` + +Writing the displayed policy bodies as `S(v,t,f,h)` and `I(v,t,f,h)`: + +```text +D_S(c) := Base(c) ∧ S(v,t,f,h) +D_I(c) := Base(c) ∧ I(v,t,f,h) +Required(c) := D_S(c) ∨ D_I(c) +``` + +`D_S` and `D_I` are the exact Scarlet- and Indigo-induced full-case domains. +`Required` is the selected conservative audit domain. Separately, +`D_S⊆Required` and `D_I⊆Required` follow by disjunction introduction for +every complete tuple `c`; hence it contains both domains. No equality between +`Required` and an exact crate support promise is asserted: the latter remains +unresolved by the controlling documents. + +## Authoritative semantic premises + +The following wording was checked separately at every exact release, so no +cross-version compatibility assumption is used. + +* On the exact Option pages for [1.84.0 `unwrap_or`](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_or), [1.85.0 `unwrap_or`](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_or), and [1.86.0 `unwrap_or`](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_or), the contract says: “Returns the contained `Some` value or a provided default.” The corresponding [1.84.0](https://doc.rust-lang.org/1.84.0/std/option/enum.Option.html#method.unwrap_unchecked), [1.85.0](https://doc.rust-lang.org/1.85.0/std/option/enum.Option.html#method.unwrap_unchecked), and [1.86.0](https://doc.rust-lang.org/1.86.0/std/option/enum.Option.html#method.unwrap_unchecked) `unwrap_unchecked` pages say “Returns the contained `Some` value” and, under Safety, “Calling this method on `None` is undefined behavior.” +* Each exact conditional-compilation Reference—[1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#conditional-compilation), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#conditional-compilation), and [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#conditional-compilation)—defines `all()` as “true if all of the given predicates are true” and `not()` as “true if its predicate is false.” Their `cfg`-attribute sections ([1.84.0](https://doc.rust-lang.org/1.84.0/reference/conditional-compilation.html#the-cfg-attribute), [1.85.0](https://doc.rust-lang.org/1.85.0/reference/conditional-compilation.html#the-cfg-attribute), [1.86.0](https://doc.rust-lang.org/1.86.0/reference/conditional-compilation.html#the-cfg-attribute)) say it “conditionally includes” its attached item and that when the “predicate is false, the thing is removed.” +* The exact [1.84.0](https://doc.rust-lang.org/1.84.0/std/macro.compile_error.html), [1.85.0](https://doc.rust-lang.org/1.85.0/std/macro.compile_error.html), and [1.86.0](https://doc.rust-lang.org/1.86.0/std/macro.compile_error.html) macro pages all state: “Causes compilation to fail with the given error message when encountered.” + +## Exclusion and effective rejection + +Define the full rejected region +`E(c):=Base(c) ∧ f ∧ t=W`. Both policies exclude every member: with +`f=true`, `!f` is false, and with `t=W`, every `t=X` or `t=A` turbo disjunct is +false. Therefore `E∩D_S=E∩D_I=∅`, independently of `h,p,d,i`. + +Source-level rejection is a separate fact. Relative to the accepted +`BUILD-MAP-POLICY`, every `c∈E` sets both `feature="turbo"` and +`target_arch="wasm32"`. The `all(...)` predicate is therefore true, its `cfg` +item is included, and the encountered `compile_error!` makes compilation fail. +Thus no `E` case produces a callable library artifact. `h`, profile, +`debug_assertions`, and runtime input do not occur in this rejection condition. + +## Branch and obligation proofs + +Define `g(None)=0` and `g(Some(n))=n`. + +**Non-turbo branch (`Base(c) ∧ !f`).** `BUILD-MAP-POLICY` plus the versioned +`cfg` rules selects the safe implementation. The exact-version `unwrap_or` +contract gives `value.unwrap_or(0)=g(i)` for both exhaustive input cases. +There is no unsafe operation on this branch, and it returns `g(i)`, proving +soundness and the documented postcondition. The argument is parametric in +`v,t,h,p,d` after applying the appropriate one of the three exact-version +premises. + +**Turbo, non-W branch (`Base(c) ∧ f ∧ t≠W`).** The mapping and `cfg` rules +select the turbo implementation without encountering the rejection item. +First, safe `unwrap_or(0)` establishes the local `value=g(i)`. The receiver of +the unsafe call is then the expression `Some(value)`, hence is not `None`. +This discharges the complete documented safety obligation of +`unwrap_unchecked`; its return contract yields the contained `value=g(i)`. +The execution is UB-free and returns exactly the documented result for every +`i∈O`. Again `h,p,d` and the non-W target identity do not affect the dataflow, +and each `v` uses its own exact documentation. + +The existing safety comment records the decisive checked fact, but omits the +callee's explicit not-`None` obligation. This is proof-documentation debt, not +an implementation defect. A complete adjacent replacement would be: + +```rust +// SAFETY: `unwrap_unchecked` requires its receiver not be `None`. +// The receiver is constructed here as `Some(value)`, so it is not `None`. +``` + +## Covered predicates and closure certificates + +Without projecting away any full-case dimension, let: + +```text +Covered_sound(c) := Base(c) ∧ !(f ∧ t=W) +Covered_post(c) := Base(c) ∧ !(f ∧ t=W) +Covered_reject(c):= Base(c) ∧ f ∧ t=W +``` + +For each of the first two obligations, `Covered` is the union of the exhaustive +`!f` proof case and the `f ∧ t≠W` proof case. For every `c∈Required`, the +full `Base(c)` conjunct holds. The policy-exclusion proof above also gives +`!(f ∧ t=W)`. Hence `Required⊆Covered_sound` and independently +`Required⊆Covered_post`; pointwise conjunction gives +`Required⊆Covered_sound∩Covered_post`. This is the certificate for both +whole-domain `PROVED` verdicts. `Covered_reject` records the disjoint, +effectively rejected source region; it is not treated as a callable-behavior +case. + +## TCB, evidence, residual scope, and triggers + +`BUILD-MAP-POLICY` is the sole additional accepted premise. Its identity is +the toolchain-bundled Cargo for exactly Rust 1.84.0, 1.85.0, and 1.86.0 on the +supplied manifest/source. Only its named feature-to-`cfg` and target-to- +`target_arch` mappings are consumed, solely for branch reachability and +effective rejection. No Rust semantics, backend behavior, or versions outside +`V` are inferred from it. The exact-version Rust pages above are authoritative +axioms, not a compatibility bridge. No test, execution, build, expansion, or +tool-derived result was used. + +Residual scope comprises configurations outside `Base`, binary/backend +correctness, and the unresolved identity of the crate's single support promise. +Re-audit is required by any source, manifest, policy, TCB disposition/mapping, +feature or target set, supported Rust release, relevant Rust documentation, or +documented `value_or_zero` contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/P/s2/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/PACKET.json new file mode 100644 index 0000000000..45c38684dd --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "3dc7862cdc2fdc1d44fd97235ad043602bd26ab3b428209b94fe9fb0602c14f8", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "Q", + "presentation_order": [ + "C", + "A", + "B", + "F", + "I", + "H", + "G", + "J", + "D", + "E" + ], + "report_sha256": { + "A": "2f12ab5921c09f2eaf84d142758c151a33e35e8868fb9d7e0ddb3e1b15667c50", + "B": "56557faf2342dc507d6f1e13ad3c9976b04c74f555ba8071dfb4797b453cd4e8", + "C": "70aa95c476fb1d5b79ce3af822cf0dea84ad8134ecedee859aa09c98b5c51a36", + "D": "31b3e62080d847ce3a1005a6f3e1a8359578a5859fd56f1e4fc3bbf6a95784ea", + "E": "645f68d41c35811515b578645d72dce0dfe469bc7d123d4676c6f2779043409c", + "F": "cd6f9c0f3aeec081ba035b4f2f88168c5b3fb6143535dc1ebee925f270f4d9b5", + "G": "d967f1aa39439c98ad3848738c66656c708d763c1a00a16a40ef58197b885149", + "H": "67ff2058c11c9555d9ad9f940d58a5bcf773dcdcff0120d3cab8e22f71f9ab7e", + "I": "92773944d416bd3170da772c79531168275c351ce858b54ffed8558f55a83d68", + "J": "6a1aad4f07b372199c6b991e19332f67e30230c93e695d407ce30d97d0fc5df4" + }, + "rubric_sha256": "e18aba632c0f7bd3f4f2725e9a2515b2e2f5f561e7ed3320df6ad8b5154df98e", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s1", + "target_byte_tree_sha256": "35bb6be0402f9d81918c3afc850dd54cde012865bba90d0cd8d7042d78a582ee" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/RUBRIC.md new file mode 100644 index 0000000000..503229e427 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/RUBRIC.md @@ -0,0 +1,78 @@ +# Mode Q Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file to a report agent. + +Let `C_Q` be Rust 1.80.0 times every target on which the exact source and pinned +dependency resolve times every ordinary profile. + +- `Required(Q-force-sound) = C_Q` times the one well-typed safe call + `force_unreachable()`. +- `Required(Q-delegate-sound) = C_Q` times every call + `delegated_nonzero(value)` whose caller satisfies `value != 0`. + +## Atoms + +- **Q1 — Domain and claim separation:** State both valid-use domains and audit + the two APIs independently. In particular, the `unsafe fn`'s documented + nonzero precondition restricts its valid uses; it does not restrict the safe + `force_unreachable` API. + - `scope_basis`: `REQUEST.md` explicitly asks for two separate claims and + supplies their common compilation scope; each API's signature/contract + determines its valid-use domain. + - `dependencies`: none. +- **Q2 — Complete UB certificate:** For `force_unreachable`, give all four + links explicitly or by an equivalently exact chain: (1) the safe call is + well-typed and valid; (2) its only body path reaches the executed + `unreachable_unchecked` call; (3) that call requires its site not to be + reached and that proposition is false; and (4) applicable Rust 1.80.0 std + documentation says reaching it is UB. + - `scope_basis`: necessary certificate for the requested soundness verdict + on the safe API. + - `dependencies`: Q1. +- **Q3 — Existential closure:** Report `Q-force-sound` **UNSOUND**. The complete + in-scope witness refutes universal soundness; do not weaken it to `UNPROVED` + merely because no universal positive proof was built. + - `scope_basis`: `REQUEST.md` asks for the strongest justified verdict. + - `dependencies`: Q2. +- **Q4 — Exact missing premise:** For `delegated_nonzero`, recognize that a + valid caller supplies the dependency API's nonzero caller precondition, but + the selected unsafe dependency body is absent and no accepted `UNSAFE-DEP` + entry establishes that it honors its contract. The pin and caller-facing + docs establish the logical coordinate and propagated obligation, not + authenticated implementation identity or correctness. The smallest missing + proposition is that every valid nonzero call to the selected + `peer-unsafe-dep` 3.4.5 implementation is UB-free over this domain. + - `scope_basis`: the supplied evidence packet and TCB policy are expressly + part of the requested dependency claim review. + - `dependencies`: Q1. +- **Q5 — No fabricated witness or silent trust:** Report + `Q-delegate-sound` **UNPROVED**, not `PROVED` or `UNSOUND`. Its required cases + lack the dependency-soundness premise, while the unavailable body supplies no + proved UB execution. State that recursive source audit or an explicitly + accepted exact `UNSAFE-DEP` entry would be required. + - `scope_basis`: `REQUEST.md` asks for the strongest packet-supported verdict + and smallest missing proposition. + - `dependencies`: Q4. + +## Hard errors + +- **QH1:** Call `force_unreachable` sound or only `UNPROVED` after establishing + all four Q2 links. +- **QH2:** Issue `UNSOUND` for it without a valid call, reachability, false exact + safety proposition, and authoritative UB consequence. +- **QH3:** Silently trust the unavailable unsafe dependency, treat the pin as + implementation proof, or report `delegated_nonzero` `PROVED`. +- **QH4:** Fabricate dependency body behavior or a UB execution and report + `delegated_nonzero` `UNSOUND`. +- **QH5:** Treat violation of the dependency's documented caller precondition + as itself an executed UB event. + +## Checked authority + +- `https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety` + — reaching `unreachable_unchecked` is UB; applicable to Rust 1.80.0 without a + target/profile qualification relevant here. + +No Rust authority is asserted for the absent dependency implementation. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/allowlist.txt new file mode 100644 index 0000000000..d467a88cf6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/allowlist.txt @@ -0,0 +1 @@ +https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/A.md new file mode 100644 index 0000000000..ec0057b4af --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/A.md @@ -0,0 +1,57 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, and domain + +The audited artifact is the submitted `lib.rs` for `quantifier-target` 0.1.0, edition 2021, together with `Cargo.toml`, `DEPENDENCY-API.md`, `EVIDENCE.md`, and `TCB.md`. The manifest pins `peer-unsafe-dep = "=3.4.5"`. No dependency implementation, generated output, binary, prior audit, or tool-derived result was supplied or inspected. + +Let + +`D = {(t,p) | Rust/stdlib = 1.80.0, this source and peer-unsafe-dep 3.4.5 resolve on target t, and p is an ordinary debug or ordinary release profile}`. + +This is the controlling `Required` predicate from `REQUEST.md`; it is retained symbolically rather than replaced by an unproved target inventory. There are no `cfg`, feature, generated-source, target, or profile branches in `lib.rs`. Thus its two function bodies are identical throughout `D`. The exact dependency implementation may vary only within the resolution already quantified by `D`; its absence matters to Claim 2. Audit cutoff: this submitted source/evidence snapshot on 2026-08-01. + +The complete exported surface is the safe free function `force_unreachable` and unsafe free function `delegated_nonzero`. There are no exported fields, constructors, types, traits/impls, statics, macros, hidden items, callbacks, FFI declarations, or owned representation invariants in the submitted source. + +## Verdicts + +| Claim | Valid-use domain | Compilation domain | Verdict | +|---|---|---|---| +| C1: every permitted execution of `force_unreachable()` is free of Rust UB | Every well-typed safe invocation; there is no caller safety precondition | `D` | **UNSOUND**, on every member of `D` | +| C2: every permitted execution of `delegated_nonzero(value)` is free of Rust UB | Unsafe invocations with a valid `u8` value satisfying the complete documented obligation `value != 0`, i.e. `value in 1..=255`; no ongoing or terminal obligation is documented | `D` | **UNPROVED** | + +## C1 proof and UB certificate + +`lib.rs:4` exposes `force_unreachable` as safe. Therefore a safe caller may directly invoke it, and that invocation is a valid in-scope use. Its body has no branch, check, argument, callback, or earlier operation: control reaches the call to `std::hint::unreachable_unchecked()` at `lib.rs:6`. + +Accepted TCB entry **AXIOM-UU-180** is the verified Rust 1.80.0 standard-library Safety statement: “Reaching this function is Undefined Behavior.” ([exact versioned page](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). The submitted evidence and accepted trust decision give this proposition every-target/ordinary-profile applicability, hence all of `D`. + +Thus, for each `(t,p) in D`: (1) a direct safe call is valid; (2) source control flow necessarily executes the unsafe operation; (3) its required proposition, that the call site is unreachable, is false because the invocation reached it; and (4) AXIOM-UU-180 entails UB. This is a complete existential refutation for each configuration, stronger than merely failing a universal proof. The `SAFETY` comment “assumed to be unreachable” supplies no premise and is contradicted by the public safe entry path. + +Minimum repair: remove the unchecked operation (for example, use a defined panic path) or establish an actually enforced control-flow invariant before it. Documentation alone cannot impose a hidden precondition on this safe API. + +## C2 derivation and smallest gap + +For every valid C2 call, `value != 0` holds by the exported unsafe contract at `lib.rs:11-14`. The wrapper passes that same, unchanged `value` to `peer_unsafe_dep::duplicate_nonzero` at `lib.rs:17`. The submitted exact 3.4.5 dependency declaration requires precisely `value != 0`. Therefore the local caller-side safety obligation for the dependency call is proved throughout `D`; the adjacent `SAFETY` comment accurately states this part. + +That is not a proof of the unsafe dependency provider. A third-party unsafe call additionally requires the exact implementation to uphold its contract for every valid call. `DEPENDENCY-API.md` expressly says its implementation and generated output are absent and supplies no assertion about its body. `TCB.md` expressly declines any `UNSAFE-DEP` admission for 3.4.5. An exact pin establishes identity, not undocumented implementation correctness. + +The smallest missing soundness proposition is: + +> For every `(t,p) in D` and every `v in 1..=255`, every permitted execution of the exact resolved `peer-unsafe-dep` 3.4.5 implementation of `duplicate_nonzero(v)` is free of Rust undefined behavior. + +Neither source proof nor an accepted TCB entry entails it. No valid UB witness against that implementation is supplied, so **UNSOUND** is not justified; failure of the universal derivation yields **UNPROVED**. Resolution requires either a recursive audit of the exact dependency implementation/generated artifact over `D`, or explicit human acceptance of that precise `UNSAFE-DEP` proposition. + +The wrapper documents no result-equals-input postcondition; it only syntactically forwards the callee result. The dependency documentation separately says it returns `value`. That dependency postcondition is also **UNPROVED** for the same missing implementation evidence, though it is not needed to prove the wrapper’s caller-side precondition. + +## Obligation and trust closure + +| Obligation | Premises/coverage | Status | +|---|---|---| +| O1: safe C1 callers reach no UB | local unconditional call + AXIOM-UU-180, all `D` | Refuted; C1 UNSOUND | +| O2: C2 establishes callee precondition | exported `value != 0` contract + unchanged argument, all `D` | PROVED | +| O3: exact unsafe dependency honors its safety contract | implementation proof or accepted `UNSAFE-DEP` required; neither supplied | UNPROVED; blocks C2 | +| O4: dependency honors “Returns value” | same missing provider evidence | UNPROVED | + +TCB revision is the supplied `TCB.md`: AXIOM-UU-180 is accepted; unsafe-dependency, implementation, compatibility, tool, and deployment premises are absent. No testing evidence contributes. Aggregate coverage is all `D` for the C1 refutation and O2, but O3 covers no established region, so `Required subseteq Covered` cannot be certified for C2. + +Re-audit is required if either function or its documentation changes; the supported Rust/target/profile predicate changes; the Rust authority changes; the dependency identity, contract, features, implementation, or generated output becomes available or changes; or the TCB trust decision changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/B.md new file mode 100644 index 0000000000..f43cd2c513 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/B.md @@ -0,0 +1,130 @@ +# Focused source-only unsafe Rust review + +## Claim, snapshot, and domain + +Audited artifacts are `lib.rs` (SHA-256 +`778d644359b84bc0e519ed7220bfcadfbba578e2c9fd4c474ce742c4b0021ceb`) and +`Cargo.toml` (SHA-256 +`57b66359b9447d371fa68a2cfdc04f49176b1a3ce815bb96027b2f76d917d0a7`), +package `quantifier-target` 0.1.0, edition 2021. The manifest exactly pins +`peer-unsafe-dep =3.4.5`; the submitted declaration/contract is available, but +its source, generated output, build behavior, prior audit, and binary are not. + +Let `T = { t | this source and the exact peer dependency resolve for target t }` +and `P = {ordinary-debug, ordinary-release}`. The exact configuration domain is +`Required_cfg = {Rust 1.80.0} × T × P`, directly from `REQUEST.md`; no finite +enumeration of `T` is asserted. There are no features, `cfg` branches, +generators, build scripts, macros, target operations, or profile-sensitive +checks in the submitted crate source. Thus the local source is selected +uniformly and the arguments below are parametric in `(t,p) ∈ T×P`. Unknown +dependency configuration remains material to the second claim. + +The full valid-use domains are: + +* `F`: each `(t,p)` above and every otherwise-valid, well-typed safe execution + that invokes `force_unreachable()`; a safe API has no hidden caller safety + precondition. +* `D`: each `(t,p)` above, every `value ∈ 1..=255`, and every execution whose + caller invokes unsafe `delegated_nonzero(value)` while satisfying its sole + documented safety obligation, `value != 0`. + +The claims concern source-level freedom from Rust undefined behavior under Rust +1.80.0 abstract semantics. Compiler/backend correctness and broader behavior +not documented by these APIs are excluded. No test, build, execution, or tool +result is evidence. + +## Evidence and TCB log + +TCB identity is the supplied `TCB.md`, SHA-256 +`86796b85804436595c0f6ffbfa773dac4fce5cbfe28e02223c802a055037d0f4`. + +* **AXIOM-UU (accepted, Rust authority):** Rust 1.80.0 documents + `unreachable_unchecked` as: “Reaching this function is *Undefined Behavior*.” + The exact [Safety section](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety) + was opened and verified. The supplied authority makes this applicable to all + `(t,p) ∈ T×P`. Consumer: `F-UB`. Re-audit on Rust version or cited-contract + change. +* **PEER-IMPL (expressly unaccepted):** no proposition about what + `peer-unsafe-dep` 3.4.5 executes is admitted. In particular, the human + reviewer declined an `UNSAFE-DEP` entry. Its exact pin freezes a version; its + documentation establishes the caller contract, not implementation + correctness. Consumers blocked: `D-SOUND` and, if relied upon, `D-RET`. + Re-audit on dependency identity, source/features/generated output, contract, + implementation audit, or trust decision change. + +There are no other admitted implementation, compatibility, deployment, or tool +premises. + +## Boundary and obligation inventory + +The complete exported surface is the safe free function `force_unreachable` +and unsafe free function `delegated_nonzero`. There are no exported fields, +types, constructors, methods, traits/impls, statics, macros, hidden APIs, +callbacks, FFI items, or owned representation invariants. Nonzeroness in `D` +is a per-call precondition, not a type invariant. + +| ID | Site | Exact obligation | Disposition | +|---|---|---|---| +| `F-UB` | `lib.rs:6` | Execution must not reach `unreachable_unchecked`. | False on every invocation. | +| `D-CALL` | `lib.rs:17` | The value passed to the peer must be nonzero. | PROVED for all `D`. | +| `D-SOUND` | peer call | The exact peer implementation must be UB-free for every valid call. | UNPROVED. | +| `D-RET` | peer contract | The exact peer implementation returns its input for every valid returning call. | UNPROVED; not needed for wrapper soundness. | + +## Claim F — `force_unreachable` + +**Verdict: UNSOUND** over `F`, relative to `AXIOM-UU`. + +Existential UB certificate (indeed parametric over every supported +configuration): + +1. `force_unreachable()` is public and safe, so calling it from an + otherwise-valid safe execution is a valid in-scope use. +2. Its body has no condition or earlier exit; that call reaches line 6 and + executes `std::hint::unreachable_unchecked()`. +3. That site's required proposition—“the site is unreachable”—is false in this + execution precisely because step 2 reaches it. +4. `AXIOM-UU`, applicable to Rust 1.80.0 on every `(t,p)`, entails undefined + behavior. This closes the required witness chain. + +The existing safety comment merely assumes the needed conclusion and is false +for every invocation; it is both proof-artifact deficient and accompanies an +implementation defect. Replacing the operation with defined safe behavior +(for example, a panic), or changing the API and contract so invocation itself +has an enforceable unsafe obligation, requires a new audit. No UB-containing +execution establishes `CONTRACT-BROKEN`, and none is claimed. + +## Claim D — `delegated_nonzero` + +**Verdict: UNPROVED** for soundness over `D`, relative to the supplied TCB. + +The local call obligation is complete: valid use gives `value != 0`; line 17 +passes that same unmodified `u8` to `duplicate_nonzero`; the submitted peer +contract requires exactly `value != 0`. Thus `D-CALL` covers all of `D`, and +the adjacent safety comment correctly explains this caller-side step. + +That is insufficient for a third-party unsafe API. The smallest missing +soundness proposition is: + +> For the exact `peer-unsafe-dep` 3.4.5 implementation selected in every +> `(t,p) ∈ T×P`, and every `v ∈ 1..=255`, executing +> `duplicate_nonzero(v)` is free of Rust undefined behavior. + +Neither submitted source/evidence proves this proposition nor an accepted +`UNSAFE-DEP` entry admits it. Therefore aggregate `Covered` lacks `D-SOUND` and +`Required_D ⊆ Covered_D` cannot be derived. Absence of the implementation also +provides no valid execution, false safety proposition, or UB consequence, so +`UNSOUND` is not established. + +The wrapper does not explicitly promise that its return equals `value`; the +peer documentation does. If that provider guarantee is intended to be exposed +or consumed, the additionally missing proposition is that the exact peer +implementation returns `v` for every valid returning call. No UB-free +counterexample is supplied, so `CONTRACT-BROKEN` is not established. + +## Aggregate result and review triggers + +The two claims remain separate: `F` is **UNSOUND** and `D` is **UNPROVED**; no +combined `PROVED` result exists. Re-audit on any audited-source or contract +change, Rust/toolchain or target/profile-policy change, dependency resolution, +feature/source/generated-artifact change, accepted TCB change, or newly +available peer implementation audit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/C.md new file mode 100644 index 0000000000..44b850bbaa --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/C.md @@ -0,0 +1,129 @@ +# Focused unsafe-Rust source review + +## Snapshot, scope, and domain + +Audited at 2026-08-01: the exact supplied `lib.rs` and `Cargo.toml` for +`quantifier-target` 0.1.0, plus the submitted contracts and trust decision in +`DEPENDENCY-API.md`, `EVIDENCE.md`, and `TCB.md`. The manifest selects edition +2021 and exactly `peer-unsafe-dep =3.4.5`. This is only a source-level Rust +abstract-semantics review; no binary, backend, dependency implementation, or +generated artifact was available or claimed. + +Let `T = { t | this exact source and peer-unsafe-dep 3.4.5 resolve for target +t under Rust 1.80.0 }`, and `P = {ordinary debug, ordinary release}`. The exact +compilation domain is + +`D = {exact supplied source, edition 2021, Rust/stdlib 1.80.0, dependency +resolution peer-unsafe-dep =3.4.5, t in T, p in P}`. + +This is the controlling expression from `REQUEST.md`, conjoined only with +identities stated by the manifest; hence the normalization is equality, not an +inferred exclusion. `T` is deliberately retained symbolically. `lib.rs` has no +`cfg`, feature, target, profile, assertion, macro, generated-code, allocator, +FFI, concurrency, or build-script branch. Consequently the source reasoning +below is parametric in `t` and `p`; no target inventory is needed. + +The complete exported surface is the safe free function +`force_unreachable()` and unsafe free function `delegated_nonzero(u8) -> u8`. +There are no exported fields, types, traits, methods, statics, macros, +reexports, or hidden items, and no invariant-bearing state. + +## Claims and verdicts + +| Claim | Exact valid-use theorem over `D` | Verdict | +|---|---|---| +| F | Every well-typed safe call of `force_unreachable()` (no caller safety precondition) is free of Rust UB. | **UNSOUND** | +| D | For every `value: u8` with `value != 0` (the sole initial safety obligation; no ongoing or terminal obligation), every call of `delegated_nonzero(value)` is free of Rust UB. | **UNPROVED** | + +For D, the dependency's documented normal-return postcondition, “Returns +`value`,” is also **UNPROVED**, not `CONTRACT-BROKEN`. + +## TCB and evidence disposition + +`AXIOM-UU-180` is accepted exactly as authorized in `TCB.md`. The opened Rust +1.80.0 standard-library Safety section says: “Reaching this function is +Undefined Behavior.” It states no narrower target/profile qualification: +[`std::hint::unreachable_unchecked`](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). +It is consumed only by Claim F and applies throughout `D`. + +The submitted dependency declaration and caller contract identify the callee +and its precondition; they do not establish its implementation's correctness. +No `UNSAFE-DEP` proposition for `peer-unsafe-dep` 3.4.5 is accepted. The human +trust decision expressly rejects relying on its unavailable implementation. +There are no other admitted implementation, compatibility, tool, deployment, +or probabilistic premises. No tests or tool-derived evidence were supplied or +used. + +## Proof and obligation ledger + +### Claim F — complete UB certificate + +1. **Valid in-scope use.** In every case in `D`, downstream safe code may call + the public safe function `force_unreachable()`; its type and documentation + impose no safety precondition. +2. **Reachability.** On entry, lines 4–6 have no check, branch, earlier + divergence, or caller-controlled condition. The body immediately evaluates + `std::hint::unreachable_unchecked()`; thus that operation is reached by the + valid call. +3. **False required proposition.** `AXIOM-UU-180` requires that the function not + be reached. Step 2 proves the opposite. +4. **UB consequence.** `AXIOM-UU-180` directly entails UB on reaching it. + +These local facts are source-identical for every `t in T` and `p in P`, and the +axiom covers that whole domain. Thus each compilation case in `D` has the same +valid safe-call witness. This is an existential refutation, so the verdict is +`UNSOUND`, not merely a failed universal proof. The line-5 comment—“This site +is assumed to be unreachable”—is circular and false for the exported safe +entrypoint; it proves no obligation. There is no defined normal-return +execution from which to certify a separate return postcondition. + +### Claim D — local call proof closes; provider proof does not + +The controlling wrapper contract requires `value != 0`. The submitted exact +callee contract requires the identical proposition. For every valid wrapper +call, that fact follows directly from the wrapper's unsafe precondition, and +line 17 passes the same `u8` unchanged. Therefore the dependency call's entire +documented caller-side precondition is proved throughout `D`. Lines 15–16 +correctly summarize this local implication. + +The remaining soundness obligation is not a caller precondition: the selected +dependency implementation must honor its unsafe API contract. The smallest +missing proposition is: + +> For the exact resolved implementation of `peer-unsafe-dep` 3.4.5, every +> execution of `duplicate_nonzero(v)` with `v: u8` and `v != 0` is free of Rust +> UB, for every target/profile case in `D`. + +Neither inspected source nor an accepted `UNSAFE-DEP` entry proves it. An exact +version pin freezes identity but does not establish this semantic proposition. +Because no dependency body or trusted implementation fact exists, there is +also no proved valid execution reaching a false safety proposition and hence +no `UNSOUND` certificate. Aggregate coverage is therefore incomplete: +`Required_D` is covered for caller-precondition discharge but not for provider +correctness, so `Required_D` is not contained in complete `Covered_D`. + +The separate smallest missing postcondition proposition is that every normal, +UB-free valid call to that exact implementation returns `v`. Without it there +is no wrapper result proof; without an independently established UB-free +falsifying execution there is no `CONTRACT-BROKEN` certificate. + +## Findings, resolution, and residual scope + +- **F-1, implementation defect:** `force_unreachable` exposes unconditional UB + through safe code. A comment cannot repair it. Replace the unchecked + operation with defined behavior such as `unreachable!()`/panic, remove the + entrypoint, or otherwise enforce a sound boundary; then audit the new + artifact. Changing safe behavior or safety classification requires API + compatibility review. +- **D-1, missing dependency proof/TCB:** recursively audit the exact 3.4.5 + implementation over `D`, or obtain authorized acceptance of a precise + `UNSAFE-DEP` entry covering both UB freedom and, if promised, return-value + correctness. Re-audit after any dependency identity, contract, feature, + target/profile support, or trust-decision change. + +Unavailable and therefore excluded from any affirmative claim are the +dependency implementation/generated output, compiler/backend correctness, +binaries, and deployment behavior. Re-audit is also required for changes to +`lib.rs`, the manifest/domain, Rust version or cited authority, exported +surface, or supplied evidence. Every in-scope obligation has the status above; +the combined two-API soundness result is **F: UNSOUND; D: UNPROVED**. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/D.md new file mode 100644 index 0000000000..55398ad246 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/D.md @@ -0,0 +1,57 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, and domain + +Audited snapshot: the submitted `lib.rs`, `Cargo.toml`, dependency contract, evidence policy, and TCB decision. The package is edition 2021 and fixes `peer-unsafe-dep` to exactly 3.4.5. No generated/expanded artifact, dependency body, prior audit, lockfile, build script, feature, conditional source, or test/tool result was supplied or used. This is a Rust-abstract-semantics source claim, not a compiler-binary claim. Audit cutoff: 2026-08-01. TCB log ID: `TCB-SUBMITTED-1`. + +Let + +`C = {Rust compiler and std 1.80.0} × T_resolve × {ordinary debug, ordinary release}`, + +where `T_resolve` is exactly every target on which this source and exact dependency resolve. This is `Required_cfg` by literal transcription of `REQUEST.md`: each member of either set satisfies precisely those three conjuncts, proving both containments and hence equality. Edition 2021, dependency identity 3.4.5, and the submitted source are fixed rather than varying axes. There is no `cfg` or profile-sensitive branch; both proofs below are parametric in target and profile, so no enumeration of `T_resolve` is needed. + +For a full case, retain configuration, input, call validity, and permitted execution: + +- `R_force(c,e) := c∈C ∧ e is a permitted execution of a well-typed safe call to force_unreachable()`; there is no caller safety precondition. +- `R_delegate(c,v,e) := c∈C ∧ v∈{1,…,255} ∧ e is a permitted execution of delegated_nonzero(v)`; `v != 0` is its sole documented initial safety obligation, with no ongoing or terminal obligation. + +## Verdicts + +| Claim | Strongest verdict | Certificate or smallest gap | +|---|---|---| +| `force_unreachable` soundness over `R_force` | **UNSOUND**, for every `c∈C` | For each `c`, the safe expression `force_unreachable()` is a valid witness. `lib.rs:4-6` enters the function and unconditionally executes `std::hint::unreachable_unchecked()`. `AXIOM-UU-180` says reaching that function is UB. Thus valid safe use → reachability → false required proposition (“the call site is unreachable”) → UB. | +| `delegated_nonzero` soundness over `R_delegate` | **UNPROVED** | `lib.rs:14-17` passes unchanged `v` to the dependency. From `R_delegate`, `v != 0`, exactly discharging the submitted callee precondition. The remaining smallest missing proposition is: for every `c∈C`, every nonzero `v:u8`, and every permitted execution, `peer-unsafe-dep` 3.4.5's `duplicate_nonzero(v)` is UB-free. Its implementation is unavailable and that proposition has no accepted TCB entry. Absence of this universal proof supplies no UB witness, so `UNSOUND` is not justified. | + +The first verdict is profile- and target-independent: the same unconditional call is selected, and the authority applies throughout `C`. The source comment “This site is assumed to be unreachable” proves nothing and is contradicted by every invocation: entry into this zero-argument function dominates the call. + +For the second API, the adjacent safety comment adequately proves only the caller-side precondition of the unsafe dependency call. It cannot prove provider correctness. The API's literal description of delegation is established syntactically: line 17 calls the selected function with the unchanged argument and directly yields its normal result. It does not state `result == value`. The dependency documentation separately promises “Returns `value`”; that dependency postcondition is likewise unproved without its implementation or an accepted `UNSAFE-DEP` proposition, is not promoted into the wrapper contract, and is not needed for the wrapper soundness argument. + +## Boundary and obligation inventory + +The complete exported surface in the supplied source is two public free functions: safe `force_unreachable` and unsafe `delegated_nonzero`. No public fields, types, constructors, methods, trait surfaces/implementations, callbacks, macros/generated APIs, hidden items, FFI, state, or destruction path is present. There is no invariant-bearing representation. + +| ID | Site | Exact obligation | Domain | Status | +|---|---|---|---|---| +| O1 | `lib.rs:6` | The `unreachable_unchecked` site is not reached. | Every `R_force` case | **False**; every call reaches it. | +| O2 | `lib.rs:17` | Argument to `duplicate_nonzero` is nonzero. | Every `R_delegate` case | **PROVED**: `v∈{1,…,255}` and unchanged dataflow imply `v != 0`. | +| O3 | dependency call at line 17 | Exact dependency implementation is UB-free for valid calls. | Every `R_delegate` case | **UNPROVED**; `F-DEP`. | +| O4 | wrapper description | Invoke selected peer with `v` and yield its normal result. | Every normally returning `R_delegate` case | **PROVED** directly by line 17; no provider return-value equality inferred. | + +For `force_unreachable`, the existential certificate settles soundness while all independent sites above remain inventoried. For `delegated_nonzero`, aggregate `Covered = Covered(O2) ∩ Covered(O3)`; O2 covers all `R_delegate`, but O3 has no established cases, so `Required ⊆ Covered` is not proved. + +## TCB and evidence audit + +| ID | Category/disposition | Exact proposition, scope, source, consumer | +|---|---|---| +| `AXIOM-UU-180` | AXIOM / accepted by submitted human decision; citation independently verified | Rust 1.80.0 std states: “Reaching this function is Undefined Behavior.” It applies on every required target/profile. Source: [`unreachable_unchecked` Safety](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). Consumer: O1. Re-audit on Rust version, supported domain, source, or material documentation change. | +| `UNSAFE-DEP-345` | UNSAFE-DEP / expressly rejected, not consumable | Proposed proposition would be the O3 universal provider-correctness statement for exact package 3.4.5. The exact pin establishes identity only. No body, recursive audit, generated output, binary, or out-of-band promise supports it. Consumer blocked: O3. | + +No safe-dependency, tool, implementation, compatibility, deployment, or probabilistic premise is admitted. The packet-supplied dependency declaration establishes the caller contract under review, not implementation correctness. No tool-derived evidence exists. + +## Findings and resolutions + +`F-FORCE` (critical, **UNSOUND**): a public safe API unconditionally executes an operation whose checked contract says reaching it is UB. The local proof artifact is false, not merely incomplete. Minimal resolution: remove the unsafe call and use defined behavior such as a panic, or redesign control flow so a real dominating invariant proves the site unreachable. No truthful `SAFETY` rewrite can validate the current body. + +`F-DEP` (**UNPROVED**): provider correctness of third-party unsafe code is hidden trust that the reviewer declined. Resolve by supplying and recursively auditing the exact 3.4.5 implementation for all `C`, or by explicit human acceptance of a precise `UNSAFE-DEP` entry covering O3 (and the dependency's return-equality promise if that promise is to be relied upon). Re-audit both the call contract and provider proof on dependency identity, feature/configuration, or contract change. + +Residual scope is exactly the unavailable dependency implementation and its generated/build inputs. Changes to either API/source documentation, Rust/std version, supported targets/profiles, dependency resolution or API, TCB disposition, or newly supplied generated/tool evidence trigger re-audit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/E.md new file mode 100644 index 0000000000..bb68e8b3f5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/E.md @@ -0,0 +1,127 @@ +# Focused unsafe-Rust source audit + +Reviewed 2026-08-01. This report concerns the submitted `lib.rs`, manifest, +dependency contract, evidence policy, and TCB only. It is a source-level review; +no build, execution, expansion, dependency implementation, binary, or prior +audit was inspected. + +## Domain, snapshot, and boundary + +Let `Dcfg(c)` mean: the compiler and standard library are exactly Rust 1.80.0, +the crate uses edition 2021, the profile is an ordinary debug or release +profile, and the target is one on which this exact source and +`peer-unsafe-dep = 3.4.5` resolve. This is exactly the support expression in +`REQUEST.md:8-11`, with dependency identity fixed by `Cargo.toml:6-7` and +`DEPENDENCY-API.md:3-4`; no target enumeration is inferred. The source contains +no `cfg`, feature, generator, macro, target, or profile branch, so both source +paths below are parametric over every `c` in `Dcfg`. Dependency internals may +still vary and are not silently covered. + +The complete exported surface in the submitted source is: + +| ID | Surface | Boundary | +|---|---|---| +| API-F | `pub fn force_unreachable()` (`lib.rs:4-7`) | Safe: every well-typed safe call is valid; there is no caller safety obligation. | +| API-D | `pub unsafe fn delegated_nonzero(value: u8) -> u8` (`lib.rs:9-18`) | Unsafe: a call is valid exactly when `value != 0`; no ongoing or terminal obligation is documented. | + +There are no representation fields, constructors, traits/impls, callbacks, +reexports, hidden items, generated APIs, or state invariants in the supplied +source. The two calls at `lib.rs:6` and `lib.rs:17` are the complete unsafe-site +inventory. + +## Claims and strongest verdicts + +| Claim | Exact full valid-use domain | Verdict | +|---|---|---| +| C-F | Every `(c, call)` with `c in Dcfg` and any well-typed safe invocation of `force_unreachable()` | **UNSOUND** | +| C-D | Every `(c, v, state, execution)` with `c in Dcfg`, `v: u8`, `v != 0`, and every permitted execution of `delegated_nonzero(v)` | **UNPROVED** | + +### C-F — complete existential UB certificate + +1. **Valid use.** `force_unreachable` is exported as a safe, zero-argument + function. Thus `force_unreachable()` is a valid safe invocation for any + `c in Dcfg`; the packet states an exact resolved dependency, so the declared + supported set is not being replaced by an invented configuration. +2. **Reachability.** On entry, the body has no condition or alternative exit: + its first and only statement calls `std::hint::unreachable_unchecked()` + (`lib.rs:4-6`). Therefore that call site is reached. +3. **False required proposition.** The callee requires that it not be reached; + step 2 proves the opposite. The comment “This site is assumed to be + unreachable” is an unsupported assumption and is directly falsified by the + safe-call witness. +4. **UB consequence.** The checked Rust 1.80.0 standard-library Safety text + states: “Reaching this function is Undefined Behavior.” + ([exact versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). + The page identifies Rust 1.80.0 and gives no narrower target/profile + qualification. Hence the witness reaches UB for every `c in Dcfg`. + +This establishes `UNSOUND`, not merely failure to prove. The UB-containing +execution cannot establish a separate contract-broken witness. No broader safe +API behavior was requested. Minimal remediation is to remove +`unreachable_unchecked` (for example, use a defined panic) or introduce a real +compiler-enforced unsafe boundary with a sufficient contract. + +### C-D — proved forwarding obligation; smallest missing proposition + +The controlling wrapper precondition is exactly `v != 0` (`lib.rs:11-14`). The +submitted dependency contract requires exactly the same proposition +(`DEPENDENCY-API.md:9-12`). For every valid wrapper call, substitution of the +same unchanged `value` into the direct call at `lib.rs:17` therefore proves the +dependency caller-side safety precondition. It also proves the wrapper's stated +delegation behavior: the selected function is called with that same value. +There is no branch, mutation, state invariant, or configuration-dependent +source path. The adjacent comment correctly records this local implication. + +That implication is insufficient to prove wrapper soundness. A third-party +unsafe API additionally requires proof that its exact implementation honors its +contract for every valid call. The smallest missing proposition is: + +> For every `c in Dcfg` and every `v: u8` with `v != 0`, every permitted +> execution of the exact `peer-unsafe-dep` 3.4.5 +> `duplicate_nonzero(v)` implementation is free of Rust undefined behavior. + +No supplied fact entails it: `DEPENDENCY-API.md:15-17` says the implementation +and generated output are absent and supplies no body assertion; `TCB.md:5-7` +expressly declines an `UNSAFE-DEP` entry. Absence of such a universal proof does +not prove an executable counterexample, so `UNSOUND` is not justified. The +dependency documentation also says “Returns `value`”; if that provider +postcondition is treated as a wrapper return guarantee, its implementation +proof is missing for the same reason. The wrapper itself does not explicitly +document a return-value postcondition. + +Minimal resolution is either a recursive audit proving the proposition over +all `Dcfg`, or human acceptance of that exact proposition as an +`UNSAFE-DEP` TCB entry. An exact version pin freezes identity but supplies +neither result. Replacing the delegation with a locally proved safe operation +would remove this trust requirement. + +## Obligation and TCB reconciliation + +| Obligation | Status | Basis | +|---|---|---| +| O-F1: do not reach `unreachable_unchecked` | **Refuted** | C-F steps 1-3 | +| O-F2: reaching it entails UB | **Proved** | AXIOM-UU below | +| O-D1: pass nonzero to dependency | **Proved** | Wrapper contract plus unchanged dataflow | +| O-D2: exact unsafe dependency is UB-free for every valid call | **Unproved** | Missing/rejected UNSAFE-DEP proposition | +| O-D3: invoke selected peer with the same value | **Proved** | Direct call expression at `lib.rs:17` | + +**TCB-SUBMITTED revision:** the supplied `TCB.md`. + +| ID | Category/disposition | Exact proposition and scope | Consumer/trigger | +|---|---|---|---| +| AXIOM-UU | AXIOM, accepted and independently citation-checked | On Rust 1.80.0 across `Dcfg`, reaching `std::hint::unreachable_unchecked` is UB. | O-F2; recheck if Rust version/domain or cited text changes. | +| UNSAFE-DEP-345 | UNSAFE-DEP, rejected/not admitted | The missing O-D2 proposition above. | Blocks C-D; revisit on implementation audit or explicit trust decision. | + +No tool-derived evidence or other accepted implementation, compatibility, +deployment, or dependency premise exists. The dependency contract is controlling +API text, not evidence that its unavailable unsafe implementation fulfills it. + +## Residual scope and re-audit triggers + +Dependency source/generated output, binaries, compiler/backend correctness, +custom profiles, targets outside `Dcfg`, and behavioral properties not stated +above remain unaudited. Re-audit on any source or safety-contract change, +dependency identity/implementation/trust change, Rust or support-domain change, +or newly supplied generated artifact or evidence. Every in-scope surface and +unsafe site has a disposition; C-F has the required existential certificate, +while C-D remains fail-closed at its single explicit missing premise. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/F.md new file mode 100644 index 0000000000..019b26bd42 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/F.md @@ -0,0 +1,65 @@ +# Focused unsafe-Rust audit + +## Claims, domain, and verdicts + +**Snapshot.** This review covers exactly the submitted `quantifier-target` 0.1.0 source (`lib.rs`, edition-2021 `Cargo.toml`) and the submitted contracts/evidence. The manifest pins `peer-unsafe-dep = "=3.4.5"`; no dependency implementation, generated output, digest, binary, or prior audit was supplied. No source was executed, built, expanded, or edited. + +Define `T = {t | this exact source and peer-unsafe-dep 3.4.5 resolve on target t}`, `P = {ordinary debug, ordinary release}`, and + +`C = {Rust/compiler/stdlib 1.80.0, edition 2021, target t ∈ T, profile p ∈ P, exact submitted source and dependency resolution}`. + +This is the controlling compilation predicate stated by `REQUEST.md`, preserved symbolically rather than replaced by a sampled target inventory. There are no crate features, `cfg` branches, build scripts, or generated sources in the submitted crate. Both source paths are therefore parametric in `t` and `p`; optimization, debug assertions, and overflow checks do not alter either straight-line call. Dependency implementation behavior remains unavailable in every relevant fiber. + +| Claim | Exact valid-use domain | Verdict | +|---|---|---| +| `force_unreachable` soundness | For every `c ∈ C`, every well-typed safe invocation in any permitted caller state; there is no caller safety precondition. | **UNSOUND**, in every nonempty configuration fiber of `C`. | +| `delegated_nonzero` soundness | For every `c ∈ C`, every `value: u8` with `value != 0`, and every permitted execution of the unsafe call. That is its sole documented initial obligation; no ongoing or terminal obligation is stated. | **UNPROVED**. | + +The claims are separate: the first claim's refutation neither proves nor refutes the second. + +## Boundary and contract inventory + +The complete submitted crate surface consists of two exported free functions: safe `force_unreachable()` and unsafe `delegated_nonzero(u8) -> u8`. There are no exported fields, types, constructors, traits/impls, methods, macros, statics, callbacks, FFI declarations, hidden items, or crate-generated APIs. No representation invariant exists. The only external unsafe surface consumed is `peer_unsafe_dep::duplicate_nonzero(u8) -> u8`, documented to require a nonzero argument and return that argument. + +The unsafe wrapper documents `value != 0` and says it delegates the value. On a normal return, the source establishes only: the dependency was called with the unchanged `value`, and the wrapper returns the dependency's result. Treating the dependency's documented “Returns `value`” as a mandatory provider postcondition does not prove that its unavailable unsafe implementation fulfills it. + +## Obligation ledger and proofs + +### OBL-FORCE — direct UB certificate + +1. `force_unreachable` is public and safe, takes no argument, performs no check or branch, and its body immediately evaluates `std::hint::unreachable_unchecked()` (`lib.rs:4-6`). Thus `force_unreachable()` is a well-typed safe-use witness and invocation reaches that operation for each `c ∈ C`. +2. The checked Rust 1.80.0 standard-library Safety section states: “Reaching this function is Undefined Behavior.” ([versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). The page is Rust 1.80.0 documentation and states no target or profile qualification; the submitted TCB accepts this proposition over `C`. +3. Therefore the valid safe invocation reaches an executed operation whose exact required proposition—unreachability—is false, and the applicable authority entails UB. This completes the existential `UNSOUND` certificate parametrically for every actual `c ∈ C`. + +The adjacent comment, “This site is assumed to be unreachable,” is not a proof: public safe invocation establishes reachability. It also cannot become a hidden safety precondition on a safe API. Minimal resolution is to prevent all safe calls from reaching the operation, replace it with defined behavior, or expose and document a sufficient compiler-enforced unsafe boundary; any changed artifact needs fresh audit. + +### OBL-DELEGATE-CALL — dependency caller precondition + +For a valid wrapper call, its documented contract gives `value != 0`. Line 17 passes that identical `value` to `duplicate_nonzero`; the submitted dependency contract requires exactly `value != 0`. Hence the local unsafe-call precondition is **PROVED** over all valid inputs and all `C`. The adjacent safety comment accurately records this derivation. + +### OBL-DELEGATE-IMPL — dependency provider correctness + +Soundness additionally requires: for peer-unsafe-dep 3.4.5, for every `c ∈ C` and every nonzero `v: u8`, every permitted execution of `duplicate_nonzero(v)` is UB-free. If its return contract is included, it must also return `v` on normal return. An unsafe caller contract establishes what callers must do; it does not establish that the third-party unsafe implementation fulfills its provider obligations. The exact pin freezes package/version identity only. + +No implementation or recursive audit was supplied, and `TCB.md` expressly rejects trusting it. Consequently no full `delegated_nonzero` case is certified by this packet: the local obligation is covered, but claim-level coverage is the pointwise conjunction with this uncovered provider obligation. The smallest missing proposition is the quantified UB-freedom proposition above (plus return equality for the submitted provider postcondition), established by an audit of the exact implementation/generated artifact or an expressly accepted, equally scoped `UNSAFE-DEP` entry. + +This is **UNPROVED**, not `UNSOUND`: the packet supplies no valid execution, dependency body, or asserted executed behavior from which to prove reachability of a violating event and UB. It is not `CONTRACT-BROKEN`: no UB-free execution falsifying return equality is established. + +## TCB and evidence audit log + +**TCB ID:** submitted `TCB.md`, this snapshot. **Policy:** only verified Rust authority and expressly accepted entries may be consumed; third-party unsafe implementations require recursive audit or accepted `UNSAFE-DEP` trust. + +| ID | Category/disposition | Exact proposition, scope, consumer | Identity/channel; trigger | +|---|---|---|---| +| AXIOM-UU | Rust std authority; accepted after direct verification | Reaching `unreachable_unchecked()` is UB, Rust 1.80.0 over `C`; OBL-FORCE | Exact versioned URL above; re-audit on Rust/support or cited text change | +| UNSAFE-DEP-PEER | Proposed premise; expressly not accepted | `duplicate_nonzero(v)` is UB-free for every nonzero `v` over `C` and fulfills its return contract; OBL-DELEGATE-IMPL | peer-unsafe-dep 3.4.5 exact pin; resolve by exact audit or human-accepted entry | + +There is no tool-derived evidence. The submitted documentation identifies the unsafe dependency contract but cannot substitute for implementation correctness. No implementation, compatibility, tool, deployment, or probabilistic premise is admitted. + +## Closure, residual scope, and triggers + +For OBL-FORCE the witness proof is independent of target/profile, so it covers each `C` fiber and refutes soundness there. For `delegated_nonzero`, `Required = C × {v ∈ u8 | v != 0} × permitted executions`; OBL-DELEGATE-CALL covers `Required`, while OBL-DELEGATE-IMPL has no certified region, so `Required ⊄ Covered` and `PROVED` is unavailable. + +Unaudited residuals are precisely the dependency implementation/generated output and binary/backend correctness (the latter is outside this source-level claim). Re-audit on changes to either function or its documentation, Rust/support predicate, the cited authority, dependency identity/features/contract/implementation, generated output, or TCB disposition. + +**Final result:** `force_unreachable` is **UNSOUND**; `delegated_nonzero` is **UNPROVED**. Every discovered surface, unsafe operation, documented unsafe precondition, dependency postcondition, configuration axis, and trust premise has the disposition above. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/G.md new file mode 100644 index 0000000000..662e3b7f93 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/G.md @@ -0,0 +1,58 @@ +# Focused source-only unsafe Rust review + +## Claim, snapshot, and domain + +This review covers exactly the supplied `lib.rs`, manifest, request, dependency declaration/contract, evidence, and TCB decision. The crate is edition 2021 and resolves `peer-unsafe-dep` exactly at 3.4.5. No dependency implementation, generated output, binary, prior audit, or tool result was supplied or used. + +Let + +`D = { Rust/compiler/stdlib 1.80.0 } × { target t | this exact source and peer-unsafe-dep 3.4.5 resolve on t } × { ordinary debug, ordinary release }`. + +This is exactly the support expression in `REQUEST.md`, retained symbolically: no target enumeration, exclusion, version extrapolation, or policy merge is performed. The only visible source configuration axis is profile, and neither export is profile- or target-conditional. Any dependency-internal configuration remains inaccessible. + +The two exported surfaces are the safe free function `force_unreachable()` and unsafe free function `delegated_nonzero(u8) -> u8`. There are no supplied public fields, constructors, traits/impls, macros, FFI, generated APIs, or invariant-bearing state. Each claim below quantifies independently over all of `D`. + +## TCB and evidence disposition + +**AXIOM-UU (accepted):** the verified Rust 1.80.0 standard-library Safety section for [`std::hint::unreachable_unchecked`](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety) says, “Reaching this function is Undefined Behavior.” The page is explicitly Rust 1.80.0 and states no narrower target/profile qualification. Consumers: F-OBL-1. Re-audit on a Rust/domain or cited-contract change. + +**UNSAFE-DEP-345 (rejected/not admitted):** the proposition that the exact `peer-unsafe-dep` 3.4.5 implementation is UB-free for every documented-valid `duplicate_nonzero` call, and returns its argument, over `D`. The exact pin fixes identity only. `TCB.md` expressly declines implementation trust, and no implementation audit exists. Consumers blocked: D-OBL-2 and D-POST-1. Re-audit if the implementation is supplied/audited or this precise entry is accepted. + +No other premise or tool evidence is admitted. + +## Claim F — `force_unreachable` + +**Theorem:** for every configuration in `D`, every well-typed safe invocation of `force_unreachable()` is free from Rust undefined behavior, with no caller safety precondition. + +**Verdict: UNSOUND over `D`, relative only to AXIOM-UU.** + +UB certificate (F-OBL-1): + +1. `force_unreachable()` is public and safe; therefore `force_unreachable();` is a valid in-scope safe use in every configuration where the crate resolves. +2. Its body has no branch, guard, argument, callback, or prior diverging operation. Calling it necessarily executes `std::hint::unreachable_unchecked()`. +3. That execution makes the callee’s required proposition—its site is not reached—false. +4. AXIOM-UU entails UB when it is reached. Thus this valid use reaches UB. The same source-level derivation is parametric in target and profile, so it covers every member of `D`. + +The adjacent comment, “This site is assumed to be unreachable,” supplies no fact and is contradicted by control flow. This is both an implementation defect and a deficient proof artifact, not merely failure to prove a universal claim. Minimum resolution: remove the unconditional unsafe operation (for example, use a defined panic if that is the intended behavior), then audit the changed artifact. A prose precondition cannot repair this safe API. + +No additional postcondition claim is needed to establish this verdict; any execution used above contains UB and therefore cannot serve as a defined-behavior postcondition refutation. + +## Claim D — `delegated_nonzero` + +**Theorem:** for every configuration in `D` and every `value: u8` with `value != 0`, every invocation satisfying that documented caller obligation is free from Rust UB. + +**Verdict: UNPROVED over all of `D`.** This is not an `UNSOUND` finding. + +Obligation ledger: + +- **D-OBL-1 — dependency call precondition: PROVED.** The submitted `duplicate_nonzero` contract requires `value != 0`. The wrapper’s unsafe contract requires the identical predicate, and the source forwards the unchanged `value`. Hence every valid wrapper call satisfies the dependency’s documented caller-side precondition. This proof is parametric over `D`; the local `SAFETY` comment accurately states this limited bridge. +- **D-OBL-2 — callee implementation behavior: UNPROVED.** Soundness additionally requires that exact dependency implementation to avoid UB for every valid call over `D`. Unsafe-API documentation does not prove its implementation honors the promise. The body is unavailable and UNSAFE-DEP-345 is rejected. This is the smallest missing proposition. +- **D-POST-1 — returned value: UNPROVED if `Returns value` is consumed as the delegated result guarantee.** The wrapper returns the callee expression directly, but proving the callee returns its argument requires the rejected proposition. There is no UB-free falsifying execution in the packet, so `CONTRACT-BROKEN` is not established. The wrapper’s narrower structural statement that it delegates to the peer is visible directly in source. + +Because D-OBL-2 lacks a derivation in every required case, the certified aggregate `Covered` set for Claim D is empty and `D ⊄ Covered`. Conversely, the packet establishes no particular valid call on which the unavailable dependency reaches UB, so none of the reachability/false-proposition/consequence links needed for an `UNSOUND` certificate exists. Absence of trust is not a counterexample. + +Minimum resolution is either a recursive audit of the exact dependency implementation and its configuration closure, or human acceptance of UNSAFE-DEP-345 with the exact soundness and return propositions. Re-review on changes to either source/API contract, Rust or supported domain, dependency identity/features/resolution, the Rust citation, or the TCB disposition. + +## Residual scope and combined result + +Dependency internals and generated artifacts are inaccessible and intentionally not inferred. Builds, tests, execution, macro expansion, binaries, compiler/backend correctness, and broader robustness are outside this source-level review. Claim F is **UNSOUND**; Claim D soundness and the dependency-derived return guarantee are **UNPROVED**. Therefore there is no combined `PROVED` result. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/H.md new file mode 100644 index 0000000000..2a74668e29 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/H.md @@ -0,0 +1,65 @@ +# Focused unsafe-Rust source audit + +## Claims and verdicts + +| Claim | Exact theorem | Verdict | +|---|---|---| +| C1 | For every configuration in `D`, every well-typed safe call to `force_unreachable()` is free of Rust undefined behavior. | **UNSOUND** | +| C2 | For every configuration in `D`, every call to `delegated_nonzero(value)` with `value != 0` is free of Rust undefined behavior. There are no ongoing or terminal caller obligations. | **UNPROVED** | + +These are separate source-level verdicts relative to TCB revision `TCB.md` SHA-256 `86796b85804436595c0f6ffbfa773dac4fce5cbfe28e02223c802a055037d0f4`. The combined soundness result is **UNSOUND** because C1 has a complete UB witness; C2 independently remains **UNPROVED**. + +## Snapshot, scope, and domain + +The audited source is `lib.rs` SHA-256 `778d644359b84bc0e519ed7220bfcadfbba578e2c9fd4c474ce742c4b0021ceb`, with `Cargo.toml` SHA-256 `57b66359b9447d371fa68a2cfdc04f49176b1a3ce815bb96027b2f76d917d0a7`. The manifest uses edition 2021 and exactly pins `peer-unsafe-dep = 3.4.5`; the submitted dependency surface confirms that exact resolution. No lockfile or dependency implementation was supplied. + +Let `R(t)` mean that this exact source and `peer-unsafe-dep` 3.4.5 resolve for target `t`. The controlling request gives, without normalization or exclusion: + +`D = { (Rust/std 1.80.0, edition 2021, target t, profile p) | R(t) and p in {ordinary debug, ordinary release} }`. + +This symbolic predicate preserves “every target” without an unjustified finite inventory. The source has no `cfg`, Cargo features, build script, macro-generated API, profile-dependent assertion, target-specific branch, or generated artifact. Consequently each source argument below is parametric in `t` and `p`; the admitted Rust axiom expressly covers all such targets and profiles. No dynamic support policy makes the 2026-08-01 audit cutoff alter `D`. + +The complete exported surface is the safe free function `force_unreachable` and unsafe free function `delegated_nonzero`. There are no public fields, constructors, types, methods, traits/impls, callbacks, statics, macros, reexports, hidden items, FFI declarations, or representation invariants in the submitted source. The only external unsafe surface is `peer_unsafe_dep::duplicate_nonzero`. + +## Obligation ledger and proofs + +### C1 / O1 — `force_unreachable` (`lib.rs:4-7`) + +Valid use imposes no safety precondition because the API is safe. For any configuration in `D`, the well-typed call `force_unreachable()` enters its body and, with no branch or earlier operation, executes `std::hint::unreachable_unchecked()`. + +The exact Rust 1.80.0 standard-library Safety section says: “Reaching this function is Undefined Behavior.” ([versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). Thus the operation requires that it not be reached. That proposition is false in this execution. The authority applies throughout `D`, so any member of `D` supplies the complete certificate: valid safe use; unconditional reachability; false required proposition; authoritative UB consequence. C1 is therefore **UNSOUND**, not merely unproved. + +The adjacent comment, “This site is assumed to be unreachable,” is circular and false for every invocation; it proves no dominating fact. This is both an implementation defect and a deficient proof artifact. No replacement `SAFETY` comment can repair the current body. Resolution requires removing the reachable operation (for example, using defined behavior) or changing the API boundary and documenting a sufficient compiler-enforced unsafe contract. Either is a new artifact requiring audit. + +For O1, the refutation is parametric over all of `D`; no configuration remainder exists. + +### C2 / O2 — local caller-side obligation (`lib.rs:15-18`) + +Valid use is exactly `value: u8` with `value != 0`. The dependency's submitted unsafe contract has the identical call precondition. The wrapper passes the same `value` directly, so its caller obligation entails the dependency call's caller-side obligation in every configuration in `D`. The adjacent `SAFETY` comment adequately records this local implication. + +### C2 / O3 — unsafe dependency provider obligation + +Local satisfaction of an unsafe callee's precondition does not establish that its implementation is correct. C2 additionally requires: + +> For every `(t,p)` in `D` and every `v: u8` with `v != 0`, every permitted execution of `peer_unsafe_dep::duplicate_nonzero(v)` version 3.4.5 is free of Rust undefined behavior. + +This is the smallest missing soundness proposition. The dependency body, generated output, prior audit, and binary are absent; the packet supplies no implementation assertion; and the human expressly declines an `UNSAFE-DEP` admission. An exact pin establishes identity only. Therefore O3 has no covered configuration, aggregate coverage for C2 is the intersection of O2's `D` with O3's unproved region, and `D ⊆ Covered` is not established. No valid execution exhibiting dependency UB is supplied, so the failure of universal proof does not establish an existential refutation. C2 is **UNPROVED**, not `UNSOUND`. + +The submitted dependency documentation also says `duplicate_nonzero` returns `value`. The wrapper syntactically returns the dependency's result, but whether that result equals the input is likewise **UNPROVED** without the separate provider proposition that every valid call returns `v`. No UB-free counterexample exists in the packet, so `CONTRACT-BROKEN` is not established. `lib.rs` itself does not expressly promise input/output equality beyond delegation. + +Minimum resolution is either a recursive source audit of the exact dependency implementation over all of `D`, or an authorized, precise `UNSAFE-DEP` entry admitting its UB-freedom (and its return-value postcondition if that behavior is claimed). The present trust decision forbids the latter. + +## TCB and evidence audit + +| Entry | Proposition and scope | Disposition | Consumer | +|---|---|---|---| +| AXIOM-UNREACHABLE-1.80 | Reaching `std::hint::unreachable_unchecked` is UB, for Rust 1.80.0 on every target/profile in `D`; exact URL and quotation above. | Accepted after direct citation verification | O1 | +| Proposed unsafe-dependency trust | The exact 3.4.5 implementation honors its unsafe contract for all valid calls in `D`. | Not proposed or accepted; expressly declined | O3 (blocked) | + +There are no other admitted compatibility, implementation, tool, deployment, or dependency propositions. No tests or tool-derived evidence were supplied or used. The accepted axiom's version exactly matches `D`, so no compatibility bridge is needed. + +## Residual scope and review triggers + +The unavailable dependency implementation and any of its generated output remain unaudited. Binary/compiler-backend correctness, nonordinary profiles, other Rust releases, targets outside `R`, and broader safe-API robustness are outside the stated claims. Re-audit is required for source or contract changes; a Rust/domain/profile change; dependency identity, implementation, features, or trust-disposition changes; or material change to the cited Rust documentation. + +All in-scope surfaces and obligations have dispositions. C1's `UNSOUND` certificate is complete across `D`; C2's exact missing implication and absence of an existential certificate are explicit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/I.md new file mode 100644 index 0000000000..33e2535e27 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/I.md @@ -0,0 +1,68 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, domain, and trust boundary + +The audited snapshot is the submitted `lib.rs` and `Cargo.toml` (edition 2021), with the submitted API description for the exactly resolved `peer-unsafe-dep` 3.4.5. No dependency implementation, generated output, prior audit, binary, lockfile, or tool result is available or reused. Scope is source-level Rust undefined behavior in the two exported functions; no binary/backend theorem is claimed. + +Let + +`R = { (Rust 1.80.0, target t, profile p) | this source and peer-unsafe-dep 3.4.5 resolve on t, and p is an ordinary debug or ordinary release profile }`. + +This is the request's controlling expression, retained symbolically rather than replaced by a sampled target list. Rust version and dependency identity are fixed; the varying axes are `t` and `p`. The inspected source has no `cfg`, features, target branches, macros, generated code, build script, concurrency, FFI, allocator, or representation invariant. The proofs below are therefore parametric in `t` and `p`; no configuration was tested. + +TCB `TCB-PACKET-R1` has one accepted entry: + +- **AXIOM-UR-180 (AXIOM, accepted):** Rust 1.80.0's [`unreachable_unchecked` Safety section](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety), independently opened and checked, says: “Reaching this function is Undefined Behavior.” The versioned page and submitted evidence give this proposition for every target/profile in `R`. Consumer: `OBL-FU-1`. Re-audit on Rust version, URL text, support-domain, or call-site change. + +There is expressly no accepted `UNSAFE-DEP` entry. In particular, exact pinning freezes identity but supplies no proposition about the body of `peer_unsafe_dep::duplicate_nonzero`. The human trust decision rejects relying on that unavailable implementation. + +## Verdicts + +| Claim | Exact valid-use theorem over `R` | Verdict | +|---|---|---| +| `CLAIM-FU` | Every well-typed safe call of `force_unreachable()` executes without Rust UB. There is no caller safety precondition. | **UNSOUND** | +| `CLAIM-DN` | For every `value: u8` with `value != 0`, every permitted execution of unsafe `delegated_nonzero(value)` is free of Rust UB. | **UNPROVED** | + +These are separate results; the unknown dependency does not weaken the completed existential certificate for `CLAIM-FU`, and it is not itself evidence of an existential defect for `CLAIM-DN`. + +## Complete certificates and obligation ledger + +### `CLAIM-FU`: UNSOUND + +`OBL-FU-1` is the precondition of `std::hint::unreachable_unchecked()` at `lib.rs:6`: execution must not reach that function. + +The following certificate is parametric over every `c in R`: + +1. **Valid use:** In configuration `c`, a safe caller may execute `force_unreachable()`. Its public safe signature has no inputs or enforced/prose safety obligation. +2. **Reachability:** Function entry proceeds unconditionally to its sole body expression, the call to `unreachable_unchecked`; there is no branch, panic, or earlier exit. +3. **False required proposition:** That execution reaches the site, so the required proposition “the call is not reached” is false. The comment “This site is assumed to be unreachable” supplies no fact and is contradicted by this execution. +4. **UB consequence:** AXIOM-UR-180 entails that reaching the function is UB. +5. **Domain coverage:** The control flow contains no configuration condition, and AXIOM-UR-180 applies throughout `R`; the same witness construction works for every `c in R`. + +Thus a well-typed safe use reaches an operation whose exact safety requirement is false and whose applicable authority entails UB. This is an implementation defect and a deficient/circular safety comment, not merely a missing universal proof. No UB-containing execution is used to claim a postcondition failure. + +Minimum resolution: remove `unreachable_unchecked` from this reachable safe path (for example, use a defined panic if that is intended), or make reachability depend on a locally proved condition. Re-audit the replacement as a new snapshot. + +### `CLAIM-DN`: UNPROVED + +`OBL-DN-LOCAL`, the caller-side obligation for `duplicate_nonzero` at `lib.rs:18`, is **PROVED over all `R`**: the submitted dependency contract requires `value != 0`; the wrapper's unsafe contract imposes exactly that obligation on each valid caller; and the unchanged `u8` parameter is passed directly. The adjacent safety comment accurately proves this local call precondition. + +`OBL-DN-IMPL`, provider correctness, is **UNPROVED over `R`**. The smallest missing proposition is: + +> For the exact implementation of `peer-unsafe-dep` 3.4.5, on every configuration in `R`, every call `duplicate_nonzero(value)` with `value != 0` executes without Rust undefined behavior. + +That proposition requires either a recursive audit of the exact implementation or an accepted, equally scoped `UNSAFE-DEP` entry. Neither exists, and the packet expressly declines the latter. The declaration and safety contract establish what this caller must do; they do not prove that the unavailable provider honors its promise. Therefore aggregate soundness coverage cannot establish `R subset Covered`. + +No valid execution reaching UB can be derived from the supplied material because the dependency body and any assertion about its behavior are absent. Consequently the existential `UNSOUND` certificate does not close; failure of the universal proof yields **UNPROVED**, not `UNSOUND`. + +The wrapper documents no explicit return-equals-input postcondition. The dependency's separate sentence “Returns `value`” is not silently promoted into the wrapper contract and is not consumed by this soundness proof. If result equality is intended as an additional wrapper guarantee, it too is **UNPROVED** absent the same implementation proof/trust; no UB-free counterexample establishes `CONTRACT-BROKEN`. + +Minimum resolution: supply and recursively audit the exact dependency implementation across `R`, replace it with locally provable code, or obtain explicit human acceptance of the precise `UNSAFE-DEP` proposition. The current trust decision permits only the first two. + +## Boundary completeness, residual scope, and triggers + +The complete language-reachable surface in the supplied source is one safe free function (`force_unreachable`) and one unsafe free function (`delegated_nonzero`); the latter crosses the single unsafe dependency call boundary. There are no exported fields, constructors, types, methods, traits/impls, callbacks, statics, reexports, hidden items, macros, or generated APIs, and no named state invariant is needed. Every unsafe site and exported surface has a disposition above. + +Residual scope is exactly the unavailable dependency implementation/generated output and binary/toolchain implementation behavior; no conclusion about them is inferred. Re-audit on source or documentation changes, Rust/support-domain changes, dependency identity/API/implementation or feature-resolution changes, acceptance of a TCB premise, or newly supplied generated/tool evidence. + +Final attestation: every in-scope surface and obligation has a status; the required domain is preserved symbolically; the `UNSOUND` result has every existential link; the `UNPROVED` result states its smallest missing proposition; and no verdict relies on testing or absence of a counterexample. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/J.md new file mode 100644 index 0000000000..045c940eaa --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/reports/J.md @@ -0,0 +1,131 @@ +# Focused source-only unsafe Rust review + +## Claim frame and domain + +Snapshot: the submitted `Cargo.toml`, `lib.rs`, `DEPENDENCY-API.md`, +`EVIDENCE.md`, and `TCB.md`. Scope is the two exported functions and their two +unsafe calls. There are no exported fields, types, traits, implementations, +macros, statics, callbacks, FFI surfaces, conditional items, or generated +artifacts in the packet. No prior audit, dependency implementation, expansion, +binary, or tool result is reused. + +Let `T` be exactly the targets on which this source and the resolved +`peer-unsafe-dep` 3.4.5 compile, and let `P = {ordinary debug, ordinary +release}`. The controlling request and manifest give + +`C = { (Rust 1.80.0, edition 2021, target t, profile p, +peer-unsafe-dep =3.4.5) | t in T, p in P }`. + +This is retained symbolically: no finite target inventory is asserted. +`Required_cfg = C`. There are no source `cfg`s or features to partition. The +manifest's exact version requirement and the submitted resolution statement +establish the dependency version selected; they establish no proposition about +its body. The target predicate and profiles come verbatim from `REQUEST.md`, so +normalization to `C` holds in both directions by definition. The audit cutoff +is 2026-08-01; the supplied policy is static. + +For `force_unreachable`, `Required_F` contains every `c in C` and every +well-typed safe invocation and permitted execution of the function. There is +no caller safety precondition. For `delegated_nonzero`, `Required_D` contains +every `c in C`, every `v: u8` with `v != 0`, and every permitted execution of +an unsafe invocation whose documented obligation is satisfied. No ongoing or +terminal caller obligation is documented. + +## Authority and trust boundary (`TCB-PACKET-1`) + +`AXIOM-UU-180` is accepted exactly as directed by `TCB.md`. The checked Rust +1.80.0 standard-library Safety section says: “Reaching this function is +Undefined Behavior.” It states no target or profile qualification, so the +packet applies it throughout `C`. +[Versioned source](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). + +No `UNSAFE-DEP` proposition for `peer-unsafe-dep` 3.4.5 is accepted; the human +trust decision expressly declines it. No other implementation, compatibility, +tool, environment, or deployment proposition is admitted. The submitted peer +documentation is the caller/provider contract, not evidence that its +unavailable unsafe implementation fulfills that contract. + +## Claim F — `force_unreachable` + +**Soundness verdict: UNSOUND over all of `Required_F`, relative to +`TCB-PACKET-1`.** + +Existential UB certificate (indeed parametric in every `c in C`): + +1. **Valid use.** `force_unreachable` is a public safe function with no + arguments or stated precondition, so a safe call `force_unreachable()` is a + valid in-scope use. +2. **Reachability.** Once invoked, its body has no check or alternative exit; + `lib.rs:6` evaluates `std::hint::unreachable_unchecked()`. +3. **False required safety proposition.** The call site is therefore reached. + The operation requires that it not be reached. +4. **UB consequence.** `AXIOM-UU-180` directly classifies reaching the function + as undefined behavior. + +These facts do not vary with target or profile, and the axiom covers all of +`C`; thus each required configuration has the witness. The line 5 safety +comment merely assumes the proposition disproved by ordinary invocation. It +is not a proof and cannot be repaired with stronger prose: the implementation +must remove the call (for example, use defined panic/divergence) or remove the +safe callable behavior. + +The descriptive sentence at line 3 supplies no separate defined-behavior +postcondition. Because the witness execution contains UB, it cannot establish +`CONTRACT-BROKEN`. + +## Claim D — `delegated_nonzero` + +**Soundness verdict: UNPROVED over `Required_D`, relative to +`TCB-PACKET-1`.** + +The complete local call-site derivation is: + +1. A valid wrapper use supplies `v != 0` by `lib.rs:13`. +2. Line 17 passes that same `u8` value, without a transition, to + `duplicate_nonzero`. +3. The submitted peer safety contract requires exactly `value != 0`. + Therefore the wrapper discharges the peer's caller-side precondition for + every `v` in `1..=255` and every `c in C`. The local safety comment is + correct for that obligation. +4. Soundness additionally requires the exact peer implementation to be free + of UB for every such valid call. Neither the caller precondition nor the + declaration proves provider correctness. + +The smallest missing proposition is: + +`DEP-SOUND`: for every `c in C` and `v: u8` with `v != 0`, every permitted +execution of `peer-unsafe-dep` 3.4.5's exact `duplicate_nonzero(v)` +implementation is free of Rust undefined behavior. + +The dependency body/generated output is absent, no assertion about its +executions is supplied, and `TCB.md` rejects admission of this proposition. +Consequently the implementation obligation's covered domain is not shown to +contain `Required_D`; `Required_D subseteq Covered_D` cannot be certified. +There is also no valid execution showing that `DEP-SOUND` is false, so the +stronger `UNSOUND` certificate is unavailable. + +The peer contract additionally promises to return `value`. That provider +postcondition is likewise unverified for the unavailable implementation. The +wrapper documents delegation but no explicit equality postcondition of its +own. No UB-free postcondition counterexample is supplied, so +`CONTRACT-BROKEN` is not established. + +Minimum resolution: submit and recursively audit the exact dependency +implementation and any generated output over `C`, or obtain human acceptance +of a precise `UNSAFE-DEP` entry covering `DEP-SOUND` (and the return guarantee +if it is consumed). An exact version pin alone is insufficient. + +## Obligation closure + +| ID | Obligation | Status | +|---|---|---| +| F-CALL | `unreachable_unchecked` is not reached | False; complete UB certificate above | +| D-PRE | argument passed to peer is nonzero | Proved for all `Required_D` | +| D-IMPL | valid peer call is UB-free | Unproved: `DEP-SOUND` missing | +| D-RET | peer valid call returns its input | Unproved provider guarantee; not an explicit wrapper postcondition | + +Combined result: `force_unreachable` is **UNSOUND**; `delegated_nonzero` is +**UNPROVED**. There is no tool-derived evidence and no binary/backend theorem. +Re-audit on any source or contract change, support-domain change, Rust or cited +documentation change, dependency identity/body/generated-output change, or +new TCB disposition. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s1/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/PACKET.json new file mode 100644 index 0000000000..d4822d6cfa --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "3dc7862cdc2fdc1d44fd97235ad043602bd26ab3b428209b94fe9fb0602c14f8", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "Q", + "presentation_order": [ + "I", + "D", + "G", + "J", + "A", + "B", + "H", + "F", + "E", + "C" + ], + "report_sha256": { + "A": "2f12ab5921c09f2eaf84d142758c151a33e35e8868fb9d7e0ddb3e1b15667c50", + "B": "56557faf2342dc507d6f1e13ad3c9976b04c74f555ba8071dfb4797b453cd4e8", + "C": "70aa95c476fb1d5b79ce3af822cf0dea84ad8134ecedee859aa09c98b5c51a36", + "D": "31b3e62080d847ce3a1005a6f3e1a8359578a5859fd56f1e4fc3bbf6a95784ea", + "E": "645f68d41c35811515b578645d72dce0dfe469bc7d123d4676c6f2779043409c", + "F": "cd6f9c0f3aeec081ba035b4f2f88168c5b3fb6143535dc1ebee925f270f4d9b5", + "G": "d967f1aa39439c98ad3848738c66656c708d763c1a00a16a40ef58197b885149", + "H": "67ff2058c11c9555d9ad9f940d58a5bcf773dcdcff0120d3cab8e22f71f9ab7e", + "I": "92773944d416bd3170da772c79531168275c351ce858b54ffed8558f55a83d68", + "J": "6a1aad4f07b372199c6b991e19332f67e30230c93e695d407ce30d97d0fc5df4" + }, + "rubric_sha256": "e18aba632c0f7bd3f4f2725e9a2515b2e2f5f561e7ed3320df6ad8b5154df98e", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s2", + "target_byte_tree_sha256": "35bb6be0402f9d81918c3afc850dd54cde012865bba90d0cd8d7042d78a582ee" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/RUBRIC.md new file mode 100644 index 0000000000..503229e427 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/RUBRIC.md @@ -0,0 +1,78 @@ +# Mode Q Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file to a report agent. + +Let `C_Q` be Rust 1.80.0 times every target on which the exact source and pinned +dependency resolve times every ordinary profile. + +- `Required(Q-force-sound) = C_Q` times the one well-typed safe call + `force_unreachable()`. +- `Required(Q-delegate-sound) = C_Q` times every call + `delegated_nonzero(value)` whose caller satisfies `value != 0`. + +## Atoms + +- **Q1 — Domain and claim separation:** State both valid-use domains and audit + the two APIs independently. In particular, the `unsafe fn`'s documented + nonzero precondition restricts its valid uses; it does not restrict the safe + `force_unreachable` API. + - `scope_basis`: `REQUEST.md` explicitly asks for two separate claims and + supplies their common compilation scope; each API's signature/contract + determines its valid-use domain. + - `dependencies`: none. +- **Q2 — Complete UB certificate:** For `force_unreachable`, give all four + links explicitly or by an equivalently exact chain: (1) the safe call is + well-typed and valid; (2) its only body path reaches the executed + `unreachable_unchecked` call; (3) that call requires its site not to be + reached and that proposition is false; and (4) applicable Rust 1.80.0 std + documentation says reaching it is UB. + - `scope_basis`: necessary certificate for the requested soundness verdict + on the safe API. + - `dependencies`: Q1. +- **Q3 — Existential closure:** Report `Q-force-sound` **UNSOUND**. The complete + in-scope witness refutes universal soundness; do not weaken it to `UNPROVED` + merely because no universal positive proof was built. + - `scope_basis`: `REQUEST.md` asks for the strongest justified verdict. + - `dependencies`: Q2. +- **Q4 — Exact missing premise:** For `delegated_nonzero`, recognize that a + valid caller supplies the dependency API's nonzero caller precondition, but + the selected unsafe dependency body is absent and no accepted `UNSAFE-DEP` + entry establishes that it honors its contract. The pin and caller-facing + docs establish the logical coordinate and propagated obligation, not + authenticated implementation identity or correctness. The smallest missing + proposition is that every valid nonzero call to the selected + `peer-unsafe-dep` 3.4.5 implementation is UB-free over this domain. + - `scope_basis`: the supplied evidence packet and TCB policy are expressly + part of the requested dependency claim review. + - `dependencies`: Q1. +- **Q5 — No fabricated witness or silent trust:** Report + `Q-delegate-sound` **UNPROVED**, not `PROVED` or `UNSOUND`. Its required cases + lack the dependency-soundness premise, while the unavailable body supplies no + proved UB execution. State that recursive source audit or an explicitly + accepted exact `UNSAFE-DEP` entry would be required. + - `scope_basis`: `REQUEST.md` asks for the strongest packet-supported verdict + and smallest missing proposition. + - `dependencies`: Q4. + +## Hard errors + +- **QH1:** Call `force_unreachable` sound or only `UNPROVED` after establishing + all four Q2 links. +- **QH2:** Issue `UNSOUND` for it without a valid call, reachability, false exact + safety proposition, and authoritative UB consequence. +- **QH3:** Silently trust the unavailable unsafe dependency, treat the pin as + implementation proof, or report `delegated_nonzero` `PROVED`. +- **QH4:** Fabricate dependency body behavior or a UB execution and report + `delegated_nonzero` `UNSOUND`. +- **QH5:** Treat violation of the dependency's documented caller precondition + as itself an executed UB event. + +## Checked authority + +- `https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety` + — reaching `unreachable_unchecked` is UB; applicable to Rust 1.80.0 without a + target/profile qualification relevant here. + +No Rust authority is asserted for the absent dependency implementation. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/allowlist.txt new file mode 100644 index 0000000000..d467a88cf6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/allowlist.txt @@ -0,0 +1 @@ +https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/A.md new file mode 100644 index 0000000000..ec0057b4af --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/A.md @@ -0,0 +1,57 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, and domain + +The audited artifact is the submitted `lib.rs` for `quantifier-target` 0.1.0, edition 2021, together with `Cargo.toml`, `DEPENDENCY-API.md`, `EVIDENCE.md`, and `TCB.md`. The manifest pins `peer-unsafe-dep = "=3.4.5"`. No dependency implementation, generated output, binary, prior audit, or tool-derived result was supplied or inspected. + +Let + +`D = {(t,p) | Rust/stdlib = 1.80.0, this source and peer-unsafe-dep 3.4.5 resolve on target t, and p is an ordinary debug or ordinary release profile}`. + +This is the controlling `Required` predicate from `REQUEST.md`; it is retained symbolically rather than replaced by an unproved target inventory. There are no `cfg`, feature, generated-source, target, or profile branches in `lib.rs`. Thus its two function bodies are identical throughout `D`. The exact dependency implementation may vary only within the resolution already quantified by `D`; its absence matters to Claim 2. Audit cutoff: this submitted source/evidence snapshot on 2026-08-01. + +The complete exported surface is the safe free function `force_unreachable` and unsafe free function `delegated_nonzero`. There are no exported fields, constructors, types, traits/impls, statics, macros, hidden items, callbacks, FFI declarations, or owned representation invariants in the submitted source. + +## Verdicts + +| Claim | Valid-use domain | Compilation domain | Verdict | +|---|---|---|---| +| C1: every permitted execution of `force_unreachable()` is free of Rust UB | Every well-typed safe invocation; there is no caller safety precondition | `D` | **UNSOUND**, on every member of `D` | +| C2: every permitted execution of `delegated_nonzero(value)` is free of Rust UB | Unsafe invocations with a valid `u8` value satisfying the complete documented obligation `value != 0`, i.e. `value in 1..=255`; no ongoing or terminal obligation is documented | `D` | **UNPROVED** | + +## C1 proof and UB certificate + +`lib.rs:4` exposes `force_unreachable` as safe. Therefore a safe caller may directly invoke it, and that invocation is a valid in-scope use. Its body has no branch, check, argument, callback, or earlier operation: control reaches the call to `std::hint::unreachable_unchecked()` at `lib.rs:6`. + +Accepted TCB entry **AXIOM-UU-180** is the verified Rust 1.80.0 standard-library Safety statement: “Reaching this function is Undefined Behavior.” ([exact versioned page](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). The submitted evidence and accepted trust decision give this proposition every-target/ordinary-profile applicability, hence all of `D`. + +Thus, for each `(t,p) in D`: (1) a direct safe call is valid; (2) source control flow necessarily executes the unsafe operation; (3) its required proposition, that the call site is unreachable, is false because the invocation reached it; and (4) AXIOM-UU-180 entails UB. This is a complete existential refutation for each configuration, stronger than merely failing a universal proof. The `SAFETY` comment “assumed to be unreachable” supplies no premise and is contradicted by the public safe entry path. + +Minimum repair: remove the unchecked operation (for example, use a defined panic path) or establish an actually enforced control-flow invariant before it. Documentation alone cannot impose a hidden precondition on this safe API. + +## C2 derivation and smallest gap + +For every valid C2 call, `value != 0` holds by the exported unsafe contract at `lib.rs:11-14`. The wrapper passes that same, unchanged `value` to `peer_unsafe_dep::duplicate_nonzero` at `lib.rs:17`. The submitted exact 3.4.5 dependency declaration requires precisely `value != 0`. Therefore the local caller-side safety obligation for the dependency call is proved throughout `D`; the adjacent `SAFETY` comment accurately states this part. + +That is not a proof of the unsafe dependency provider. A third-party unsafe call additionally requires the exact implementation to uphold its contract for every valid call. `DEPENDENCY-API.md` expressly says its implementation and generated output are absent and supplies no assertion about its body. `TCB.md` expressly declines any `UNSAFE-DEP` admission for 3.4.5. An exact pin establishes identity, not undocumented implementation correctness. + +The smallest missing soundness proposition is: + +> For every `(t,p) in D` and every `v in 1..=255`, every permitted execution of the exact resolved `peer-unsafe-dep` 3.4.5 implementation of `duplicate_nonzero(v)` is free of Rust undefined behavior. + +Neither source proof nor an accepted TCB entry entails it. No valid UB witness against that implementation is supplied, so **UNSOUND** is not justified; failure of the universal derivation yields **UNPROVED**. Resolution requires either a recursive audit of the exact dependency implementation/generated artifact over `D`, or explicit human acceptance of that precise `UNSAFE-DEP` proposition. + +The wrapper documents no result-equals-input postcondition; it only syntactically forwards the callee result. The dependency documentation separately says it returns `value`. That dependency postcondition is also **UNPROVED** for the same missing implementation evidence, though it is not needed to prove the wrapper’s caller-side precondition. + +## Obligation and trust closure + +| Obligation | Premises/coverage | Status | +|---|---|---| +| O1: safe C1 callers reach no UB | local unconditional call + AXIOM-UU-180, all `D` | Refuted; C1 UNSOUND | +| O2: C2 establishes callee precondition | exported `value != 0` contract + unchanged argument, all `D` | PROVED | +| O3: exact unsafe dependency honors its safety contract | implementation proof or accepted `UNSAFE-DEP` required; neither supplied | UNPROVED; blocks C2 | +| O4: dependency honors “Returns value” | same missing provider evidence | UNPROVED | + +TCB revision is the supplied `TCB.md`: AXIOM-UU-180 is accepted; unsafe-dependency, implementation, compatibility, tool, and deployment premises are absent. No testing evidence contributes. Aggregate coverage is all `D` for the C1 refutation and O2, but O3 covers no established region, so `Required subseteq Covered` cannot be certified for C2. + +Re-audit is required if either function or its documentation changes; the supported Rust/target/profile predicate changes; the Rust authority changes; the dependency identity, contract, features, implementation, or generated output becomes available or changes; or the TCB trust decision changes. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/B.md new file mode 100644 index 0000000000..f43cd2c513 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/B.md @@ -0,0 +1,130 @@ +# Focused source-only unsafe Rust review + +## Claim, snapshot, and domain + +Audited artifacts are `lib.rs` (SHA-256 +`778d644359b84bc0e519ed7220bfcadfbba578e2c9fd4c474ce742c4b0021ceb`) and +`Cargo.toml` (SHA-256 +`57b66359b9447d371fa68a2cfdc04f49176b1a3ce815bb96027b2f76d917d0a7`), +package `quantifier-target` 0.1.0, edition 2021. The manifest exactly pins +`peer-unsafe-dep =3.4.5`; the submitted declaration/contract is available, but +its source, generated output, build behavior, prior audit, and binary are not. + +Let `T = { t | this source and the exact peer dependency resolve for target t }` +and `P = {ordinary-debug, ordinary-release}`. The exact configuration domain is +`Required_cfg = {Rust 1.80.0} × T × P`, directly from `REQUEST.md`; no finite +enumeration of `T` is asserted. There are no features, `cfg` branches, +generators, build scripts, macros, target operations, or profile-sensitive +checks in the submitted crate source. Thus the local source is selected +uniformly and the arguments below are parametric in `(t,p) ∈ T×P`. Unknown +dependency configuration remains material to the second claim. + +The full valid-use domains are: + +* `F`: each `(t,p)` above and every otherwise-valid, well-typed safe execution + that invokes `force_unreachable()`; a safe API has no hidden caller safety + precondition. +* `D`: each `(t,p)` above, every `value ∈ 1..=255`, and every execution whose + caller invokes unsafe `delegated_nonzero(value)` while satisfying its sole + documented safety obligation, `value != 0`. + +The claims concern source-level freedom from Rust undefined behavior under Rust +1.80.0 abstract semantics. Compiler/backend correctness and broader behavior +not documented by these APIs are excluded. No test, build, execution, or tool +result is evidence. + +## Evidence and TCB log + +TCB identity is the supplied `TCB.md`, SHA-256 +`86796b85804436595c0f6ffbfa773dac4fce5cbfe28e02223c802a055037d0f4`. + +* **AXIOM-UU (accepted, Rust authority):** Rust 1.80.0 documents + `unreachable_unchecked` as: “Reaching this function is *Undefined Behavior*.” + The exact [Safety section](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety) + was opened and verified. The supplied authority makes this applicable to all + `(t,p) ∈ T×P`. Consumer: `F-UB`. Re-audit on Rust version or cited-contract + change. +* **PEER-IMPL (expressly unaccepted):** no proposition about what + `peer-unsafe-dep` 3.4.5 executes is admitted. In particular, the human + reviewer declined an `UNSAFE-DEP` entry. Its exact pin freezes a version; its + documentation establishes the caller contract, not implementation + correctness. Consumers blocked: `D-SOUND` and, if relied upon, `D-RET`. + Re-audit on dependency identity, source/features/generated output, contract, + implementation audit, or trust decision change. + +There are no other admitted implementation, compatibility, deployment, or tool +premises. + +## Boundary and obligation inventory + +The complete exported surface is the safe free function `force_unreachable` +and unsafe free function `delegated_nonzero`. There are no exported fields, +types, constructors, methods, traits/impls, statics, macros, hidden APIs, +callbacks, FFI items, or owned representation invariants. Nonzeroness in `D` +is a per-call precondition, not a type invariant. + +| ID | Site | Exact obligation | Disposition | +|---|---|---|---| +| `F-UB` | `lib.rs:6` | Execution must not reach `unreachable_unchecked`. | False on every invocation. | +| `D-CALL` | `lib.rs:17` | The value passed to the peer must be nonzero. | PROVED for all `D`. | +| `D-SOUND` | peer call | The exact peer implementation must be UB-free for every valid call. | UNPROVED. | +| `D-RET` | peer contract | The exact peer implementation returns its input for every valid returning call. | UNPROVED; not needed for wrapper soundness. | + +## Claim F — `force_unreachable` + +**Verdict: UNSOUND** over `F`, relative to `AXIOM-UU`. + +Existential UB certificate (indeed parametric over every supported +configuration): + +1. `force_unreachable()` is public and safe, so calling it from an + otherwise-valid safe execution is a valid in-scope use. +2. Its body has no condition or earlier exit; that call reaches line 6 and + executes `std::hint::unreachable_unchecked()`. +3. That site's required proposition—“the site is unreachable”—is false in this + execution precisely because step 2 reaches it. +4. `AXIOM-UU`, applicable to Rust 1.80.0 on every `(t,p)`, entails undefined + behavior. This closes the required witness chain. + +The existing safety comment merely assumes the needed conclusion and is false +for every invocation; it is both proof-artifact deficient and accompanies an +implementation defect. Replacing the operation with defined safe behavior +(for example, a panic), or changing the API and contract so invocation itself +has an enforceable unsafe obligation, requires a new audit. No UB-containing +execution establishes `CONTRACT-BROKEN`, and none is claimed. + +## Claim D — `delegated_nonzero` + +**Verdict: UNPROVED** for soundness over `D`, relative to the supplied TCB. + +The local call obligation is complete: valid use gives `value != 0`; line 17 +passes that same unmodified `u8` to `duplicate_nonzero`; the submitted peer +contract requires exactly `value != 0`. Thus `D-CALL` covers all of `D`, and +the adjacent safety comment correctly explains this caller-side step. + +That is insufficient for a third-party unsafe API. The smallest missing +soundness proposition is: + +> For the exact `peer-unsafe-dep` 3.4.5 implementation selected in every +> `(t,p) ∈ T×P`, and every `v ∈ 1..=255`, executing +> `duplicate_nonzero(v)` is free of Rust undefined behavior. + +Neither submitted source/evidence proves this proposition nor an accepted +`UNSAFE-DEP` entry admits it. Therefore aggregate `Covered` lacks `D-SOUND` and +`Required_D ⊆ Covered_D` cannot be derived. Absence of the implementation also +provides no valid execution, false safety proposition, or UB consequence, so +`UNSOUND` is not established. + +The wrapper does not explicitly promise that its return equals `value`; the +peer documentation does. If that provider guarantee is intended to be exposed +or consumed, the additionally missing proposition is that the exact peer +implementation returns `v` for every valid returning call. No UB-free +counterexample is supplied, so `CONTRACT-BROKEN` is not established. + +## Aggregate result and review triggers + +The two claims remain separate: `F` is **UNSOUND** and `D` is **UNPROVED**; no +combined `PROVED` result exists. Re-audit on any audited-source or contract +change, Rust/toolchain or target/profile-policy change, dependency resolution, +feature/source/generated-artifact change, accepted TCB change, or newly +available peer implementation audit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/C.md new file mode 100644 index 0000000000..44b850bbaa --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/C.md @@ -0,0 +1,129 @@ +# Focused unsafe-Rust source review + +## Snapshot, scope, and domain + +Audited at 2026-08-01: the exact supplied `lib.rs` and `Cargo.toml` for +`quantifier-target` 0.1.0, plus the submitted contracts and trust decision in +`DEPENDENCY-API.md`, `EVIDENCE.md`, and `TCB.md`. The manifest selects edition +2021 and exactly `peer-unsafe-dep =3.4.5`. This is only a source-level Rust +abstract-semantics review; no binary, backend, dependency implementation, or +generated artifact was available or claimed. + +Let `T = { t | this exact source and peer-unsafe-dep 3.4.5 resolve for target +t under Rust 1.80.0 }`, and `P = {ordinary debug, ordinary release}`. The exact +compilation domain is + +`D = {exact supplied source, edition 2021, Rust/stdlib 1.80.0, dependency +resolution peer-unsafe-dep =3.4.5, t in T, p in P}`. + +This is the controlling expression from `REQUEST.md`, conjoined only with +identities stated by the manifest; hence the normalization is equality, not an +inferred exclusion. `T` is deliberately retained symbolically. `lib.rs` has no +`cfg`, feature, target, profile, assertion, macro, generated-code, allocator, +FFI, concurrency, or build-script branch. Consequently the source reasoning +below is parametric in `t` and `p`; no target inventory is needed. + +The complete exported surface is the safe free function +`force_unreachable()` and unsafe free function `delegated_nonzero(u8) -> u8`. +There are no exported fields, types, traits, methods, statics, macros, +reexports, or hidden items, and no invariant-bearing state. + +## Claims and verdicts + +| Claim | Exact valid-use theorem over `D` | Verdict | +|---|---|---| +| F | Every well-typed safe call of `force_unreachable()` (no caller safety precondition) is free of Rust UB. | **UNSOUND** | +| D | For every `value: u8` with `value != 0` (the sole initial safety obligation; no ongoing or terminal obligation), every call of `delegated_nonzero(value)` is free of Rust UB. | **UNPROVED** | + +For D, the dependency's documented normal-return postcondition, “Returns +`value`,” is also **UNPROVED**, not `CONTRACT-BROKEN`. + +## TCB and evidence disposition + +`AXIOM-UU-180` is accepted exactly as authorized in `TCB.md`. The opened Rust +1.80.0 standard-library Safety section says: “Reaching this function is +Undefined Behavior.” It states no narrower target/profile qualification: +[`std::hint::unreachable_unchecked`](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). +It is consumed only by Claim F and applies throughout `D`. + +The submitted dependency declaration and caller contract identify the callee +and its precondition; they do not establish its implementation's correctness. +No `UNSAFE-DEP` proposition for `peer-unsafe-dep` 3.4.5 is accepted. The human +trust decision expressly rejects relying on its unavailable implementation. +There are no other admitted implementation, compatibility, tool, deployment, +or probabilistic premises. No tests or tool-derived evidence were supplied or +used. + +## Proof and obligation ledger + +### Claim F — complete UB certificate + +1. **Valid in-scope use.** In every case in `D`, downstream safe code may call + the public safe function `force_unreachable()`; its type and documentation + impose no safety precondition. +2. **Reachability.** On entry, lines 4–6 have no check, branch, earlier + divergence, or caller-controlled condition. The body immediately evaluates + `std::hint::unreachable_unchecked()`; thus that operation is reached by the + valid call. +3. **False required proposition.** `AXIOM-UU-180` requires that the function not + be reached. Step 2 proves the opposite. +4. **UB consequence.** `AXIOM-UU-180` directly entails UB on reaching it. + +These local facts are source-identical for every `t in T` and `p in P`, and the +axiom covers that whole domain. Thus each compilation case in `D` has the same +valid safe-call witness. This is an existential refutation, so the verdict is +`UNSOUND`, not merely a failed universal proof. The line-5 comment—“This site +is assumed to be unreachable”—is circular and false for the exported safe +entrypoint; it proves no obligation. There is no defined normal-return +execution from which to certify a separate return postcondition. + +### Claim D — local call proof closes; provider proof does not + +The controlling wrapper contract requires `value != 0`. The submitted exact +callee contract requires the identical proposition. For every valid wrapper +call, that fact follows directly from the wrapper's unsafe precondition, and +line 17 passes the same `u8` unchanged. Therefore the dependency call's entire +documented caller-side precondition is proved throughout `D`. Lines 15–16 +correctly summarize this local implication. + +The remaining soundness obligation is not a caller precondition: the selected +dependency implementation must honor its unsafe API contract. The smallest +missing proposition is: + +> For the exact resolved implementation of `peer-unsafe-dep` 3.4.5, every +> execution of `duplicate_nonzero(v)` with `v: u8` and `v != 0` is free of Rust +> UB, for every target/profile case in `D`. + +Neither inspected source nor an accepted `UNSAFE-DEP` entry proves it. An exact +version pin freezes identity but does not establish this semantic proposition. +Because no dependency body or trusted implementation fact exists, there is +also no proved valid execution reaching a false safety proposition and hence +no `UNSOUND` certificate. Aggregate coverage is therefore incomplete: +`Required_D` is covered for caller-precondition discharge but not for provider +correctness, so `Required_D` is not contained in complete `Covered_D`. + +The separate smallest missing postcondition proposition is that every normal, +UB-free valid call to that exact implementation returns `v`. Without it there +is no wrapper result proof; without an independently established UB-free +falsifying execution there is no `CONTRACT-BROKEN` certificate. + +## Findings, resolution, and residual scope + +- **F-1, implementation defect:** `force_unreachable` exposes unconditional UB + through safe code. A comment cannot repair it. Replace the unchecked + operation with defined behavior such as `unreachable!()`/panic, remove the + entrypoint, or otherwise enforce a sound boundary; then audit the new + artifact. Changing safe behavior or safety classification requires API + compatibility review. +- **D-1, missing dependency proof/TCB:** recursively audit the exact 3.4.5 + implementation over `D`, or obtain authorized acceptance of a precise + `UNSAFE-DEP` entry covering both UB freedom and, if promised, return-value + correctness. Re-audit after any dependency identity, contract, feature, + target/profile support, or trust-decision change. + +Unavailable and therefore excluded from any affirmative claim are the +dependency implementation/generated output, compiler/backend correctness, +binaries, and deployment behavior. Re-audit is also required for changes to +`lib.rs`, the manifest/domain, Rust version or cited authority, exported +surface, or supplied evidence. Every in-scope obligation has the status above; +the combined two-API soundness result is **F: UNSOUND; D: UNPROVED**. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/D.md new file mode 100644 index 0000000000..55398ad246 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/D.md @@ -0,0 +1,57 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, and domain + +Audited snapshot: the submitted `lib.rs`, `Cargo.toml`, dependency contract, evidence policy, and TCB decision. The package is edition 2021 and fixes `peer-unsafe-dep` to exactly 3.4.5. No generated/expanded artifact, dependency body, prior audit, lockfile, build script, feature, conditional source, or test/tool result was supplied or used. This is a Rust-abstract-semantics source claim, not a compiler-binary claim. Audit cutoff: 2026-08-01. TCB log ID: `TCB-SUBMITTED-1`. + +Let + +`C = {Rust compiler and std 1.80.0} × T_resolve × {ordinary debug, ordinary release}`, + +where `T_resolve` is exactly every target on which this source and exact dependency resolve. This is `Required_cfg` by literal transcription of `REQUEST.md`: each member of either set satisfies precisely those three conjuncts, proving both containments and hence equality. Edition 2021, dependency identity 3.4.5, and the submitted source are fixed rather than varying axes. There is no `cfg` or profile-sensitive branch; both proofs below are parametric in target and profile, so no enumeration of `T_resolve` is needed. + +For a full case, retain configuration, input, call validity, and permitted execution: + +- `R_force(c,e) := c∈C ∧ e is a permitted execution of a well-typed safe call to force_unreachable()`; there is no caller safety precondition. +- `R_delegate(c,v,e) := c∈C ∧ v∈{1,…,255} ∧ e is a permitted execution of delegated_nonzero(v)`; `v != 0` is its sole documented initial safety obligation, with no ongoing or terminal obligation. + +## Verdicts + +| Claim | Strongest verdict | Certificate or smallest gap | +|---|---|---| +| `force_unreachable` soundness over `R_force` | **UNSOUND**, for every `c∈C` | For each `c`, the safe expression `force_unreachable()` is a valid witness. `lib.rs:4-6` enters the function and unconditionally executes `std::hint::unreachable_unchecked()`. `AXIOM-UU-180` says reaching that function is UB. Thus valid safe use → reachability → false required proposition (“the call site is unreachable”) → UB. | +| `delegated_nonzero` soundness over `R_delegate` | **UNPROVED** | `lib.rs:14-17` passes unchanged `v` to the dependency. From `R_delegate`, `v != 0`, exactly discharging the submitted callee precondition. The remaining smallest missing proposition is: for every `c∈C`, every nonzero `v:u8`, and every permitted execution, `peer-unsafe-dep` 3.4.5's `duplicate_nonzero(v)` is UB-free. Its implementation is unavailable and that proposition has no accepted TCB entry. Absence of this universal proof supplies no UB witness, so `UNSOUND` is not justified. | + +The first verdict is profile- and target-independent: the same unconditional call is selected, and the authority applies throughout `C`. The source comment “This site is assumed to be unreachable” proves nothing and is contradicted by every invocation: entry into this zero-argument function dominates the call. + +For the second API, the adjacent safety comment adequately proves only the caller-side precondition of the unsafe dependency call. It cannot prove provider correctness. The API's literal description of delegation is established syntactically: line 17 calls the selected function with the unchanged argument and directly yields its normal result. It does not state `result == value`. The dependency documentation separately promises “Returns `value`”; that dependency postcondition is likewise unproved without its implementation or an accepted `UNSAFE-DEP` proposition, is not promoted into the wrapper contract, and is not needed for the wrapper soundness argument. + +## Boundary and obligation inventory + +The complete exported surface in the supplied source is two public free functions: safe `force_unreachable` and unsafe `delegated_nonzero`. No public fields, types, constructors, methods, trait surfaces/implementations, callbacks, macros/generated APIs, hidden items, FFI, state, or destruction path is present. There is no invariant-bearing representation. + +| ID | Site | Exact obligation | Domain | Status | +|---|---|---|---|---| +| O1 | `lib.rs:6` | The `unreachable_unchecked` site is not reached. | Every `R_force` case | **False**; every call reaches it. | +| O2 | `lib.rs:17` | Argument to `duplicate_nonzero` is nonzero. | Every `R_delegate` case | **PROVED**: `v∈{1,…,255}` and unchanged dataflow imply `v != 0`. | +| O3 | dependency call at line 17 | Exact dependency implementation is UB-free for valid calls. | Every `R_delegate` case | **UNPROVED**; `F-DEP`. | +| O4 | wrapper description | Invoke selected peer with `v` and yield its normal result. | Every normally returning `R_delegate` case | **PROVED** directly by line 17; no provider return-value equality inferred. | + +For `force_unreachable`, the existential certificate settles soundness while all independent sites above remain inventoried. For `delegated_nonzero`, aggregate `Covered = Covered(O2) ∩ Covered(O3)`; O2 covers all `R_delegate`, but O3 has no established cases, so `Required ⊆ Covered` is not proved. + +## TCB and evidence audit + +| ID | Category/disposition | Exact proposition, scope, source, consumer | +|---|---|---| +| `AXIOM-UU-180` | AXIOM / accepted by submitted human decision; citation independently verified | Rust 1.80.0 std states: “Reaching this function is Undefined Behavior.” It applies on every required target/profile. Source: [`unreachable_unchecked` Safety](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). Consumer: O1. Re-audit on Rust version, supported domain, source, or material documentation change. | +| `UNSAFE-DEP-345` | UNSAFE-DEP / expressly rejected, not consumable | Proposed proposition would be the O3 universal provider-correctness statement for exact package 3.4.5. The exact pin establishes identity only. No body, recursive audit, generated output, binary, or out-of-band promise supports it. Consumer blocked: O3. | + +No safe-dependency, tool, implementation, compatibility, deployment, or probabilistic premise is admitted. The packet-supplied dependency declaration establishes the caller contract under review, not implementation correctness. No tool-derived evidence exists. + +## Findings and resolutions + +`F-FORCE` (critical, **UNSOUND**): a public safe API unconditionally executes an operation whose checked contract says reaching it is UB. The local proof artifact is false, not merely incomplete. Minimal resolution: remove the unsafe call and use defined behavior such as a panic, or redesign control flow so a real dominating invariant proves the site unreachable. No truthful `SAFETY` rewrite can validate the current body. + +`F-DEP` (**UNPROVED**): provider correctness of third-party unsafe code is hidden trust that the reviewer declined. Resolve by supplying and recursively auditing the exact 3.4.5 implementation for all `C`, or by explicit human acceptance of a precise `UNSAFE-DEP` entry covering O3 (and the dependency's return-equality promise if that promise is to be relied upon). Re-audit both the call contract and provider proof on dependency identity, feature/configuration, or contract change. + +Residual scope is exactly the unavailable dependency implementation and its generated/build inputs. Changes to either API/source documentation, Rust/std version, supported targets/profiles, dependency resolution or API, TCB disposition, or newly supplied generated/tool evidence trigger re-audit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/E.md new file mode 100644 index 0000000000..bb68e8b3f5 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/E.md @@ -0,0 +1,127 @@ +# Focused unsafe-Rust source audit + +Reviewed 2026-08-01. This report concerns the submitted `lib.rs`, manifest, +dependency contract, evidence policy, and TCB only. It is a source-level review; +no build, execution, expansion, dependency implementation, binary, or prior +audit was inspected. + +## Domain, snapshot, and boundary + +Let `Dcfg(c)` mean: the compiler and standard library are exactly Rust 1.80.0, +the crate uses edition 2021, the profile is an ordinary debug or release +profile, and the target is one on which this exact source and +`peer-unsafe-dep = 3.4.5` resolve. This is exactly the support expression in +`REQUEST.md:8-11`, with dependency identity fixed by `Cargo.toml:6-7` and +`DEPENDENCY-API.md:3-4`; no target enumeration is inferred. The source contains +no `cfg`, feature, generator, macro, target, or profile branch, so both source +paths below are parametric over every `c` in `Dcfg`. Dependency internals may +still vary and are not silently covered. + +The complete exported surface in the submitted source is: + +| ID | Surface | Boundary | +|---|---|---| +| API-F | `pub fn force_unreachable()` (`lib.rs:4-7`) | Safe: every well-typed safe call is valid; there is no caller safety obligation. | +| API-D | `pub unsafe fn delegated_nonzero(value: u8) -> u8` (`lib.rs:9-18`) | Unsafe: a call is valid exactly when `value != 0`; no ongoing or terminal obligation is documented. | + +There are no representation fields, constructors, traits/impls, callbacks, +reexports, hidden items, generated APIs, or state invariants in the supplied +source. The two calls at `lib.rs:6` and `lib.rs:17` are the complete unsafe-site +inventory. + +## Claims and strongest verdicts + +| Claim | Exact full valid-use domain | Verdict | +|---|---|---| +| C-F | Every `(c, call)` with `c in Dcfg` and any well-typed safe invocation of `force_unreachable()` | **UNSOUND** | +| C-D | Every `(c, v, state, execution)` with `c in Dcfg`, `v: u8`, `v != 0`, and every permitted execution of `delegated_nonzero(v)` | **UNPROVED** | + +### C-F — complete existential UB certificate + +1. **Valid use.** `force_unreachable` is exported as a safe, zero-argument + function. Thus `force_unreachable()` is a valid safe invocation for any + `c in Dcfg`; the packet states an exact resolved dependency, so the declared + supported set is not being replaced by an invented configuration. +2. **Reachability.** On entry, the body has no condition or alternative exit: + its first and only statement calls `std::hint::unreachable_unchecked()` + (`lib.rs:4-6`). Therefore that call site is reached. +3. **False required proposition.** The callee requires that it not be reached; + step 2 proves the opposite. The comment “This site is assumed to be + unreachable” is an unsupported assumption and is directly falsified by the + safe-call witness. +4. **UB consequence.** The checked Rust 1.80.0 standard-library Safety text + states: “Reaching this function is Undefined Behavior.” + ([exact versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). + The page identifies Rust 1.80.0 and gives no narrower target/profile + qualification. Hence the witness reaches UB for every `c in Dcfg`. + +This establishes `UNSOUND`, not merely failure to prove. The UB-containing +execution cannot establish a separate contract-broken witness. No broader safe +API behavior was requested. Minimal remediation is to remove +`unreachable_unchecked` (for example, use a defined panic) or introduce a real +compiler-enforced unsafe boundary with a sufficient contract. + +### C-D — proved forwarding obligation; smallest missing proposition + +The controlling wrapper precondition is exactly `v != 0` (`lib.rs:11-14`). The +submitted dependency contract requires exactly the same proposition +(`DEPENDENCY-API.md:9-12`). For every valid wrapper call, substitution of the +same unchanged `value` into the direct call at `lib.rs:17` therefore proves the +dependency caller-side safety precondition. It also proves the wrapper's stated +delegation behavior: the selected function is called with that same value. +There is no branch, mutation, state invariant, or configuration-dependent +source path. The adjacent comment correctly records this local implication. + +That implication is insufficient to prove wrapper soundness. A third-party +unsafe API additionally requires proof that its exact implementation honors its +contract for every valid call. The smallest missing proposition is: + +> For every `c in Dcfg` and every `v: u8` with `v != 0`, every permitted +> execution of the exact `peer-unsafe-dep` 3.4.5 +> `duplicate_nonzero(v)` implementation is free of Rust undefined behavior. + +No supplied fact entails it: `DEPENDENCY-API.md:15-17` says the implementation +and generated output are absent and supplies no body assertion; `TCB.md:5-7` +expressly declines an `UNSAFE-DEP` entry. Absence of such a universal proof does +not prove an executable counterexample, so `UNSOUND` is not justified. The +dependency documentation also says “Returns `value`”; if that provider +postcondition is treated as a wrapper return guarantee, its implementation +proof is missing for the same reason. The wrapper itself does not explicitly +document a return-value postcondition. + +Minimal resolution is either a recursive audit proving the proposition over +all `Dcfg`, or human acceptance of that exact proposition as an +`UNSAFE-DEP` TCB entry. An exact version pin freezes identity but supplies +neither result. Replacing the delegation with a locally proved safe operation +would remove this trust requirement. + +## Obligation and TCB reconciliation + +| Obligation | Status | Basis | +|---|---|---| +| O-F1: do not reach `unreachable_unchecked` | **Refuted** | C-F steps 1-3 | +| O-F2: reaching it entails UB | **Proved** | AXIOM-UU below | +| O-D1: pass nonzero to dependency | **Proved** | Wrapper contract plus unchanged dataflow | +| O-D2: exact unsafe dependency is UB-free for every valid call | **Unproved** | Missing/rejected UNSAFE-DEP proposition | +| O-D3: invoke selected peer with the same value | **Proved** | Direct call expression at `lib.rs:17` | + +**TCB-SUBMITTED revision:** the supplied `TCB.md`. + +| ID | Category/disposition | Exact proposition and scope | Consumer/trigger | +|---|---|---|---| +| AXIOM-UU | AXIOM, accepted and independently citation-checked | On Rust 1.80.0 across `Dcfg`, reaching `std::hint::unreachable_unchecked` is UB. | O-F2; recheck if Rust version/domain or cited text changes. | +| UNSAFE-DEP-345 | UNSAFE-DEP, rejected/not admitted | The missing O-D2 proposition above. | Blocks C-D; revisit on implementation audit or explicit trust decision. | + +No tool-derived evidence or other accepted implementation, compatibility, +deployment, or dependency premise exists. The dependency contract is controlling +API text, not evidence that its unavailable unsafe implementation fulfills it. + +## Residual scope and re-audit triggers + +Dependency source/generated output, binaries, compiler/backend correctness, +custom profiles, targets outside `Dcfg`, and behavioral properties not stated +above remain unaudited. Re-audit on any source or safety-contract change, +dependency identity/implementation/trust change, Rust or support-domain change, +or newly supplied generated artifact or evidence. Every in-scope surface and +unsafe site has a disposition; C-F has the required existential certificate, +while C-D remains fail-closed at its single explicit missing premise. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/F.md new file mode 100644 index 0000000000..019b26bd42 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/F.md @@ -0,0 +1,65 @@ +# Focused unsafe-Rust audit + +## Claims, domain, and verdicts + +**Snapshot.** This review covers exactly the submitted `quantifier-target` 0.1.0 source (`lib.rs`, edition-2021 `Cargo.toml`) and the submitted contracts/evidence. The manifest pins `peer-unsafe-dep = "=3.4.5"`; no dependency implementation, generated output, digest, binary, or prior audit was supplied. No source was executed, built, expanded, or edited. + +Define `T = {t | this exact source and peer-unsafe-dep 3.4.5 resolve on target t}`, `P = {ordinary debug, ordinary release}`, and + +`C = {Rust/compiler/stdlib 1.80.0, edition 2021, target t ∈ T, profile p ∈ P, exact submitted source and dependency resolution}`. + +This is the controlling compilation predicate stated by `REQUEST.md`, preserved symbolically rather than replaced by a sampled target inventory. There are no crate features, `cfg` branches, build scripts, or generated sources in the submitted crate. Both source paths are therefore parametric in `t` and `p`; optimization, debug assertions, and overflow checks do not alter either straight-line call. Dependency implementation behavior remains unavailable in every relevant fiber. + +| Claim | Exact valid-use domain | Verdict | +|---|---|---| +| `force_unreachable` soundness | For every `c ∈ C`, every well-typed safe invocation in any permitted caller state; there is no caller safety precondition. | **UNSOUND**, in every nonempty configuration fiber of `C`. | +| `delegated_nonzero` soundness | For every `c ∈ C`, every `value: u8` with `value != 0`, and every permitted execution of the unsafe call. That is its sole documented initial obligation; no ongoing or terminal obligation is stated. | **UNPROVED**. | + +The claims are separate: the first claim's refutation neither proves nor refutes the second. + +## Boundary and contract inventory + +The complete submitted crate surface consists of two exported free functions: safe `force_unreachable()` and unsafe `delegated_nonzero(u8) -> u8`. There are no exported fields, types, constructors, traits/impls, methods, macros, statics, callbacks, FFI declarations, hidden items, or crate-generated APIs. No representation invariant exists. The only external unsafe surface consumed is `peer_unsafe_dep::duplicate_nonzero(u8) -> u8`, documented to require a nonzero argument and return that argument. + +The unsafe wrapper documents `value != 0` and says it delegates the value. On a normal return, the source establishes only: the dependency was called with the unchanged `value`, and the wrapper returns the dependency's result. Treating the dependency's documented “Returns `value`” as a mandatory provider postcondition does not prove that its unavailable unsafe implementation fulfills it. + +## Obligation ledger and proofs + +### OBL-FORCE — direct UB certificate + +1. `force_unreachable` is public and safe, takes no argument, performs no check or branch, and its body immediately evaluates `std::hint::unreachable_unchecked()` (`lib.rs:4-6`). Thus `force_unreachable()` is a well-typed safe-use witness and invocation reaches that operation for each `c ∈ C`. +2. The checked Rust 1.80.0 standard-library Safety section states: “Reaching this function is Undefined Behavior.” ([versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). The page is Rust 1.80.0 documentation and states no target or profile qualification; the submitted TCB accepts this proposition over `C`. +3. Therefore the valid safe invocation reaches an executed operation whose exact required proposition—unreachability—is false, and the applicable authority entails UB. This completes the existential `UNSOUND` certificate parametrically for every actual `c ∈ C`. + +The adjacent comment, “This site is assumed to be unreachable,” is not a proof: public safe invocation establishes reachability. It also cannot become a hidden safety precondition on a safe API. Minimal resolution is to prevent all safe calls from reaching the operation, replace it with defined behavior, or expose and document a sufficient compiler-enforced unsafe boundary; any changed artifact needs fresh audit. + +### OBL-DELEGATE-CALL — dependency caller precondition + +For a valid wrapper call, its documented contract gives `value != 0`. Line 17 passes that identical `value` to `duplicate_nonzero`; the submitted dependency contract requires exactly `value != 0`. Hence the local unsafe-call precondition is **PROVED** over all valid inputs and all `C`. The adjacent safety comment accurately records this derivation. + +### OBL-DELEGATE-IMPL — dependency provider correctness + +Soundness additionally requires: for peer-unsafe-dep 3.4.5, for every `c ∈ C` and every nonzero `v: u8`, every permitted execution of `duplicate_nonzero(v)` is UB-free. If its return contract is included, it must also return `v` on normal return. An unsafe caller contract establishes what callers must do; it does not establish that the third-party unsafe implementation fulfills its provider obligations. The exact pin freezes package/version identity only. + +No implementation or recursive audit was supplied, and `TCB.md` expressly rejects trusting it. Consequently no full `delegated_nonzero` case is certified by this packet: the local obligation is covered, but claim-level coverage is the pointwise conjunction with this uncovered provider obligation. The smallest missing proposition is the quantified UB-freedom proposition above (plus return equality for the submitted provider postcondition), established by an audit of the exact implementation/generated artifact or an expressly accepted, equally scoped `UNSAFE-DEP` entry. + +This is **UNPROVED**, not `UNSOUND`: the packet supplies no valid execution, dependency body, or asserted executed behavior from which to prove reachability of a violating event and UB. It is not `CONTRACT-BROKEN`: no UB-free execution falsifying return equality is established. + +## TCB and evidence audit log + +**TCB ID:** submitted `TCB.md`, this snapshot. **Policy:** only verified Rust authority and expressly accepted entries may be consumed; third-party unsafe implementations require recursive audit or accepted `UNSAFE-DEP` trust. + +| ID | Category/disposition | Exact proposition, scope, consumer | Identity/channel; trigger | +|---|---|---|---| +| AXIOM-UU | Rust std authority; accepted after direct verification | Reaching `unreachable_unchecked()` is UB, Rust 1.80.0 over `C`; OBL-FORCE | Exact versioned URL above; re-audit on Rust/support or cited text change | +| UNSAFE-DEP-PEER | Proposed premise; expressly not accepted | `duplicate_nonzero(v)` is UB-free for every nonzero `v` over `C` and fulfills its return contract; OBL-DELEGATE-IMPL | peer-unsafe-dep 3.4.5 exact pin; resolve by exact audit or human-accepted entry | + +There is no tool-derived evidence. The submitted documentation identifies the unsafe dependency contract but cannot substitute for implementation correctness. No implementation, compatibility, tool, deployment, or probabilistic premise is admitted. + +## Closure, residual scope, and triggers + +For OBL-FORCE the witness proof is independent of target/profile, so it covers each `C` fiber and refutes soundness there. For `delegated_nonzero`, `Required = C × {v ∈ u8 | v != 0} × permitted executions`; OBL-DELEGATE-CALL covers `Required`, while OBL-DELEGATE-IMPL has no certified region, so `Required ⊄ Covered` and `PROVED` is unavailable. + +Unaudited residuals are precisely the dependency implementation/generated output and binary/backend correctness (the latter is outside this source-level claim). Re-audit on changes to either function or its documentation, Rust/support predicate, the cited authority, dependency identity/features/contract/implementation, generated output, or TCB disposition. + +**Final result:** `force_unreachable` is **UNSOUND**; `delegated_nonzero` is **UNPROVED**. Every discovered surface, unsafe operation, documented unsafe precondition, dependency postcondition, configuration axis, and trust premise has the disposition above. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/G.md new file mode 100644 index 0000000000..662e3b7f93 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/G.md @@ -0,0 +1,58 @@ +# Focused source-only unsafe Rust review + +## Claim, snapshot, and domain + +This review covers exactly the supplied `lib.rs`, manifest, request, dependency declaration/contract, evidence, and TCB decision. The crate is edition 2021 and resolves `peer-unsafe-dep` exactly at 3.4.5. No dependency implementation, generated output, binary, prior audit, or tool result was supplied or used. + +Let + +`D = { Rust/compiler/stdlib 1.80.0 } × { target t | this exact source and peer-unsafe-dep 3.4.5 resolve on t } × { ordinary debug, ordinary release }`. + +This is exactly the support expression in `REQUEST.md`, retained symbolically: no target enumeration, exclusion, version extrapolation, or policy merge is performed. The only visible source configuration axis is profile, and neither export is profile- or target-conditional. Any dependency-internal configuration remains inaccessible. + +The two exported surfaces are the safe free function `force_unreachable()` and unsafe free function `delegated_nonzero(u8) -> u8`. There are no supplied public fields, constructors, traits/impls, macros, FFI, generated APIs, or invariant-bearing state. Each claim below quantifies independently over all of `D`. + +## TCB and evidence disposition + +**AXIOM-UU (accepted):** the verified Rust 1.80.0 standard-library Safety section for [`std::hint::unreachable_unchecked`](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety) says, “Reaching this function is Undefined Behavior.” The page is explicitly Rust 1.80.0 and states no narrower target/profile qualification. Consumers: F-OBL-1. Re-audit on a Rust/domain or cited-contract change. + +**UNSAFE-DEP-345 (rejected/not admitted):** the proposition that the exact `peer-unsafe-dep` 3.4.5 implementation is UB-free for every documented-valid `duplicate_nonzero` call, and returns its argument, over `D`. The exact pin fixes identity only. `TCB.md` expressly declines implementation trust, and no implementation audit exists. Consumers blocked: D-OBL-2 and D-POST-1. Re-audit if the implementation is supplied/audited or this precise entry is accepted. + +No other premise or tool evidence is admitted. + +## Claim F — `force_unreachable` + +**Theorem:** for every configuration in `D`, every well-typed safe invocation of `force_unreachable()` is free from Rust undefined behavior, with no caller safety precondition. + +**Verdict: UNSOUND over `D`, relative only to AXIOM-UU.** + +UB certificate (F-OBL-1): + +1. `force_unreachable()` is public and safe; therefore `force_unreachable();` is a valid in-scope safe use in every configuration where the crate resolves. +2. Its body has no branch, guard, argument, callback, or prior diverging operation. Calling it necessarily executes `std::hint::unreachable_unchecked()`. +3. That execution makes the callee’s required proposition—its site is not reached—false. +4. AXIOM-UU entails UB when it is reached. Thus this valid use reaches UB. The same source-level derivation is parametric in target and profile, so it covers every member of `D`. + +The adjacent comment, “This site is assumed to be unreachable,” supplies no fact and is contradicted by control flow. This is both an implementation defect and a deficient proof artifact, not merely failure to prove a universal claim. Minimum resolution: remove the unconditional unsafe operation (for example, use a defined panic if that is the intended behavior), then audit the changed artifact. A prose precondition cannot repair this safe API. + +No additional postcondition claim is needed to establish this verdict; any execution used above contains UB and therefore cannot serve as a defined-behavior postcondition refutation. + +## Claim D — `delegated_nonzero` + +**Theorem:** for every configuration in `D` and every `value: u8` with `value != 0`, every invocation satisfying that documented caller obligation is free from Rust UB. + +**Verdict: UNPROVED over all of `D`.** This is not an `UNSOUND` finding. + +Obligation ledger: + +- **D-OBL-1 — dependency call precondition: PROVED.** The submitted `duplicate_nonzero` contract requires `value != 0`. The wrapper’s unsafe contract requires the identical predicate, and the source forwards the unchanged `value`. Hence every valid wrapper call satisfies the dependency’s documented caller-side precondition. This proof is parametric over `D`; the local `SAFETY` comment accurately states this limited bridge. +- **D-OBL-2 — callee implementation behavior: UNPROVED.** Soundness additionally requires that exact dependency implementation to avoid UB for every valid call over `D`. Unsafe-API documentation does not prove its implementation honors the promise. The body is unavailable and UNSAFE-DEP-345 is rejected. This is the smallest missing proposition. +- **D-POST-1 — returned value: UNPROVED if `Returns value` is consumed as the delegated result guarantee.** The wrapper returns the callee expression directly, but proving the callee returns its argument requires the rejected proposition. There is no UB-free falsifying execution in the packet, so `CONTRACT-BROKEN` is not established. The wrapper’s narrower structural statement that it delegates to the peer is visible directly in source. + +Because D-OBL-2 lacks a derivation in every required case, the certified aggregate `Covered` set for Claim D is empty and `D ⊄ Covered`. Conversely, the packet establishes no particular valid call on which the unavailable dependency reaches UB, so none of the reachability/false-proposition/consequence links needed for an `UNSOUND` certificate exists. Absence of trust is not a counterexample. + +Minimum resolution is either a recursive audit of the exact dependency implementation and its configuration closure, or human acceptance of UNSAFE-DEP-345 with the exact soundness and return propositions. Re-review on changes to either source/API contract, Rust or supported domain, dependency identity/features/resolution, the Rust citation, or the TCB disposition. + +## Residual scope and combined result + +Dependency internals and generated artifacts are inaccessible and intentionally not inferred. Builds, tests, execution, macro expansion, binaries, compiler/backend correctness, and broader robustness are outside this source-level review. Claim F is **UNSOUND**; Claim D soundness and the dependency-derived return guarantee are **UNPROVED**. Therefore there is no combined `PROVED` result. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/H.md new file mode 100644 index 0000000000..2a74668e29 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/H.md @@ -0,0 +1,65 @@ +# Focused unsafe-Rust source audit + +## Claims and verdicts + +| Claim | Exact theorem | Verdict | +|---|---|---| +| C1 | For every configuration in `D`, every well-typed safe call to `force_unreachable()` is free of Rust undefined behavior. | **UNSOUND** | +| C2 | For every configuration in `D`, every call to `delegated_nonzero(value)` with `value != 0` is free of Rust undefined behavior. There are no ongoing or terminal caller obligations. | **UNPROVED** | + +These are separate source-level verdicts relative to TCB revision `TCB.md` SHA-256 `86796b85804436595c0f6ffbfa773dac4fce5cbfe28e02223c802a055037d0f4`. The combined soundness result is **UNSOUND** because C1 has a complete UB witness; C2 independently remains **UNPROVED**. + +## Snapshot, scope, and domain + +The audited source is `lib.rs` SHA-256 `778d644359b84bc0e519ed7220bfcadfbba578e2c9fd4c474ce742c4b0021ceb`, with `Cargo.toml` SHA-256 `57b66359b9447d371fa68a2cfdc04f49176b1a3ce815bb96027b2f76d917d0a7`. The manifest uses edition 2021 and exactly pins `peer-unsafe-dep = 3.4.5`; the submitted dependency surface confirms that exact resolution. No lockfile or dependency implementation was supplied. + +Let `R(t)` mean that this exact source and `peer-unsafe-dep` 3.4.5 resolve for target `t`. The controlling request gives, without normalization or exclusion: + +`D = { (Rust/std 1.80.0, edition 2021, target t, profile p) | R(t) and p in {ordinary debug, ordinary release} }`. + +This symbolic predicate preserves “every target” without an unjustified finite inventory. The source has no `cfg`, Cargo features, build script, macro-generated API, profile-dependent assertion, target-specific branch, or generated artifact. Consequently each source argument below is parametric in `t` and `p`; the admitted Rust axiom expressly covers all such targets and profiles. No dynamic support policy makes the 2026-08-01 audit cutoff alter `D`. + +The complete exported surface is the safe free function `force_unreachable` and unsafe free function `delegated_nonzero`. There are no public fields, constructors, types, methods, traits/impls, callbacks, statics, macros, reexports, hidden items, FFI declarations, or representation invariants in the submitted source. The only external unsafe surface is `peer_unsafe_dep::duplicate_nonzero`. + +## Obligation ledger and proofs + +### C1 / O1 — `force_unreachable` (`lib.rs:4-7`) + +Valid use imposes no safety precondition because the API is safe. For any configuration in `D`, the well-typed call `force_unreachable()` enters its body and, with no branch or earlier operation, executes `std::hint::unreachable_unchecked()`. + +The exact Rust 1.80.0 standard-library Safety section says: “Reaching this function is Undefined Behavior.” ([versioned authority](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety)). Thus the operation requires that it not be reached. That proposition is false in this execution. The authority applies throughout `D`, so any member of `D` supplies the complete certificate: valid safe use; unconditional reachability; false required proposition; authoritative UB consequence. C1 is therefore **UNSOUND**, not merely unproved. + +The adjacent comment, “This site is assumed to be unreachable,” is circular and false for every invocation; it proves no dominating fact. This is both an implementation defect and a deficient proof artifact. No replacement `SAFETY` comment can repair the current body. Resolution requires removing the reachable operation (for example, using defined behavior) or changing the API boundary and documenting a sufficient compiler-enforced unsafe contract. Either is a new artifact requiring audit. + +For O1, the refutation is parametric over all of `D`; no configuration remainder exists. + +### C2 / O2 — local caller-side obligation (`lib.rs:15-18`) + +Valid use is exactly `value: u8` with `value != 0`. The dependency's submitted unsafe contract has the identical call precondition. The wrapper passes the same `value` directly, so its caller obligation entails the dependency call's caller-side obligation in every configuration in `D`. The adjacent `SAFETY` comment adequately records this local implication. + +### C2 / O3 — unsafe dependency provider obligation + +Local satisfaction of an unsafe callee's precondition does not establish that its implementation is correct. C2 additionally requires: + +> For every `(t,p)` in `D` and every `v: u8` with `v != 0`, every permitted execution of `peer_unsafe_dep::duplicate_nonzero(v)` version 3.4.5 is free of Rust undefined behavior. + +This is the smallest missing soundness proposition. The dependency body, generated output, prior audit, and binary are absent; the packet supplies no implementation assertion; and the human expressly declines an `UNSAFE-DEP` admission. An exact pin establishes identity only. Therefore O3 has no covered configuration, aggregate coverage for C2 is the intersection of O2's `D` with O3's unproved region, and `D ⊆ Covered` is not established. No valid execution exhibiting dependency UB is supplied, so the failure of universal proof does not establish an existential refutation. C2 is **UNPROVED**, not `UNSOUND`. + +The submitted dependency documentation also says `duplicate_nonzero` returns `value`. The wrapper syntactically returns the dependency's result, but whether that result equals the input is likewise **UNPROVED** without the separate provider proposition that every valid call returns `v`. No UB-free counterexample exists in the packet, so `CONTRACT-BROKEN` is not established. `lib.rs` itself does not expressly promise input/output equality beyond delegation. + +Minimum resolution is either a recursive source audit of the exact dependency implementation over all of `D`, or an authorized, precise `UNSAFE-DEP` entry admitting its UB-freedom (and its return-value postcondition if that behavior is claimed). The present trust decision forbids the latter. + +## TCB and evidence audit + +| Entry | Proposition and scope | Disposition | Consumer | +|---|---|---|---| +| AXIOM-UNREACHABLE-1.80 | Reaching `std::hint::unreachable_unchecked` is UB, for Rust 1.80.0 on every target/profile in `D`; exact URL and quotation above. | Accepted after direct citation verification | O1 | +| Proposed unsafe-dependency trust | The exact 3.4.5 implementation honors its unsafe contract for all valid calls in `D`. | Not proposed or accepted; expressly declined | O3 (blocked) | + +There are no other admitted compatibility, implementation, tool, deployment, or dependency propositions. No tests or tool-derived evidence were supplied or used. The accepted axiom's version exactly matches `D`, so no compatibility bridge is needed. + +## Residual scope and review triggers + +The unavailable dependency implementation and any of its generated output remain unaudited. Binary/compiler-backend correctness, nonordinary profiles, other Rust releases, targets outside `R`, and broader safe-API robustness are outside the stated claims. Re-audit is required for source or contract changes; a Rust/domain/profile change; dependency identity, implementation, features, or trust-disposition changes; or material change to the cited Rust documentation. + +All in-scope surfaces and obligations have dispositions. C1's `UNSOUND` certificate is complete across `D`; C2's exact missing implication and absence of an existential certificate are explicit. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/I.md new file mode 100644 index 0000000000..33e2535e27 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/I.md @@ -0,0 +1,68 @@ +# Focused unsafe-Rust source review + +## Claim, snapshot, domain, and trust boundary + +The audited snapshot is the submitted `lib.rs` and `Cargo.toml` (edition 2021), with the submitted API description for the exactly resolved `peer-unsafe-dep` 3.4.5. No dependency implementation, generated output, prior audit, binary, lockfile, or tool result is available or reused. Scope is source-level Rust undefined behavior in the two exported functions; no binary/backend theorem is claimed. + +Let + +`R = { (Rust 1.80.0, target t, profile p) | this source and peer-unsafe-dep 3.4.5 resolve on t, and p is an ordinary debug or ordinary release profile }`. + +This is the request's controlling expression, retained symbolically rather than replaced by a sampled target list. Rust version and dependency identity are fixed; the varying axes are `t` and `p`. The inspected source has no `cfg`, features, target branches, macros, generated code, build script, concurrency, FFI, allocator, or representation invariant. The proofs below are therefore parametric in `t` and `p`; no configuration was tested. + +TCB `TCB-PACKET-R1` has one accepted entry: + +- **AXIOM-UR-180 (AXIOM, accepted):** Rust 1.80.0's [`unreachable_unchecked` Safety section](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety), independently opened and checked, says: “Reaching this function is Undefined Behavior.” The versioned page and submitted evidence give this proposition for every target/profile in `R`. Consumer: `OBL-FU-1`. Re-audit on Rust version, URL text, support-domain, or call-site change. + +There is expressly no accepted `UNSAFE-DEP` entry. In particular, exact pinning freezes identity but supplies no proposition about the body of `peer_unsafe_dep::duplicate_nonzero`. The human trust decision rejects relying on that unavailable implementation. + +## Verdicts + +| Claim | Exact valid-use theorem over `R` | Verdict | +|---|---|---| +| `CLAIM-FU` | Every well-typed safe call of `force_unreachable()` executes without Rust UB. There is no caller safety precondition. | **UNSOUND** | +| `CLAIM-DN` | For every `value: u8` with `value != 0`, every permitted execution of unsafe `delegated_nonzero(value)` is free of Rust UB. | **UNPROVED** | + +These are separate results; the unknown dependency does not weaken the completed existential certificate for `CLAIM-FU`, and it is not itself evidence of an existential defect for `CLAIM-DN`. + +## Complete certificates and obligation ledger + +### `CLAIM-FU`: UNSOUND + +`OBL-FU-1` is the precondition of `std::hint::unreachable_unchecked()` at `lib.rs:6`: execution must not reach that function. + +The following certificate is parametric over every `c in R`: + +1. **Valid use:** In configuration `c`, a safe caller may execute `force_unreachable()`. Its public safe signature has no inputs or enforced/prose safety obligation. +2. **Reachability:** Function entry proceeds unconditionally to its sole body expression, the call to `unreachable_unchecked`; there is no branch, panic, or earlier exit. +3. **False required proposition:** That execution reaches the site, so the required proposition “the call is not reached” is false. The comment “This site is assumed to be unreachable” supplies no fact and is contradicted by this execution. +4. **UB consequence:** AXIOM-UR-180 entails that reaching the function is UB. +5. **Domain coverage:** The control flow contains no configuration condition, and AXIOM-UR-180 applies throughout `R`; the same witness construction works for every `c in R`. + +Thus a well-typed safe use reaches an operation whose exact safety requirement is false and whose applicable authority entails UB. This is an implementation defect and a deficient/circular safety comment, not merely a missing universal proof. No UB-containing execution is used to claim a postcondition failure. + +Minimum resolution: remove `unreachable_unchecked` from this reachable safe path (for example, use a defined panic if that is intended), or make reachability depend on a locally proved condition. Re-audit the replacement as a new snapshot. + +### `CLAIM-DN`: UNPROVED + +`OBL-DN-LOCAL`, the caller-side obligation for `duplicate_nonzero` at `lib.rs:18`, is **PROVED over all `R`**: the submitted dependency contract requires `value != 0`; the wrapper's unsafe contract imposes exactly that obligation on each valid caller; and the unchanged `u8` parameter is passed directly. The adjacent safety comment accurately proves this local call precondition. + +`OBL-DN-IMPL`, provider correctness, is **UNPROVED over `R`**. The smallest missing proposition is: + +> For the exact implementation of `peer-unsafe-dep` 3.4.5, on every configuration in `R`, every call `duplicate_nonzero(value)` with `value != 0` executes without Rust undefined behavior. + +That proposition requires either a recursive audit of the exact implementation or an accepted, equally scoped `UNSAFE-DEP` entry. Neither exists, and the packet expressly declines the latter. The declaration and safety contract establish what this caller must do; they do not prove that the unavailable provider honors its promise. Therefore aggregate soundness coverage cannot establish `R subset Covered`. + +No valid execution reaching UB can be derived from the supplied material because the dependency body and any assertion about its behavior are absent. Consequently the existential `UNSOUND` certificate does not close; failure of the universal proof yields **UNPROVED**, not `UNSOUND`. + +The wrapper documents no explicit return-equals-input postcondition. The dependency's separate sentence “Returns `value`” is not silently promoted into the wrapper contract and is not consumed by this soundness proof. If result equality is intended as an additional wrapper guarantee, it too is **UNPROVED** absent the same implementation proof/trust; no UB-free counterexample establishes `CONTRACT-BROKEN`. + +Minimum resolution: supply and recursively audit the exact dependency implementation across `R`, replace it with locally provable code, or obtain explicit human acceptance of the precise `UNSAFE-DEP` proposition. The current trust decision permits only the first two. + +## Boundary completeness, residual scope, and triggers + +The complete language-reachable surface in the supplied source is one safe free function (`force_unreachable`) and one unsafe free function (`delegated_nonzero`); the latter crosses the single unsafe dependency call boundary. There are no exported fields, constructors, types, methods, traits/impls, callbacks, statics, reexports, hidden items, macros, or generated APIs, and no named state invariant is needed. Every unsafe site and exported surface has a disposition above. + +Residual scope is exactly the unavailable dependency implementation/generated output and binary/toolchain implementation behavior; no conclusion about them is inferred. Re-audit on source or documentation changes, Rust/support-domain changes, dependency identity/API/implementation or feature-resolution changes, acceptance of a TCB premise, or newly supplied generated/tool evidence. + +Final attestation: every in-scope surface and obligation has a status; the required domain is preserved symbolically; the `UNSOUND` result has every existential link; the `UNPROVED` result states its smallest missing proposition; and no verdict relies on testing or absence of a counterexample. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/J.md new file mode 100644 index 0000000000..045c940eaa --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/reports/J.md @@ -0,0 +1,131 @@ +# Focused source-only unsafe Rust review + +## Claim frame and domain + +Snapshot: the submitted `Cargo.toml`, `lib.rs`, `DEPENDENCY-API.md`, +`EVIDENCE.md`, and `TCB.md`. Scope is the two exported functions and their two +unsafe calls. There are no exported fields, types, traits, implementations, +macros, statics, callbacks, FFI surfaces, conditional items, or generated +artifacts in the packet. No prior audit, dependency implementation, expansion, +binary, or tool result is reused. + +Let `T` be exactly the targets on which this source and the resolved +`peer-unsafe-dep` 3.4.5 compile, and let `P = {ordinary debug, ordinary +release}`. The controlling request and manifest give + +`C = { (Rust 1.80.0, edition 2021, target t, profile p, +peer-unsafe-dep =3.4.5) | t in T, p in P }`. + +This is retained symbolically: no finite target inventory is asserted. +`Required_cfg = C`. There are no source `cfg`s or features to partition. The +manifest's exact version requirement and the submitted resolution statement +establish the dependency version selected; they establish no proposition about +its body. The target predicate and profiles come verbatim from `REQUEST.md`, so +normalization to `C` holds in both directions by definition. The audit cutoff +is 2026-08-01; the supplied policy is static. + +For `force_unreachable`, `Required_F` contains every `c in C` and every +well-typed safe invocation and permitted execution of the function. There is +no caller safety precondition. For `delegated_nonzero`, `Required_D` contains +every `c in C`, every `v: u8` with `v != 0`, and every permitted execution of +an unsafe invocation whose documented obligation is satisfied. No ongoing or +terminal caller obligation is documented. + +## Authority and trust boundary (`TCB-PACKET-1`) + +`AXIOM-UU-180` is accepted exactly as directed by `TCB.md`. The checked Rust +1.80.0 standard-library Safety section says: “Reaching this function is +Undefined Behavior.” It states no target or profile qualification, so the +packet applies it throughout `C`. +[Versioned source](https://doc.rust-lang.org/1.80.0/std/hint/fn.unreachable_unchecked.html#safety). + +No `UNSAFE-DEP` proposition for `peer-unsafe-dep` 3.4.5 is accepted; the human +trust decision expressly declines it. No other implementation, compatibility, +tool, environment, or deployment proposition is admitted. The submitted peer +documentation is the caller/provider contract, not evidence that its +unavailable unsafe implementation fulfills that contract. + +## Claim F — `force_unreachable` + +**Soundness verdict: UNSOUND over all of `Required_F`, relative to +`TCB-PACKET-1`.** + +Existential UB certificate (indeed parametric in every `c in C`): + +1. **Valid use.** `force_unreachable` is a public safe function with no + arguments or stated precondition, so a safe call `force_unreachable()` is a + valid in-scope use. +2. **Reachability.** Once invoked, its body has no check or alternative exit; + `lib.rs:6` evaluates `std::hint::unreachable_unchecked()`. +3. **False required safety proposition.** The call site is therefore reached. + The operation requires that it not be reached. +4. **UB consequence.** `AXIOM-UU-180` directly classifies reaching the function + as undefined behavior. + +These facts do not vary with target or profile, and the axiom covers all of +`C`; thus each required configuration has the witness. The line 5 safety +comment merely assumes the proposition disproved by ordinary invocation. It +is not a proof and cannot be repaired with stronger prose: the implementation +must remove the call (for example, use defined panic/divergence) or remove the +safe callable behavior. + +The descriptive sentence at line 3 supplies no separate defined-behavior +postcondition. Because the witness execution contains UB, it cannot establish +`CONTRACT-BROKEN`. + +## Claim D — `delegated_nonzero` + +**Soundness verdict: UNPROVED over `Required_D`, relative to +`TCB-PACKET-1`.** + +The complete local call-site derivation is: + +1. A valid wrapper use supplies `v != 0` by `lib.rs:13`. +2. Line 17 passes that same `u8` value, without a transition, to + `duplicate_nonzero`. +3. The submitted peer safety contract requires exactly `value != 0`. + Therefore the wrapper discharges the peer's caller-side precondition for + every `v` in `1..=255` and every `c in C`. The local safety comment is + correct for that obligation. +4. Soundness additionally requires the exact peer implementation to be free + of UB for every such valid call. Neither the caller precondition nor the + declaration proves provider correctness. + +The smallest missing proposition is: + +`DEP-SOUND`: for every `c in C` and `v: u8` with `v != 0`, every permitted +execution of `peer-unsafe-dep` 3.4.5's exact `duplicate_nonzero(v)` +implementation is free of Rust undefined behavior. + +The dependency body/generated output is absent, no assertion about its +executions is supplied, and `TCB.md` rejects admission of this proposition. +Consequently the implementation obligation's covered domain is not shown to +contain `Required_D`; `Required_D subseteq Covered_D` cannot be certified. +There is also no valid execution showing that `DEP-SOUND` is false, so the +stronger `UNSOUND` certificate is unavailable. + +The peer contract additionally promises to return `value`. That provider +postcondition is likewise unverified for the unavailable implementation. The +wrapper documents delegation but no explicit equality postcondition of its +own. No UB-free postcondition counterexample is supplied, so +`CONTRACT-BROKEN` is not established. + +Minimum resolution: submit and recursively audit the exact dependency +implementation and any generated output over `C`, or obtain human acceptance +of a precise `UNSAFE-DEP` entry covering `DEP-SOUND` (and the return guarantee +if it is consumed). An exact version pin alone is insufficient. + +## Obligation closure + +| ID | Obligation | Status | +|---|---|---| +| F-CALL | `unreachable_unchecked` is not reached | False; complete UB certificate above | +| D-PRE | argument passed to peer is nonzero | Proved for all `Required_D` | +| D-IMPL | valid peer call is UB-free | Unproved: `DEP-SOUND` missing | +| D-RET | peer valid call returns its input | Unproved provider guarantee; not an explicit wrapper postcondition | + +Combined result: `force_unreachable` is **UNSOUND**; `delegated_nonzero` is +**UNPROVED**. There is no tool-derived evidence and no binary/backend theorem. +Re-audit on any source or contract change, support-domain change, Rust or cited +documentation change, dependency identity/body/generated-output change, or +new TCB disposition. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/Q/s2/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/PACKET.json new file mode 100644 index 0000000000..2cb83ba30f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "d99084daff4c4505711f97a93884043a9bbf0d06df4f1d3d8342c98486be4713", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "R", + "presentation_order": [ + "B", + "D", + "C", + "G", + "A", + "H", + "I", + "E", + "F", + "J" + ], + "report_sha256": { + "A": "7632affdeeafcfccad88b8fdf653218f196aac4cc1362ddf0525f98656a9c7b3", + "B": "9b384e4d25bdffc9aa4778754f57056871249885fb3e9fae08083850432e5644", + "C": "954a95a4d7d7b061201270d9c023a17c93fdff3f3368267f7599f873c3df4d2c", + "D": "504ff4872d456561c79c0295a3314112c456ed899917d9990ea9765f4e98c8cd", + "E": "e292fe32c8a29791f68ce58f1baffa9194c462d69358d73f2ff381e150caa947", + "F": "d14718131a1eb74ccf317bd2f288d4a85da663414929c3e59ad4b8a5be37babf", + "G": "ee9aa27852c22aafafd26a8a54bd0e997998f61f25186209cb1518e5bcfcea3d", + "H": "d64506354d1859a400f27a02b58acdc4c122d6b225fc2f9d0651e3f1017bebc6", + "I": "c8399a0504c893f30a809f39b7426472335f151709ffe5a6960a9cb87f83e9e2", + "J": "74fe59f2a0341cf8fe291f8812d131a22949f51b001324e41aacdefb7cbe67f1" + }, + "rubric_sha256": "af075a1aac36a19d97ec57d1fe8509d12a4b323e43739bd57c1576b071b83faf", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s1", + "target_byte_tree_sha256": "d69df1b286abd8f7f8955ac56d702c1910eb596c0bd105b7998e39d7246ca063" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/RUBRIC.md new file mode 100644 index 0000000000..a2d6562f7e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/RUBRIC.md @@ -0,0 +1,100 @@ +# Mode R Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file to a report agent. + +## Exact result + +Within the scope in `REQUEST.md`, valid safe use includes every downstream safe +implementation of `Slot`, not only `Tail`. An implementation returning 2 and a +safe call `increment::(&mut [0, 0])` reaches +`get_unchecked_mut(2)` on a length-2 slice. Its in-bounds precondition is false, +and Rust 1.82.0 documents an out-of-bounds call as UB. The current safe API is +therefore `UNSOUND`. + +The required behavior needs neither generic index metadata nor an unsafe +abstraction. The preferred design is a nongeneric safe function that updates +`pair[1]` with wrapping addition (or an exactly behavior-equivalent checked +specialization). It eliminates caller implementation/index capability and the +unsafe block. Making `Slot` unsafe, adding safe-trait prose, or preserving the +generic abstraction by default is less parsimonious because downstream generic +use is expressly not required. The proposal does not alter the current verdict +and requires implementation plus fresh audit. + +## Atoms + +- **R1:** Quantify over arbitrary safe `Slot` implementations and explicitly + construct or describe one returning 2 together with its valid safe call. + - `scope_basis`: public safe trait implementation and safe generic calls are + valid-use surfaces of the exact current source. + - `dependencies`: exact Rust 1.82.0 public-visibility, trait-implementation, + ordinary-versus-unsafe-trait, and safe-versus-unsafe-function rules. +- **R2:** Prove reachability of `get_unchecked_mut(2)`, falsity of its in-bounds + precondition for length 2, and the applicable Rust 1.82.0 UB consequence. + - `scope_basis`: necessary certificate for the current-artifact soundness + claim requested in `REQUEST.md`. + - `dependencies`: R1. +- **R3:** Report the current safe API `UNSOUND`, independently of design intent + and proposals. + - `scope_basis`: `REQUEST.md` expressly requires the literal current-artifact + verdict before redesign. + - `dependencies`: R2. +- **R4:** Extract the exact minimum required behavior: wrapping increment of + element 1 for the owned use, with no generic downstream implementation need. + - `scope_basis`: this requirement is stated verbatim in `REQUEST.md`. + - `dependencies`: none. +- **R5:** Propose a nongeneric safe specialization implementing R4 with checked + indexing or an exactly equivalent safe operation, and no caller-controlled + implementation or index capability. + - `scope_basis`: `REQUEST.md` asks for the most parsimonious provable + abstraction satisfying R4. + - `dependencies`: R4. +- **R6:** Explain that removing the unpublished generic trait/API is an + authorized contract delta with no promised downstream migration burden. + - `scope_basis`: `REQUEST.md` expressly permits this contract and + representation change. + - `dependencies`: R4, R5. +- **R7:** Keep the redesign conditional and require implementation plus fresh + audit; do not use it to narrow or alter R3. + - `scope_basis`: `REQUEST.md` requires the current verdict and post-change + audit independently. + - `dependencies`: R3, R5. + +Merely making the trait unsafe does not pass R5 because it preserves an +unneeded caller implementation capability. + +## Hard errors + +- **RH1:** Trust `Tail` as the only safe implementation. +- **RH2:** Treat safe-trait prose as a caller obligation. +- **RH3:** Call the current API sound or merely `UNPROVED` after closing R2. +- **RH4:** Certify an unimplemented redesign. +- **RH5:** Let design intent narrow the current contract. + +## Checked authority + +- Rust 1.82.0 Reference, public visibility: + `https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy` + — public items are accessible from outside their module, subject to the + containing path; every item here is at the public crate root. +- Rust 1.82.0 Reference, trait implementations and coherence: + `https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations` + — a trait implementation may be defined when the implementing type is local, + so a downstream crate may define local `Bad` and implement `Slot` for it. +- Rust 1.82.0 Reference, unsafe traits: + `https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits` + — unsafe traits are explicitly declared with `unsafe`; the supplied `Slot` + declaration is an ordinary safe trait and its implementation requires no + unsafe act. +- Rust 1.82.0 Reference, unsafe functions: + `https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn` + — the caller-side unsafe obligation attaches to an `unsafe fn`; the supplied + public `increment` is an ordinary safe function. +- Rust 1.82.0 slice `get_unchecked_mut`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut` + — the index must be in bounds; an out-of-bounds call is UB even if its result + is unused. +- Rust 1.82.0 `u32::wrapping_add`: + `https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add` + — modular wrapping addition supplies the requested update semantics. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/allowlist.txt new file mode 100644 index 0000000000..6852f5fd70 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/allowlist.txt @@ -0,0 +1,6 @@ +https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy +https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations +https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits +https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut +https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/A.md new file mode 100644 index 0000000000..defb37885d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/A.md @@ -0,0 +1,62 @@ +# Focused literal audit and redesign + +## Claim, domain, and verdicts + +**Snapshot and scope.** This reviews exactly the supplied `target/lib.rs`: `Slot`, `Tail`, its `Slot` implementation, `increment`, and the one `get_unchecked_mut` call. `Required(c)` is exactly: `c` uses Rust and standard library 1.82.0, is any target on which this exact source and its used 1.82.0 standard-library items exist, and uses any ordinary profile. There are no dependencies, `cfg`s, features, generated artifacts, macros, FFI, concurrency, allocators, or other source-level configuration branches. + +**Soundness theorem.** Every well-typed safe call to the public safe API must be free of Rust undefined behavior, without an undocumented caller or implementer safety condition. + +**Verdict: UNSOUND.** The current public generic `increment` has a valid entirely-safe downstream use that necessarily calls `get_unchecked_mut` out of bounds. This verdict is independent of the redesign below. + +**Required `Tail` behavior: PROVED.** For every `c` in `Required` and every initial `pair`, `increment::` returns with element 0 unchanged and element 1 equal to its old value plus one modulo `2^32`. This user-required behavior is not documentation found in `lib.rs`; it is an explicit review requirement. + +**Trust boundary `TCB-R182`.** No additional TCB assumptions are admitted. The only semantic premises are the exact Rust 1.82.0 Reference and standard-library contracts cited below. No compiler-binary, platform-implementation, test, or tool result is trusted. + +## Boundary and obligation coverage + +The complete relevant surface is: public safe trait `Slot`; its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `impl Slot for Tail`; public safe generic function `increment`; and its private unsafe operation. There are no unsafe declarations, fields, constructors with state, callbacks other than caller-selected `Slot` implementations, hidden items, or generated surfaces. There is no owned invariant: `S::index() < 2` is merely the missing proposition consumed by the unsafe call. + +The [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) say a `pub` item is accessible externally and associated items in a public trait are public by default. Under the [orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), a downstream crate may implement a foreign trait for its own local type. `Slot` does not use `unsafe trait`; the [unsafe-trait rule](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits) reserves the implementer-side unsafe obligation for traits whose declaration begins with `unsafe`. + +### UNSOUND certificate + +A downstream crate can write only safe Rust: + +```rust +use audited_crate::{increment, Slot}; + +struct OutOfBounds; +impl Slot for OutOfBounds { + fn index() -> usize { 2 } +} + +let mut pair = [0u32; 2]; +increment::(&mut pair); +``` + +1. **Valid use:** Both imported items are public; `OutOfBounds` is local, so its safe `Slot` implementation is coherent. Neither the implementation nor `increment` requires an `unsafe` context or documents a safety obligation. +2. **Reachability:** `increment` unconditionally evaluates `S::index()` and passes the result, `2`, to `pair.get_unchecked_mut`. +3. **False required proposition:** `pair` has exactly two elements, so valid element indices are `0` and `1`; `2` is out of bounds. +4. **UB consequence:** Rust 1.82 documents for [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut): “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” UB therefore occurs at the call itself. + +This certificate applies parametrically on every `c` in `Required`: the source has no target/profile selection and the cited 1.82 contract is the same premise for the whole requested target/profile predicate. The UB-containing witness does not establish a separate `CONTRACT-BROKEN` result. + +For `Tail`, `index()` is locally fixed at `1`; `1 < 2`, so the unchecked call returns a mutable reference to element 1. The assignment touches only that element, and Rust 1.82 [`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) specifies modular addition. Thus `Covered_Tail = Required` and `Required ⊆ Covered_Tail`. The same derivation is profile- and target-parametric. + +The unsafe block has no adjacent `SAFETY` proof. A valid local proof can be reconstructed only for `S = Tail`; it cannot prove the universal generic call. Adding a comment or prose requirement to this safe trait would not repair the implementation defect. + +## Preferred design + +Replace the generic abstraction with the exact required capability, using only safe operations: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its safe contract is: for every input, return with element 0 unchanged and element 1 equal to its prior value plus one modulo `2^32`; there are no caller safety preconditions. The array type establishes length two, literal index `1` supplies the bounds fact at the use site, and safe indexing enforces it. There is no representation invariant, unsafe surface, implementer capability, or additional TCB premise. + +This is preferable to sealing or making `Slot` unsafe because no required polymorphism remains. Remove `Slot`, its implementations, and `Tail` if it has no independent nominal purpose; change `increment` to the non-generic signature above. Migrate `increment::(&mut pair)` to `increment(&mut pair)` and delete trait bounds/implementations. Downstream `Slot` implementations and generic calls intentionally cease to be supported, as authorized for this unreleased abstraction. + +This is a design proposal, not a verdict for a new artifact. After implementation, audit the exact new snapshot: enumerate its exported surface and all callers/documentation; confirm the intended removals; prove both-element postconditions for all inputs; confirm no conditional/generated variants; and re-establish `Required ⊆ Covered` for the same Rust/target/profile predicate. Re-audit on any source, contract, Rust version, target/profile-support, or generation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/B.md new file mode 100644 index 0000000000..401f6ef712 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/B.md @@ -0,0 +1,71 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and results + +**Snapshot.** The artifact is exactly the supplied `lib.rs`; there are no other target sources, dependencies, generated artifacts, `cfg` branches, build scripts, macros, FFI, or prior results. Audit cutoff: 2026-08-01. Source-level Rust abstract semantics only. + +Let `E` be the request's exact set of targets “on which this exact source and its used Rust 1.82.0 standard-library items exist,” and `P` its symbolic set of ordinary profiles. `Required` contains every well-typed safe use of every language-reachable safe surface, with every input/state/execution, for `(Rust, target, profile) in {1.82.0} × E × P`. Thus `Required_cfg = {1.82.0} × E × P`. This is an exact restatement, not an enumeration. The source has no selection mechanism, and the proof below is parametric in `E` and `P`: target and profile cannot change the constants `2` and `1`, trait openness, or the specified operations. There are no exclusions. + +- **Safe-API soundness: UNSOUND.** A valid safe downstream implementation can return an out-of-bounds index and make `increment` execute documented undefined behavior. This certificate is independent of the redesign. +- **Requested `Tail` behavior: PROVED.** For every input array and required configuration, `increment::` returns with element 0 unchanged and element 1 equal to its old value plus one modulo `2^32`, without UB. +- **Combined current-artifact result: UNSOUND.** The positive `Tail` result does not repair the universally quantified public safe API. + +No additional robustness or documented unsafe-API postcondition is in scope. + +## Boundary and obligation inventory + +All surfaces are public and safe: `Slot`; its associated function `index`; public unit type/constructor `Tail`; its `Slot` implementation; and generic free function `increment`. The sole unsafe site is `pair.get_unchecked_mut(S::index())`. There are no fields, unsafe declarations/impls, named representation invariants, destructors, callbacks after index selection, or hidden/generated surfaces. `S::index()` may also panic; that exits before the unsafe call and before mutation. + +The Rust 1.82 authority set (TCB `R82-A`, no admitted non-Rust assumptions) is: + +- `AX-PUBLIC/IMPL`: public accessibility and trait-implementation/coherence rules. A downstream crate may name this public trait and implement it for its own local type; the local self type satisfies the orphan rule. [Visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy), [trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations). +- `AX-SAFE-BOUNDARY`: unsafe traits and functions require their respective `unsafe` declarations/obligations. Here `Slot` is not an unsafe trait and `increment` is not an unsafe function, so neither implementation nor call carries a caller safety obligation. [Unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), [unsafe functions](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn). +- `AX-GET`: Rust 1.82 documents for `get_unchecked_mut`: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” [Slice method](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut). +- `AX-WRAP`: `u32::wrapping_add` performs modular addition, wrapping at the type boundary. [Integer method](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add). + +No dependency or tool result is consumed. Re-audit `R82-A` if any cited Rust 1.82 text is corrected materially. + +| ID | Exact obligation | Disposition | +|---|---|---| +| O1 | At every executed `get_unchecked_mut(i)`, `i < 2`. | **False** for the public generic safe API; existential certificate below. | +| O2 | For `Tail`, establish O1 and the requested state transition. | **Proved:** `Tail::index()` unconditionally returns `1`; `1 < 2`; `AX-GET` therefore admits the returned reference to element 1. Assignment touches only that element. `AX-WRAP` gives the exact modulo-`2^32` result, including `u32::MAX -> 0`. | +| O3 | Existing adjacent proof explains the unsafe call. | **Deficient:** there is no `SAFETY` comment, and no sound derivation exists for arbitrary `S`. | + +For O2, the same source and argument cover every input fiber and every `(target, profile) in E × P`; no premise is configuration-specific. Hence the requested `Tail` domain is contained in its covered domain. + +## F-1 — safe generic API reaches UB + +Severity/classification: **UNSOUND implementation defect**, plus missing proof documentation. + +**Valid safe witness:** in a downstream crate, entirely safe Rust may write: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } +let mut pair = [0_u32; 2]; +increment::(&mut pair); +``` + +`Bad` is downstream-local, so `AX-PUBLIC/IMPL` permits the implementation. Neither boundary is unsafe (`AX-SAFE-BOUNDARY`), and the current API documents no precondition; this is therefore a valid in-scope safe use. + +**Reachability and falsity:** monomorphization calls `Bad::index()`, which returns `2`, then executes `get_unchecked_mut(2)` on the two-element receiver. Its valid element indices are `0` and `1`, so `2` is out of bounds. **UB consequence:** `AX-GET` states that the call itself is UB even before the reference is used. This completes every existential link on every required configuration and establishes `UNSOUND`; it is not merely a missing universal proof. The execution cannot separately witness `CONTRACT-BROKEN` because it contains UB. No generic behavioral postcondition was documented. + +Minimum repair of the current generic design would require checking the index before any unchecked access (and defining the failure behavior), or making/sealing an implementer contract and auditing every implementation. Neither complexity serves the stated requirement. + +## Preferred provable abstraction + +Specialize to the only required capability and remove unsafe code, the trait, the marker type, and genericity: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +**Proposed contract:** this is a safe function with no precondition beyond its type. On normal return, `pair[0] == old(pair[0])` and `pair[1] == old(pair[1]).wrapping_add(1)`; it returns `()`. The fixed array type makes index 1 in bounds. Safe indexing enforces its own bounds in any event, and `AX-WRAP` supplies the required arithmetic. There is no unsafe surface, implementer promise, or representation invariant. Retaining `Tail` would add nominal machinery without supplying a required capability. + +**Migration delta:** remove public `Slot` and `Tail`; change `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` impls and generic invocations cease to compile. The request expressly authorizes all of these unreleased contract/representation breaks. The wrapping result and mutation of element 1 are unchanged for the required case. + +**Fresh audit after implementation:** treat it as a new snapshot. Verify the exact exported surface and removal of old implementations/callers; prove both element postconditions for all `u32` values (especially `u32::MAX`); recheck the safe indexing and wrapping contracts against Rust 1.82; repeat the symbolic `E × P` configuration-closure argument; inventory any newly introduced code/generation; and confirm there is no remaining unsafe site. The proposal itself has no artifact verdict. + +Residual scope is exactly what the request excludes: other Rust releases, targets outside `E`, nonordinary configurations, binaries/backend correctness, and behavior of the intentionally removed generic API. Re-audit on source/API changes, support-domain changes, or material changes to the cited Rust 1.82 contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/C.md new file mode 100644 index 0000000000..82fb421517 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/C.md @@ -0,0 +1,72 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and verdicts + +**Snapshot.** The complete supplied `lib.rs` (lines 1–18), with no generated artifacts or third-party dependencies in scope. Audit cutoff: 2026-08-01. + +Let `T` be exactly “every target on which this exact source and its used Rust 1.82.0 standard-library items exist,” and `P` exactly “every ordinary profile.” `Required(case)` is the given source, Rust/compiler/stdlib 1.82.0, target in `T`, profile in `P`, every input/state/type and execution of every well-typed safe use of its public safe surfaces. The separately required behavioral domain is every valid `&mut [u32; 2]` passed to `increment::`. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every required safe use is free of Rust UB | **UNSOUND** | `F-UB` below gives a valid safe use, reaches `get_unchecked_mut`, falsifies its bounds requirement, and the applicable Rust 1.82.0 contract expressly entails UB. | +| For initial `[a,b]`, `increment::` returns with `[a, b.wrapping_add(1)]` | **PROVED** | `P-TAIL` covers every `a,b: u32`, target in `T`, and profile in `P`. | +| Existing local unsafe-proof documentation | **DEFICIENT** | The unsafe block has no adjacent `SAFETY` proof, and its needed universal premise is false. | + +The redesign below does not participate in these current-artifact verdicts. + +## Boundary and obligation inventory + +All language-reachable surfaces are: public safe trait `Slot` and its public safe associated function `index` (3–5); public unit struct and constructor `Tail` (7); its safe `Slot` implementation (9–13); and public safe generic function `increment` (15–18). There are no unsafe declarations, fields, macros, callbacks, FFI, concurrency, allocation, generated code, `cfg`, or configuration-selected paths. The sole unsafe operation is `pair.get_unchecked_mut(S::index())` (16); its result is consumed by wrapping addition and assignment (17). The only proposed invariant—`S::index() < 2` for every `S: Slot`—has no owner or enforcement boundary and is false. + +The source is identical across the symbolic `T × P` domain. Its explicit `wrapping_add` is profile-independent; no target fact, layout, panic strategy, or code-generation premise enters either certificate. Thus the proofs below are parametric over every configuration fiber, not sampled. No build or test evidence was used. + +## Checked Rust 1.82.0 axioms + +TCB `R82-AUTH-1` contains only these exact authoritative Rust 1.82.0 propositions; there are no additional assumptions. + +- `AX-VIS`: a `pub` item is accessible externally, subject to accessible ancestors ([Reference](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). +- `AX-IMPL`: a trait implementation is valid under the orphan rules when the implementing type is local; unsafe traits require `unsafe impl` ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). Rust describes an unsafe trait as one whose implementation may be unsafe and whose impl must use `unsafe` ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). `Slot` is not declared unsafe. +- `AX-BOUNDARY`: extra unchecked safety conditions belong on `unsafe fn`; an unsafe block asserts that all called-operation obligations were discharged ([unsafe functions and blocks](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). `increment` is a safe `fn`. +- `AX-GET`: `get_unchecked_mut` returns the selected mutable element without checking bounds, and: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” ([standard library](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). +- `AX-WRAP`: `u32::wrapping_add` performs modular addition, wrapping at the type boundary ([standard library](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). + +## Proofs and finding + +### F-UB — caller-controlled safe trait breaks the unchecked access + +A downstream crate may write the entirely safe witness: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +Validity: `Slot` and `increment` are public (`AX-VIS`); `Bad` is local to that downstream crate, satisfying the orphan alternative in `AX-IMPL`; neither the impl nor call accepts an unsafe obligation (`AX-IMPL`, `AX-BOUNDARY`). Reachability: `Bad::index()` returns 2, after which line 16 necessarily calls `get_unchecked_mut(2)` on the two-element array viewed as a length-two slice. False proposition: valid indices are below 2, so 2 is out of bounds. Consequence: `AX-GET` directly classifies that executed call as UB, even before line 17 uses the reference. The witness uses only values representable wherever this source exists, so it applies throughout `T × P`. This completes the existential `UNSOUND` certificate. There is no UB-free postcondition counterexample in scope from this witness. + +The smallest current implementation resolution is to stop passing unchecked memory-safety authority through a caller-controlled safe trait. Documentation alone cannot repair the safe API. + +### P-TAIL — required crate-owned behavior + +For arbitrary initial `[a,b]`, the inspected `Tail::index` returns 1. Since `1 < 2`, line 16 satisfies `AX-GET` and obtains the unique mutable reference to element 1. Line 17 computes `b + 1` modulo the `u32` range by `AX-WRAP` and stores it through that reference; element 0 is not accessed or assigned. Hence normal return yields exactly `[a, b.wrapping_add(1)]`. These source facts and axioms are independent of target and ordinary profile, so `Required_tail ⊆ Covered_tail` over all `T × P`. + +## Preferred provable abstraction + +Specialize to the sole required operation and remove both the implementer boundary and unsafe code: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +**Contract.** This safe function has no caller safety precondition beyond a valid exclusive array reference. For every initial `[a,b]`, it returns `[a, b.wrapping_add(1)]`. The fixed array type supplies length two, constant index 1 is in bounds, and the only arithmetic uses the documented modular operation. No representation invariant, unsafe implementer promise, or extra TCB entry remains. + +**Migration delta.** Delete public `Slot`, `Tail`, their impl, and the generic parameter. Change crate-owned calls from `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` impls and generic calls cease to compile; the request expressly authorizes that break because the abstraction is unreleased and only the Tail operation must survive. The observable required mutation is unchanged. + +**Fresh audit after implementation.** Treat the edit as a new snapshot. Re-inventory exports and all call sites; verify the exact implementation and any documentation; prove constant index 1 is in bounds for `[u32; 2]`, the wrapping postcondition, unchanged element 0, and absence of alternate exits for every `T × P` case; rescan conditional/generated surfaces and residual unsafe code. Any source, API contract, Rust version, target/profile policy, or generated/build input change triggers re-audit. No verdict is assigned to the unimplemented proposal. + +## Residual scope + +No broader safe-API behavior, binary/backend correctness, other source, or future version is claimed. Source execution, building, testing, and macro expansion were excluded by instruction and supply no premise. No authoritative-documentation or skill-guidance gap blocked either certificate. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/D.md new file mode 100644 index 0000000000..34ec4b57e7 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/D.md @@ -0,0 +1,76 @@ +# Focused literal audit and redesign + +## Claim, domain, and results + +**Current-artifact soundness: `UNSOUND`.** For the complete supplied `lib.rs`, a well-typed entirely safe downstream use reaches undefined behavior. This verdict is independent of the redesign below. + +**Requested `Tail` behavior: `PROVED`.** For every initial `pair = [a, b]`, `increment::(&mut pair)` returns normally with `[a, b.wrapping_add(1)]`. This is a user-requested robustness result, not a documented current-API postcondition. + +There are no documented postconditions or unsafe public APIs, so no `CONTRACT-BROKEN` claim applies. + +Let `T` be exactly the targets on which this source and its used Rust 1.82.0 standard-library items exist, and `P` every ordinary profile. A required case is + +`Required(source, rust, target, profile, S, pair, execution) := source = supplied lib.rs ∧ rust = 1.82.0 ∧ target ∈ T ∧ profile ∈ P ∧ the call is a well-typed safe use`. + +Thus `Required_cfg = {1.82.0} × T × P`. This is the request's predicate verbatim, not a finite target inventory. The source has no `cfg`, features, dependencies, generators, FFI, assembly, concurrency, allocation, or profile-sensitive operation. The proofs and counterexample below are parametric in `target ∈ T` and `profile ∈ P`; optimization, overflow-check, panic-strategy, and debug-assertion differences do not alter them. Audit cutoff: 2026-08-01. + +## Boundary and obligation inventory + +The complete language-reachable crate-owned surfaces are: public safe trait `Slot` and its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `Slot for Tail` implementation; and public safe generic function `increment`. The sole unsafe operation is `pair.get_unchecked_mut(S::index())`. `wrapping_add` and assignment are safe. There are no fields, constructors beyond the unit-struct expression, macros, hidden items, callbacks, or explicit unsafe declarations. No enforced invariant constrains implementations of `Slot` or their returned index. + +| ID | Obligation | Disposition | +|---|---|---| +| O1 | Every safe call to `increment` must pass an in-bounds index to `get_unchecked_mut`. | **Refuted; F1.** | +| O2 | For `Tail`, the selected index is in bounds for `[u32; 2]`. | `Tail::index()` is source-constant `1`; valid indices are `0,1`. **Proved** for all required configurations. | +| O3 | The requested normal result for `Tail` is `[a, b+1 mod 2^32]`. | O2 makes the returned reference designate element 1; assignment changes that element only; `wrapping_add(1)` supplies the modular value. **Proved**. | +| O4 | Every required configuration reaches the reviewed source and the same material semantics. | Exact source only, with no selectors or generated stages; O1–O3 are target/profile-parametric. **Proved**. | + +## F1 — safe trait implementation causes out-of-bounds unchecked access + +Severity/classification: **UNSOUND implementation defect; missing local proof artifact.** The unsafe block has no adjacent `SAFETY` proof, but documentation alone cannot repair the false premise. + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +Certificate: + +1. **Valid in-scope use.** `Slot` and `increment` are public at crate root. `Slot` is a safe trait and states no behavioral contract. The Rust 1.82 orphan rule permits this implementation because `Bad` is local to the downstream crate; its relevant clause is “At least one of the types `T0..=Tn` must be a local type.” There are no uncovered type parameters. The call is to a safe function and uses no unsafe operation at the call site. ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy), [trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), [unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)) +2. **Reachability.** `Bad::index()` returns `2`; `increment` unconditionally calls `get_unchecked_mut(2)` on the borrowed `[u32; 2]`. +3. **False safety proposition.** Index `2` is outside the two-element array's index set `{0,1}`. +4. **UB consequence.** Rust 1.82 documents: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)) + +This witness works for every `target ∈ T` and ordinary profile. One valid required execution suffices to refute universal safe-API soundness. No UB-free postcondition refutation is needed or claimed. + +## Authority and trust + +TCB revision `TCB-0` contains only the exact Rust 1.82 Reference/std propositions cited above and the `u32` contract: “Wrapping (modular) addition. Computes `self + rhs`, wrapping around at the boundary of the type.” ([`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)) These are version-matched Rust axioms, not additional assumptions. There are no dependencies, tool results, prior audits, external specifications, implementation claims, or deployment assumptions. Review was source-only; nothing was built, executed, tested, or expanded. + +## Preferred design + +Remove `Slot` and the generic free function. Retain the crate-owned name as one safe inherent operation: + +```rust +pub struct Tail; + +impl Tail { + pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); + } +} +``` + +Proposed contract: for every `[a,b]`, `Tail::increment` has no caller safety precondition, returns normally, leaves element 0 equal to `a`, and sets element 1 to `b + 1 mod 2^32`. The fixed array type makes index `1` locally in bounds; ordinary checked indexing removes all unsafe code, implementer promises, invariants, and additional TCB premises. + +Migration is intentionally source-breaking but authorized for this unreleased abstraction: replace `increment::(&mut x)` with `Tail::increment(&mut x)`; remove downstream `Slot` implementations and generic calls, which the requirement expressly does not preserve. The required `Tail` behavior is unchanged. Do not regard this sketch as audited or `PROVED`. + +After implementation, audit the new snapshot afresh: verify the actual visibility/reexports and absence of generated or conditional alternatives; inventory every remaining safe/unsafe surface; prove index `1` is in bounds from `[u32;2]`; prove normal return, element-0 preservation, and wrapping element-1 update for every input, target in `T`, and ordinary profile; reconcile the final documentation with that contract; and repeat the configuration/TCB closure if source, support policy, dependencies, or Rust version changes. + +Residual scope: binary/backend correctness, nonordinary profiles, other Rust releases, unavailable targets/items, performance, and APIs other than the supplied source are excluded by the request. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/E.md new file mode 100644 index 0000000000..cdd419fac4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/E.md @@ -0,0 +1,76 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +**Snapshot.** Exactly the supplied 18-line `target/lib.rs`, audited as source under Rust and standard-library 1.82.0 abstract semantics. No generated source, dependencies, build machinery, features, `cfg`, FFI, assembly, allocator choice, concurrency, or prior audit appears in the supplied artifact. Nothing was executed or expanded. + +Let `E` be exactly the targets named by the request: targets on which this source and its used Rust 1.82.0 standard-library items exist. Let `P` be every ordinary profile. Then + +`Required_cfg = {Rust 1.82.0} × E × P`. + +For soundness, `Required` additionally quantifies over every well-typed safe call, every valid `&mut [u32; 2]`, every caller-provided `S: Slot`, and every permitted execution. For the requested behavior, `Required_Tail` is every call with `S = Tail` and every initial array. The source has no configuration selector, and neither proof below consumes target- or profile-specific facts; both are parametric over `E × P`. Thus no finite target/profile inventory is asserted or needed. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every valid safe use of the current public API is UB-free | **UNSOUND** | Witness `W1` below is valid, reaches the unsafe operation, falsifies its exact precondition, and the Rust 1.82 contract says the call is UB. | +| `increment::` increments element 1 modulo `2^32` and leaves element 0 unchanged | **PROVED** | `TAIL-PROOF` below covers all `Required_Tail`. | + +The current-artifact soundness verdict is independent of the proposal. + +## Boundary and obligation inventory + +The complete language-reachable surface in this source is: public safe trait `Slot` and its required safe associated function `index` (lines 3–5); constructible public unit struct `Tail` (line 7); safe `Slot for Tail` implementation returning `1` (lines 9–13); and public safe generic function `increment` (lines 15–18). There are no fields, inherent methods, macros, hidden items, callbacks, unsafe declarations/traits/impls, or destructors in the artifact. + +The sole unsafe operation is `pair.get_unchecked_mut(S::index())` (line 16). Its obligation is `S::index() < pair.len() = 2` at the call. There is no enforced invariant or check supplying that fact. The subsequent operation (line 17) must write the referenced element's old value plus one with wrapping arithmetic. The unsafe block has no adjacent `SAFETY` proof; that proof artifact is missing independently of implementation correctness. + +### `W1`: existential UB certificate + +Downstream safe code can write: + +```rust +struct Outside; +impl Slot for Outside { fn index() -> usize { 2 } } +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +1. `Slot` and `increment` are `pub`; Rust 1.82 says a `pub` item is accessible outside, and associated items of a public trait are public by default ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). +2. `Outside` is local to the downstream crate, so this implementation satisfies the orphan-rule alternative requiring a local implementing type. It defines the sole required item ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). `Slot` is not `unsafe`; only an unsafe trait establishes compiler-recognized extra implementation safety conditions and requires `unsafe impl` ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), [unsafe keyword](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). The source documents no behavioral restriction. Therefore returning `2` is a valid safe implementation and the entire witness contains no caller-side `unsafe`. +3. The safe generic call reaches line 16; `S::index()` returns `2`. A two-element array has length `2`, so `2` is out of bounds. +4. Rust 1.82 states: “Calling this method with an out-of-bounds index is undefined behavior” even if the reference is unused ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). + +This same source-level witness applies for each `E × P`; one witness suffices to refute the universal claim. A comment cannot repair it. The minimum current-shape repairs would enforce the bound, seal/control every implementation, or create an honest unsafe implementer boundary. The requested specialization makes all three unnecessary. + +### `TAIL-PROOF`: requested current behavior + +For `Tail`, the inspected implementation returns `1`. Since `1 < 2`, line 16 satisfies the only stated safety condition and returns a mutable reference to element 1. Line 17 reads and writes only through that reference, so element 0 is unchanged. Rust 1.82 defines `wrapping_add(1)` as modular addition that wraps at the type boundary ([`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Therefore element 1 becomes `(old element 1 + 1) mod 2^32` for every input. There are no alternative source paths. This reconstruction proves the `Tail` implementation obligation but does not cure the missing local proof or generic unsoundness. + +## Trust and evidence + +**TCB-R182/revision 1.** No additional assumption is admitted. The only consumed semantic premises are the exact Rust 1.82 authoritative propositions linked above: public accessibility, trait-implementation/orphan and unsafe-boundary rules, out-of-bounds `get_unchecked_mut` UB, and wrapping addition. Their scope is exactly Rust/std 1.82.0 and `E × P`; consumers are `W1` and `TAIL-PROOF`. All other premises are inspected local syntax or arithmetic. No dependency, tool result, external specification, implementation/backend assumption, deployment restriction, or probabilistic premise is consumed. Re-audit on any source/public-contract change, Rust/std version change, scope expansion, or material change to a cited proposition. + +## Preferred redesign + +The minimum required capability is one fixed operation, not caller-selected indexing. Retain nominal `Tail` only if that name is desired, remove `Slot`, remove genericity, and use safe indexing: + +```rust +pub struct Tail; + +impl Tail { + pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); + } +} +``` + +**Proposed contract.** For every valid `&mut [u32; 2]`, `Tail::increment` has no caller safety precondition, returns normally, leaves element 0 unchanged, and replaces element 1 by its old value plus one modulo `2^32`. It exposes no representation invariant and contains no unsafe operation or implementer obligation. + +**Why preferred.** It directly supplies the only required consumer proposition. A checked generic function would preserve unneeded variability; sealing would retain an unneeded trait; making `Slot` unsafe would export an unnecessary obligation. The proposal removes the false bound premise, unsafe block, generic consumer, and implementer surface rather than relocating their proofs. + +**Migration/contract delta.** Delete public `Slot`, its `Tail` impl, and `increment`. Change crate-owned calls from `increment::(&mut pair)` to `Tail::increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile, as expressly authorized; the abstraction is unreleased. The required `Tail` result is unchanged. + +**Fresh-audit status.** This is an unimplemented design, not a verdict on a new snapshot. After implementation, audit the exact source anew: enumerate its public surfaces; verify safe indexing selects element 1 and cannot panic for `[u32; 2]`; reprove wrapping arithmetic and nonmutation of element 0 on every exit; confirm no generated/configuration-dependent alternative; and re-establish parametric coverage of Rust 1.82.0 over `E × P`. No unsafe-code TCB entry or safety comment should remain. + +## Residual scope + +Repository history, manifests, packaging, downstream code, compiler/backend correctness, binaries, and any source other than the two supplied target files were neither provided nor part of this exact source-level claim. No whole-crate or later-snapshot verdict is implied. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/F.md new file mode 100644 index 0000000000..288ee57e72 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/F.md @@ -0,0 +1,70 @@ +# Focused unsafe-Rust audit and redesign + +## Claims and verdicts + +**Snapshot.** Exact supplied `lib.rs` (18 lines), reviewed without execution or expansion. Scope is Rust 1.82.0 and + +`Required = { (target, profile, use) | target admits this source and the used Rust 1.82.0 standard-library items; profile is ordinary; use is well-typed safe use of a language-reachable safe surface }`. + +There are no `cfg`s, macros, dependencies, generated artifacts, FFI, concurrency, allocator choices, or target-dependent operations in the supplied snapshot. The source contains no support-policy transformation: the request supplies the symbolic target set directly. Audit cutoff 2026-08-01 does not extend the fixed Rust release. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every safe use of the current public API is free of Rust UB over `Required`. | **UNSOUND** | F-1 gives a valid entirely-safe use, reaches `get_unchecked_mut(2)` on a length-2 slice, proves its bounds precondition false, and links that event to Rust 1.82.0's explicit UB consequence. The witness is target/profile-parametric. | +| For every initial `[a, b]`, `increment::` terminates with `[a, b.wrapping_add(1)]` without UB. | **PROVED** | P-TAIL below covers every `u32` pair and every required target/profile. | + +There is no documented unsafe public API postcondition. The request's `Tail` behavior is the only additional behavior claim. No `CONTRACT-BROKEN` verdict applies: F-1's execution contains UB, while the independently reviewed `Tail` behavior holds. + +## Boundary, invariants, and obligation ledger + +The complete relevant language-reachable surface is: public safe trait `Slot` and safe associated function `Slot::index` (`lib.rs:3-5`); public unit struct and constructor `Tail` (`:7`); its safe trait implementation (`:9-13`); and safe generic function `increment` (`:15-18`). There are no fields, derives, reexports, hidden items, exported macros, or other manual implementations. Compiler-supplied auto-trait/drop behavior carries no state and is not consumed by the unsafe block. + +The unsafe operation needs `BOUND(S): S::index() < 2`. No type, check, privacy boundary, trait contract, or invariant establishes `BOUND` for arbitrary `S`. `Slot` is public and safe. Rust 1.82.0's [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) make the root `pub` surfaces externally reachable, and its [trait-implementation/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) permit another crate to implement this trait for its own local type. + +| ID | Obligation | Status | +|---|---|---| +| O-BOUND | At `:16`, the `usize` index must be in `0..2`. | **False** for a valid implementation returning 2; proved for `Tail` because `Tail::index()` is exactly 1. | +| O-SAFE | Safe `increment` must discharge O-BOUND for every safe `S: Slot`. | **Refuted** by F-1. | +| O-TAIL | The in-bounds mutable reference denotes element 1; the write preserves element 0 and stores modular `b + 1`. | **Proved** by P-TAIL. | +| O-CONFIG | Cover all requested targets/profiles. | Control flow, array length, constants, and the exact Rust 1.82.0 contracts are invariant across the symbolic availability set; thus P-TAIL covers it, and F-1 works in every member. | + +### P-TAIL + +For `S = Tail`, source fixes `S::index()` to 1. An array `[u32; 2]` has length 2, so 1 is in bounds. Rust 1.82.0 documents that [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) returns a mutable reference to the selected element without checking bounds and states: “Calling this method with an out-of-bounds index is undefined behavior.” Here that forbidden condition is false. The exclusive array borrow supplies the access for the returned reference, and no intervening call occurs. Rust 1.82.0 documents [`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) as computing addition “wrapping around at the boundary of the type.” Therefore the sole write changes element 1 from `b` to modular `b + 1`; element 0 remains `a`. + +## F-1 — safe implementer selects an out-of-bounds slot + +**Implementation: UNSOUND. Proof artifact: missing and not repairable under the current safe contract.** A downstream crate can write, with `audited_crate` denoting this crate: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +This contains no unsafe operation or unmet caller obligation. The ordinary impl is legal for the downstream-local `Bad`; `Slot` imposes no safety condition. `increment` is also safe. Its call to `Bad::index()` returns 2, so line 16 executes `pair.get_unchecked_mut(2)` after array-to-slice method resolution with length 2. Thus the exact required proposition `2 < 2` is false. The linked Rust 1.82.0 standard-library contract says the call itself is UB even if its resulting reference is never used. This completes the existential certificate; it is not merely a missing universal proof. + +The absent adjacent `SAFETY` comment is independently deficient. No truthful comment can derive O-BOUND for arbitrary safe implementations. Minimum repair is to enforce the bound or remove this generic unsafe path; changing prose alone cannot add a hidden precondition to safe callers or implementers. + +## TCB and evidence + +`TCB-R033` contains only the exact Rust 1.82.0 Reference/std axioms linked above: public reachability and legal local-type trait implementation, `get_unchecked_mut`'s return/bounds contract, and `wrapping_add`'s modular result. They are the controlling authorities selected by the request, not additional assumptions. No dependency, tool result, implementation behavior, compatibility premise, test, or deployment restriction is consumed. + +## Preferred redesign + +Delete `Slot`, its impl, the marker `Tail`, the type parameter, and the unsafe operation. The stated behavior needs only a concrete safe function: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract is: no caller safety preconditions; on normal return, initial `[a, b]` becomes `[a, b.wrapping_add(1)]`. The fixed array type and constant index make the access locally checkable, while safe indexing removes the unsafe contract entirely. Keeping `Tail` as an associated-function namespace is possible but adds surface without supplying required capability. + +This intentionally breaks source compatibility: `increment::(&mut pair)` migrates to `increment(&mut pair)`; `Slot` implementations and other generic instantiations disappear. The request authorizes that delta because the abstraction is unreleased and those uses need not survive. + +The proposal is not a new verdict. After implementation, freshly audit the exact new snapshot: public surface and migrated in-scope callers, the fixed index/array-length argument, the wrapping postcondition for every `u32`, absence of unsafe or callback-selected indexing, and Rust-1.82 target/profile closure. Re-audit on source/API changes, reintroduced generic dispatch or unsafe code, new configurations/generated code, or a change to the consumed Rust contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/G.md new file mode 100644 index 0000000000..361bf9ba55 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/G.md @@ -0,0 +1,87 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +**Snapshot.** Exactly the supplied `lib.rs`; no expansion or generated artifact. Scope is Rust and standard library 1.82.0, every target on which this source and the used items exist, and every ordinary profile. Audit cutoff: 2026-08-01. There are no dependencies, features, `cfg`s, build scripts, FFI, assembly, concurrency, allocators, or additional TCB assumptions. + +**Current safe-API soundness: UNSOUND.** A well-typed safe downstream implementation of `Slot` can return `2`; `increment` then executes `get_unchecked_mut(2)` on a two-element array. Rust 1.82 documents that an out-of-bounds call is undefined behavior even if the reference is unused. + +**Required `Tail` behavior: PROVED.** For every initial `[a, b]`, `increment::` returns with `[a, b.wrapping_add(1)]`, and this execution is free of undefined behavior. This regional result does not alter the whole safe-API verdict. + +**Combined current-artifact result: UNSOUND.** The source documents no other postcondition. The `Tail` behavior is included because `REQUEST.md` expressly requires it. + +## Exact domain and configuration closure + +Let a case be `(t, p, S, pair, execution)`. `Required` means: this exact source; Rust/std 1.82.0; `t` is any target on which the source and used items exist; `p` is any ordinary profile; `S` is any type satisfying the public safe bound `Slot`; `pair` is any valid `&mut [u32; 2]`; and the call is well-typed safe Rust. `Required_cfg(t,p)` is its Rust/target/profile projection. This is an equality-preserving transcription of the request, not a sampled inventory or inferred support promise. + +The source has one unconditional path and no generation or selection stage. Target/profile facts do not control the index, length, call, or library contracts used below. The counterexample is therefore parametric over every member of `Required_cfg`; one required case is already sufficient for `UNSOUND`. The `Tail` proof is likewise parametric over the full configuration projection and all `pair` values. No version-bridging premise is used. + +## Boundary, surfaces, and invariants + +- `Slot` and its safe associated function `index` are public; associated items in a public trait are public by default, and root-public items are externally accessible. [Rust 1.82 visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) +- A downstream crate can define local `Oob` and write `impl Slot for Oob`: the implementation supplies the sole required item, and the local implementing type satisfies the orphan rule. Only unsafe traits require `unsafe impl`; `Slot` is not declared unsafe. [Rust 1.82 trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) +- `Tail` is a public unit struct (including its constructor) with the crate-owned `Slot` implementation. `increment` is a public safe generic free function. Its unsafe block is the only unsafe operation. +- There are no fields, methods, other trait items/impls, callbacks, macros, hidden APIs, reexports, or invariant-bearing state. No abstraction invariant constrains caller implementations of `Slot`. + +## Authority/TCB log `TCB-1` + +There are no admitted non-authoritative premises. These checked Rust 1.82 axioms are the entire authority inventory: + +- **AX-ACCESS:** the visibility and implementation propositions stated above; consumers: witness validity and safe-surface inventory. +- **AX-GET:** `get_unchecked_mut` “returns a mutable reference to an element or subslice” without bounds checking, and calling it with an out-of-bounds index is UB even if unused. The page specifically identifies `len` as UB. Consumer: the unsafe-call obligation and `Tail` result. [Rust 1.82 slice contract](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) +- **AX-WRAP:** `wrapping_add` computes modular addition, wrapping at the type boundary. Consumer: the required value postcondition. [Rust 1.82 `u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) + +All apply exactly to Rust/std 1.82.0; changing that identity or any cited contract triggers review. + +## Obligation ledger and proofs + +**O1 — safe generic boundary.** Every safe call must establish `S::index() < 2` before the unsafe operation. Neither `S: Slot` nor any check establishes it. **Refuted; FIND-1.** + +**O2 — unsafe call for `Tail`.** `Tail::index()` returns literal `1`; `[u32; 2]` has length `2`; hence `1 < 2`. AX-GET then supplies a mutable reference to element 1. **PROVED** for all `Tail` cases. + +**O3 — update/postcondition for `Tail`.** The sole store is through that element-1 reference. AX-WRAP makes the stored value old element 1 plus one modulo the `u32` range; element 0 is not written. There is no alternative source path. **PROVED** for all initial arrays and configurations. + +**O4 — local proof artifact.** The unsafe block has no adjacent `SAFETY` proof. The reconstruction in O2 proves only `Tail`, not arbitrary `S`, so no truthful generic safety comment can repair the current implementation. **Deficient and implementation-unsound.** + +Aggregate positive coverage for the required `Tail` claim is `O2-covered ∩ O3-covered = Required_Tail`, establishing `Required_Tail ⊆ Covered_Tail`. Aggregate coverage for universal safe-API soundness fails at O1 and is existentially refuted below. + +## FIND-1 — safe implementer selects an out-of-bounds index + +**Status: UNSOUND; proof artifact missing.** Consider downstream safe code: + +```rust +struct Oob; +impl Slot for Oob { fn index() -> usize { 2 } } +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +**Valid use.** AX-ACCESS plus the source’s public, non-unsafe declarations make the implementation and call available without any caller-side unsafe obligation. The implementation defines the only required associated item and is coherent because `Oob` is local. + +**Reachability.** Monomorphization does not change the written control flow: `S::index()` returns `2`, which is passed directly to the executed `get_unchecked_mut` call before the store. + +**False safety proposition.** The array length is `2`, so the supplied index equals `len` and is out of bounds. + +**UB consequence.** AX-GET expressly makes that call UB even if its result is never used. Thus the whole execution witnesses soundness failure; it cannot witness a defined postcondition failure. No separate required postcondition is refuted. + +Minimum repair is to stop relying on an unenforced safe-implementer promise: validate the index, make and fully document an unsafe trait, effectively seal it, or remove the genericity. The stated requirements make removal preferable. + +## Preferred redesign (not a verdict on new code) + +Replace `Slot`, `Tail`, and generic `increment` with the specialized safe operation: + +```rust +pub fn increment_tail(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract has no safety precondition: for every valid input `[a,b]`, normal return produces `[a, b + 1 mod 2^32]`. The fixed array type and safe indexing enforce the only memory-selection fact; AX-WRAP supplies the arithmetic postcondition. It exposes no unsafe caller/implementer surface, owns no invariant, and needs no additional TCB premise. This is more parsimonious than sealing a trait whose only required implementation is fixed. + +**Migration/contract delta.** Remove the public `Slot` implementer contract, `Slot::index`, the nominal `Tail` constructor/implementation, and generic calls. Change the required internal call from `increment::(&mut pair)` to `increment_tail(&mut pair)`. Downstream implementations and generic calls intentionally cease to compile; the request authorizes that break and states the API is unreleased. The required observable behavior is unchanged. + +**Fresh audit after implementation.** Treat it as a new snapshot: re-inventory its actual visibility and all call sites; verify the safe element-selection semantics and AX-WRAP applicability on every requested target/profile; prove both elements’ post-state and all exits; confirm no conditional/generated alternative; and redo `Required ⊆ Covered`. This proposal itself is **not implemented and has no audit verdict**. + +## Evidence, residual scope, and triggers + +No target was built, run, tested, expanded, or tool-verified; none of those facts supports a conclusion. This is a source-level Rust-semantics audit, not a compiler-backend, binary, platform-implementation, performance, panic-freedom-beyond-the-required-case, or maximal-safe-subset claim. Re-audit on source/API/contract changes, Rust/std or support-domain changes, addition of configuration/generation/dependencies, or implementation of the redesign. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/H.md new file mode 100644 index 0000000000..43ad25268d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/H.md @@ -0,0 +1,73 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and verdicts + +**Snapshot.** Exact supplied `lib.rs`, lines 1–18; no generated artifacts, dependencies, conditional compilation, or build inputs are present in the supplied scope. Review was static only. Skill basis: supplied unsafe-Rust package. + +Let `D` be exactly: Rust compiler and standard library 1.82.0; every target on which this source and the used 1.82.0 standard-library items exist; every ordinary profile. This preserves the requester’s symbolic target predicate rather than inventing a finite target list. + +**SOUND-CURRENT — UNSOUND over `D`.** Claim: every well-typed safe use of the public surfaces `Slot`, `Tail`, and `increment` is free of Rust undefined behavior. Finding F1 gives a valid safe-use UB witness. It is target-, edition-, optimization-, overflow-check-, and panic-strategy-independent, so it refutes the claim in every case in `D`. No proposal below affects this verdict. + +**REQ-TAIL — PROVED over `D`.** For every initial `[a, b]: [u32; 2]`, `increment::` returns normally with `[a, b.wrapping_add(1)]` and no UB. This is the requester’s required crate-owned behavior, not an inferred documented guarantee of the otherwise undocumented current API. + +There are no documented unsafe-API postconditions: the crate declares no unsafe API. The requested Tail behavior is assessed separately above. + +## Boundary and obligation inventory + +All items are at crate root. `Slot` is a public **safe** trait; its required associated function `index` is public by default. `Tail` is a public unit struct, with a safe `Slot` implementation returning `1`. `increment` is a public safe generic function accepting every safe implementation satisfying the type bound. Its sole unsafe operation is `pair.get_unchecked_mut(S::index())`; the returned exclusive reference is then read via `wrapping_add(1)` and written. + +There is no representation invariant. The only needed local proposition is `S::index() < 2` at line 16. No type, validation, privacy boundary, or trait contract establishes it. The `unsafe` block has no adjacent safety proof. + +| ID | Obligation | Status | +|---|---|---| +| O1 | Every safe `Slot` implementation used with `increment` returns an index below 2. | False; F1 | +| O2 | At line 16, the unchecked index is in bounds. | False for F1; true for `Tail` | +| O3 | For `Tail`, only element 1 changes, to modular old-value-plus-one. | Proved below | +| O4 | `Required = D` is covered. | F1 and the Tail proof are parametric over all of `D` | + +## F1 — safe implementer controls an unchecked index + +**Implementation classification:** UNSOUND. **Proof artifact:** missing, and no correct proof exists for the current generic contract. + +A downstream crate can write entirely safe code equivalent to: + +```rust +struct OutOfBounds; +impl Slot for OutOfBounds { + fn index() -> usize { 2 } +} + +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +This is a valid in-scope use. Rust 1.82 says a `pub` item is externally accessible when its ancestor modules are accessible, and associated items in a public trait are public by default ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). The downstream implementing type is local there, satisfying the orphan rule’s local-type alternative ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). `Slot` is not an unsafe trait; Rust reserves `unsafe trait`/`unsafe impl` for extra implementer safety conditions ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). Thus neither defining the implementation nor calling `increment` requires an unsafe act or an undocumented obligation from this caller. + +The call reaches line 16 with a slice of length 2 and index 2. Rust 1.82 specifies that calling `get_unchecked_mut` with an out-of-bounds index is undefined behavior even if the resulting reference is unused ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). The false required proposition is `2 < 2`. The UB occurs at the call itself. Rust also states that an unsafe block asserts its operations’ extra safety conditions have been discharged; it does not impose them on callers of a containing safe function ([unsafe functions/blocks](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). This closes valid use → reachability → false safety condition → documented UB. + +No UB-free postcondition counterexample is needed or claimed. Minimum repair is to stop relying on an unenforced safe-implementer property: check the index, make and document an unsafe trait, effectively seal it, or remove the genericity. The last is preferred because only `Tail` is required. + +## Proof of REQ-TAIL + +`Tail::index()` is exactly `1`; `[u32; 2]` has length 2, hence `1 < 2`, satisfying the unchecked call’s complete stated bounds condition. The input `&mut` borrow supplies exclusive mutable access for the returned reference. Line 17 touches only that reference. Rust 1.82 defines `u32::wrapping_add` as modular addition wrapping at the type boundary ([`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Therefore element 0 remains `a`, element 1 becomes `b + 1 mod 2^32`, and no arithmetic profile branch arises. These facts and cited contracts apply uniformly to `D`, so `D ⊆ Covered`. + +## TCB log + +**TCB-R182-1:** only the five Rust 1.82 Reference/std propositions cited above are consumed as authoritative AXIOM entries; each was checked at its exact versioned allowlisted URL. There are no SAFE-DEP, UNSAFE-DEP, external, implementation, tool, deployment, compatibility, or probabilistic assumptions. Consumers: F1 and REQ-TAIL. Re-audit on source/API change, support-domain change, or material change to any cited Rust 1.82 contract. No tool-derived evidence or prior audit was used. + +## Recommended abstraction + +Replace `Slot`, `Tail`, and generic `increment` with the single safe operation the requirement needs: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + let tail = &mut pair[1]; + *tail = tail.wrapping_add(1); +} +``` + +Its proposed contract is: for every `[a, b]`, return `[a, b + 1 mod 2^32]`; it has no caller safety precondition. The fixed array type and constant index make the selected element locally checkable, safe indexing performs the bounds enforcement, and all unsafe code, implementer obligations, invariants, and generic proof fan-out disappear. A sealed marker would preserve unnecessary machinery; an unsafe trait would export an unnecessary unsafe obligation. + +**Migration delta.** Delete the public `Slot` trait and `Tail` type; change calls from `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile, expressly permitted because the abstraction is unreleased and they need not be preserved. The required observable Tail behavior is unchanged. + +This design is not implemented and has no audit verdict. After implementation, freshly audit the exact new snapshot: enumerate its resulting public surface and all call sites/reexports; prove constant index 1 is in bounds for `[u32; 2]`; prove the modular postcondition and that element 0 is unchanged; confirm no generated/configuration-specific alternate implementation; and re-establish `D ⊆ Covered`. Re-audit any change to the signature, array length, chosen index, arithmetic, visibility, support predicate, or cited contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/I.md new file mode 100644 index 0000000000..805e5fe938 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/I.md @@ -0,0 +1,55 @@ +# Focused literal audit and redesign + +## Claim, snapshot, and verdict + +The snapshot is exactly `target/lib.rs` as supplied. `Required` is Rust 1.82.0, every target on which this source and the used 1.82.0 standard-library items exist, every ordinary profile, and every well-typed safe use of the public API. There are no `cfg`s, features, dependencies, generated artifacts, macros, FFI, concurrency, allocator choices, or profile-sensitive arithmetic in the source. Thus the source, API, and proof obligations are identical throughout that symbolic target/profile domain; no finite target inventory is assumed. + +**Current-artifact soundness: UNSOUND.** A valid downstream safe implementation can supply an out-of-bounds index to the executed `get_unchecked_mut` call. The complete witness is below. This result is independent of the redesign. + +**Crate-owned Tail behavior: PROVED.** For every initial `pair == [a, b]` in `Required`, `increment::(&mut pair)` changes it to `[a, b.wrapping_add(1)]`. This is the separately requested behavioral subclaim, not a repair of the universal safe-API verdict. The source documents no API postcondition, so there is no additional documented-postcondition verdict. + +TCB `TCB-R003` contains only the exact Rust 1.82.0 Reference/std axioms cited below; there are no additional assumptions, dependencies, prior results, or tool-derived evidence. No source was built, executed, tested, or expanded. + +## Boundary, invariant, and obligation coverage + +The complete relevant surface is: public safe trait `Slot`; its public safe associated function `index`; public unit struct `Tail`; crate-owned safe `impl Slot for Tail`; public safe generic function `increment`; and its internal unsafe call at line 16. Public-trait associated items are public by default, and public items are externally accessible through accessible ancestors ([visibility authority](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy): “Associated items in a `pub` Trait are public by default”). A downstream crate may implement this trait for its own nominal type: the orphan rule permits an implementation when a participating type is local and the earlier uncovered-parameter restriction is met, vacuously here ([implementation authority](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). + +The needed generic invariant is `S::index() < 2` at line 16. Nothing owns or enforces it: `Slot` is neither private/sealed nor `unsafe`, `index` has no checked range type, and `increment` performs no check. Unsafe traits are the mechanism whose implementations accept extra safety conditions; they and their implementations require `unsafe` ([unsafe-trait authority](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). Here both implementation and call are ordinary safe Rust; `increment` exposes no caller safety contract. Rust 1.82 describes unsafe functions as the functions carrying compiler-unchecked caller conditions and requires the `unsafe` prefix ([unsafe-function authority](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). + +| ID | Exact obligation | Status | +|---|---|---| +| O1 | Every safe `increment::` call must give `get_unchecked_mut` an in-bounds index. | **Refuted; UNSOUND witness F1.** | +| O2 | For `Tail`, the index is in bounds. | **Proved:** the inspected impl returns literal `1`, and `[u32; 2]` has indices 0 and 1. | +| O3 | The Tail call increments exactly element 1 with wrapping arithmetic. | **Proved:** the unsafe API returns a mutable reference to the selected element when its precondition holds; assignment targets that element, while element 0 is untouched. `wrapping_add(1)` computes modular addition ([wrapping authority](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add): “Wrapping (modular) addition ... wrapping around at the boundary of the type”). | +| O4 | Configuration closure. | **Proved for O2–O3:** the derivation is parametric over every requested target/profile. O1 is refuted throughout that same domain, so a positive aggregate closure certificate is neither claimed nor needed. | + +## F1 — safe implementer causes undefined behavior + +```rust +struct Bad; +impl Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +This is a valid in-scope safe use: `Bad` is local downstream, its ordinary trait implementation satisfies coherence, and `increment` is safe. The call reaches line 16 with `S::index() == 2`; a two-element array has no element 2. Rust 1.82 states: “Calling this method with an out-of-bounds index is undefined behavior,” even if the reference is unused ([`get_unchecked_mut` contract](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). Therefore the executed operation's exact safety proposition is false and authoritative semantics supplies the UB consequence. This completes the existential `UNSOUND` certificate for every requested target/profile. Because the witness contains UB, it is not used as a postcondition refutation. + +The unsafe block has no `SAFETY` proof, but documentation alone cannot repair O1: there is no true derivation to document. The minimum generic repair would enforce bounds with safe checked indexing. Given the narrower authorized requirement, the design below is smaller. + +## Preferred provable design + +Replace the trait, marker type, generic parameter, and unsafe operation with one safe specialized function: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract is: for every initial `[a, b]`, normal return leaves `[a, b.wrapping_add(1)]`; it has no caller-side safety precondition. It has no invariant-bearing representation, implementer boundary, or unsafe/TCB premise. The array type fixes the length, literal index 1 supplies the needed projection locally, and `wrapping_add` supplies the required overflow behavior. + +Migration deletes `Slot` and `Tail`; `increment::(&mut pair)` becomes `increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile. Those are deliberate contract/API removals authorized because the abstraction is unreleased and only Tail behavior must remain. + +This proposal is not implemented and has no artifact verdict. After implementation, freshly audit the exact new snapshot: enumerate its public surfaces and any newly introduced configuration/generated code; verify safe indexing is in bounds for `[u32; 2]`; prove the exact element-0 preservation and modular element-1 postcondition; confirm removal/migration of every old trait/generic consumer; and re-establish target/profile closure. Re-audit on any source, signature, behavioral contract, Rust version, supported-target/profile, or standard-library-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/J.md new file mode 100644 index 0000000000..a2cb2e7bae --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/reports/J.md @@ -0,0 +1,82 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +Snapshot: the supplied `lib.rs` exactly as inspected; scope is its complete surface (`Slot`, `Tail`, their associated items/impl, and `increment`). `REQUEST.md` supplies the only behavioral requirement. No generated artifacts, dependencies, prior audit, build tooling, or tests are used. This is a source-level Rust-abstract-semantics review. + +`DOMAIN-R` is + +`rustc = std = 1.82.0 ∧ target supports this exact source and the used 1.82.0 items ∧ profile is ordinary`. + +The proof is parametric over every such target, profile, and Rust-1.82-supported edition in which the source compiles. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the current public surface is UB-free | **UNSOUND** throughout `DOMAIN-R` | `F-UB` below gives a valid safe witness in every case. | +| `increment::` changes `[a,b]` to `[a,b.wrapping_add(1)]` | **PROVED** throughout `DOMAIN-R` | `P-TAIL`; `Covered = DOMAIN-R`, hence `Required ⊆ Covered`. | +| Source-documented postconditions | none | No `CONTRACT-BROKEN` verdict applies. The requested Tail behavior is proved separately above. | + +The redesign authorization does not narrow the current artifact's safe public contract, so the proposal below does not affect **UNSOUND**. + +## Boundary, invariants, and obligations + +Safe surfaces are the public safe trait `Slot`, its safe associated function `index`, downstream implementations, public unit type/constructor `Tail`, its implementation, and public safe generic function `increment`. The only unsafe site is `pair.get_unchecked_mut(S::index())`. There are no fields, unsafe traits/impls, macros, hidden items, callbacks, FFI, concurrency, custom allocation, or destruction behavior relevant to that site. + +There is no enforced invariant. The needed proposition `S::index() < 2` cannot be an invariant of every `S: Slot`: `Slot` is public, safe, and unsealed, and neither its type system nor a check constrains the return value. + +| ID | Exact obligation | Status | +|---|---|---| +| O-BOUNDS | At the unsafe call, `S::index()` indexes the two-element slice in bounds. | **Refuted** for the generic safe surface by `F-UB`; proved for `S=Tail`. | +| O-TAIL | On normal return for `Tail`, mutate only element 1 to its old value plus one modulo `2^32`. | **PROVED** by `P-TAIL`. | +| O-DOC | Adjacent proof must derive O-BOUNDS from enforceable facts. | **Missing**, and no truthful generic derivation exists. | + +### F-UB — complete existential certificate + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } + +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +`Slot` and `increment` are externally reachable public items under the Rust 1.82 [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy). Because `Bad` is downstream-local, this implementation satisfies the [trait-implementation coherence/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations). `Slot` is not an [unsafe trait](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), so neither implementation nor call accepts a safety obligation. + +The call reaches `get_unchecked_mut(2)` on a slice of length 2. Its exact 1.82.0 contract says: “Calling this method with an out-of-bounds index is undefined behavior” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)); it expressly applies even when the result is unused. Thus the executed unsafe operation's required proposition is false and Rust's contract entails UB. No earlier operation in the witness is unsafe. `2` and `[u32; 2]` exist in every `DOMAIN-R` case, and cfg/profile/optimization does not alter this path. + +### P-TAIL — reconstructed local proof + +`Tail::index()` is definitionally `1`; `[u32; 2]` has length 2, so `1 < 2`. The unsafe method therefore returns a mutable reference to element 1. There is no intervening call or escaped alias. Rust 1.82 documents `wrapping_add` as “Wrapping (modular) addition” ([`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Assigning that result through the reference changes element 1 to `(old + 1) mod 2^32`; element 0 is untouched. This material derivation is absent from the source, but it proves only the Tail case and cannot repair the generic contract. + +## Configuration closure and TCB + +The controlling expression is exactly `DOMAIN-R`; no normalization or exclusion was added. Actual axes are target, ordinary profile, and compiling Rust-1.82 edition. There is one handwritten, unconditional path. Fixed array length, index values, the UB witness, and modular arithmetic are independent of those axes, giving parametric coverage. There are no sampled configurations or tool-derived claims. + +TCB log `TCB-R016-r1` has no additional assumptions. Its accepted authoritative axioms are: `AX-GET`, the quoted Rust-1.82 `get_unchecked_mut` contract (consumer O-BOUNDS); `AX-WRAP`, the quoted Rust-1.82 modular-addition contract (O-TAIL); and `AX-TRAIT`, the linked Rust-1.82 visibility, implementation, and unsafe-trait rules (F-UB). Exact identities are the linked versioned pages; scope is `DOMAIN-R`. Re-audit on source/API changes, Rust or support-domain changes, or material changes to those pages. + +## Finding and required resolution + +`F-UB` is an implementation defect in the current safe generic API; severity critical. The proof artifact is also missing: there is no `SAFETY` comment. Adding prose such as “implementers return an in-bounds index” would leave a hidden safety precondition on a safe trait and would not fix the defect. A generic design would need enforcement (for example, checked indexing) or an unsafe/sealed implementer boundary. The stated requirement needs no genericity, making those larger contracts unnecessary. + +## Preferred redesign + +Remove `Slot`, `Tail`, the type parameter, and all unsafe code: + +```rust +/// Replaces `[a, b]` with `[a, b.wrapping_add(1)]`. +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Contract: every well-typed safe call has no safety precondition beyond the parameter type; on return element 0 equals its old value and element 1 equals its old value plus one modulo `2^32`. The array type makes index 1 in bounds, safe indexing enforces bounds regardless, and `wrapping_add` supplies the exact arithmetic. There is no invariant, unsafe boundary, implementer obligation, or additional TCB premise. + +Migration: `increment::(&mut pair)` becomes `increment(&mut pair)`. The `Slot` implementation surface, generic calls, and nominal `Tail` type disappear; the request expressly authorizes those breaking changes and says the abstraction is unreleased. Tail's observable required effect is unchanged. + +This sketch is **not implemented and has no audit verdict**. After implementation, freeze a new snapshot and freshly audit every remaining/reexported safe surface; verify removal of the trait, impls, and unsafe site; prove index 1 in bounds, element 0 unchanged, and the wrapping postcondition; redo `DOMAIN-R` configuration closure; and review the final documentation and migrated consumers. + +## Residual scope + +Binary/backend correctness, non-ordinary configurations, other Rust releases, and any source not supplied are excluded. No target was built, tested, executed, or macro-expanded. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s1/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/PACKET.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/PACKET.json new file mode 100644 index 0000000000..fbe4378706 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/PACKET.json @@ -0,0 +1,34 @@ +{ + "allowlist_sha256": "d99084daff4c4505711f97a93884043a9bbf0d06df4f1d3d8342c98486be4713", + "common_rules_sha256": "d3ba48b524059bf07bcbf9448053971ee931854ee80d7107246fb3761c5eca9e", + "mode": "R", + "presentation_order": [ + "H", + "I", + "E", + "C", + "A", + "B", + "G", + "F", + "J", + "D" + ], + "report_sha256": { + "A": "7632affdeeafcfccad88b8fdf653218f196aac4cc1362ddf0525f98656a9c7b3", + "B": "9b384e4d25bdffc9aa4778754f57056871249885fb3e9fae08083850432e5644", + "C": "954a95a4d7d7b061201270d9c023a17c93fdff3f3368267f7599f873c3df4d2c", + "D": "504ff4872d456561c79c0295a3314112c456ed899917d9990ea9765f4e98c8cd", + "E": "e292fe32c8a29791f68ce58f1baffa9194c462d69358d73f2ff381e150caa947", + "F": "d14718131a1eb74ccf317bd2f288d4a85da663414929c3e59ad4b8a5be37babf", + "G": "ee9aa27852c22aafafd26a8a54bd0e997998f61f25186209cb1518e5bcfcea3d", + "H": "d64506354d1859a400f27a02b58acdc4c122d6b225fc2f9d0651e3f1017bebc6", + "I": "c8399a0504c893f30a809f39b7426472335f151709ffe5a6960a9cb87f83e9e2", + "J": "74fe59f2a0341cf8fe291f8812d131a22949f51b001324e41aacdefb7cbe67f1" + }, + "rubric_sha256": "af075a1aac36a19d97ec57d1fe8509d12a4b323e43739bd57c1576b071b83faf", + "schema_sha256": "c6f477c42431a9ea89c92b486a8ae49b9ee2d39219f4c572b55e2fc0fce453b5", + "schema_version": 1, + "scorer_id": "s2", + "target_byte_tree_sha256": "d69df1b286abd8f7f8955ac56d702c1910eb596c0bd105b7998e39d7246ca063" +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/RUBRIC.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/RUBRIC.md new file mode 100644 index 0000000000..a2d6562f7e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/RUBRIC.md @@ -0,0 +1,100 @@ +# Mode R Frozen Blind-Scoring Rubric + +> **Evaluator-only material. Never expose this file to a report agent.** + +> Evaluator-only material. Never expose this file to a report agent. + +## Exact result + +Within the scope in `REQUEST.md`, valid safe use includes every downstream safe +implementation of `Slot`, not only `Tail`. An implementation returning 2 and a +safe call `increment::(&mut [0, 0])` reaches +`get_unchecked_mut(2)` on a length-2 slice. Its in-bounds precondition is false, +and Rust 1.82.0 documents an out-of-bounds call as UB. The current safe API is +therefore `UNSOUND`. + +The required behavior needs neither generic index metadata nor an unsafe +abstraction. The preferred design is a nongeneric safe function that updates +`pair[1]` with wrapping addition (or an exactly behavior-equivalent checked +specialization). It eliminates caller implementation/index capability and the +unsafe block. Making `Slot` unsafe, adding safe-trait prose, or preserving the +generic abstraction by default is less parsimonious because downstream generic +use is expressly not required. The proposal does not alter the current verdict +and requires implementation plus fresh audit. + +## Atoms + +- **R1:** Quantify over arbitrary safe `Slot` implementations and explicitly + construct or describe one returning 2 together with its valid safe call. + - `scope_basis`: public safe trait implementation and safe generic calls are + valid-use surfaces of the exact current source. + - `dependencies`: exact Rust 1.82.0 public-visibility, trait-implementation, + ordinary-versus-unsafe-trait, and safe-versus-unsafe-function rules. +- **R2:** Prove reachability of `get_unchecked_mut(2)`, falsity of its in-bounds + precondition for length 2, and the applicable Rust 1.82.0 UB consequence. + - `scope_basis`: necessary certificate for the current-artifact soundness + claim requested in `REQUEST.md`. + - `dependencies`: R1. +- **R3:** Report the current safe API `UNSOUND`, independently of design intent + and proposals. + - `scope_basis`: `REQUEST.md` expressly requires the literal current-artifact + verdict before redesign. + - `dependencies`: R2. +- **R4:** Extract the exact minimum required behavior: wrapping increment of + element 1 for the owned use, with no generic downstream implementation need. + - `scope_basis`: this requirement is stated verbatim in `REQUEST.md`. + - `dependencies`: none. +- **R5:** Propose a nongeneric safe specialization implementing R4 with checked + indexing or an exactly equivalent safe operation, and no caller-controlled + implementation or index capability. + - `scope_basis`: `REQUEST.md` asks for the most parsimonious provable + abstraction satisfying R4. + - `dependencies`: R4. +- **R6:** Explain that removing the unpublished generic trait/API is an + authorized contract delta with no promised downstream migration burden. + - `scope_basis`: `REQUEST.md` expressly permits this contract and + representation change. + - `dependencies`: R4, R5. +- **R7:** Keep the redesign conditional and require implementation plus fresh + audit; do not use it to narrow or alter R3. + - `scope_basis`: `REQUEST.md` requires the current verdict and post-change + audit independently. + - `dependencies`: R3, R5. + +Merely making the trait unsafe does not pass R5 because it preserves an +unneeded caller implementation capability. + +## Hard errors + +- **RH1:** Trust `Tail` as the only safe implementation. +- **RH2:** Treat safe-trait prose as a caller obligation. +- **RH3:** Call the current API sound or merely `UNPROVED` after closing R2. +- **RH4:** Certify an unimplemented redesign. +- **RH5:** Let design intent narrow the current contract. + +## Checked authority + +- Rust 1.82.0 Reference, public visibility: + `https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy` + — public items are accessible from outside their module, subject to the + containing path; every item here is at the public crate root. +- Rust 1.82.0 Reference, trait implementations and coherence: + `https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations` + — a trait implementation may be defined when the implementing type is local, + so a downstream crate may define local `Bad` and implement `Slot` for it. +- Rust 1.82.0 Reference, unsafe traits: + `https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits` + — unsafe traits are explicitly declared with `unsafe`; the supplied `Slot` + declaration is an ordinary safe trait and its implementation requires no + unsafe act. +- Rust 1.82.0 Reference, unsafe functions: + `https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn` + — the caller-side unsafe obligation attaches to an `unsafe fn`; the supplied + public `increment` is an ordinary safe function. +- Rust 1.82.0 slice `get_unchecked_mut`: + `https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut` + — the index must be in bounds; an out-of-bounds call is UB even if its result + is unused. +- Rust 1.82.0 `u32::wrapping_add`: + `https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add` + — modular wrapping addition supplies the requested update semantics. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/SCORER.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/SCORER.md new file mode 100644 index 0000000000..eb79798cd6 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/SCORER.md @@ -0,0 +1,84 @@ +# Frozen Common Blind-Scoring Rules + +Score explicit propositions, not keywords, terminology, organization, or a +preferred proof style. Accept any equivalently exact derivation. Do not infer a +missing material premise from vague shorthand. + +For each report A–J: + +1. Mark every mode atom `PASS` or `FAIL`; every material clause of an atom must + hold for `PASS`. +2. Record every independently applicable hard error. +3. Separately decide proposal laundering, a TCB/authority defect, and a visible + source-scope defect. The runner, not the scorer, decides the mechanical word + budget and records operational scope deviations. +4. Cite compact report evidence for every decision. +5. Record genuine rubric ambiguity and novel findings without creating a new + confirmatory atom. A novel finding is a concrete, potentially gate-relevant + material defect in the report which the frozen atoms and defect fields do + not already represent; do not use it for praise, style, or harmless extra + detail. + +`Required` is the exact product of release/configuration scope, valid uses, and +the domain of the theorem being judged. `Covered` contains a case only when +every obligation has a complete applicable derivation. A universal positive +result requires an explicit or readily checkable `Required subset-of Covered` +derivation. An existential `UNSOUND` result instead requires a valid in-scope +safe use, reachability, falsity of the exact safety proposition, and an +applicable authoritative UB consequence. + +Where a mode uses these symbols, `P` ranges over every Cargo profile supported +by the target and `D` ranges over both states of debug assertions. + +A missed atom is not automatically a hard error. Apply a hard error only when +the report makes the listed false affirmative claim or triggers another exact +mode/global rule. Additional correct regional detail is harmless. + +A material Rust premise passes only when the report verifies applicable, +version-matched Rust Reference or standard-library text, or correctly leaves +the proposition unresolved. The URL allowlist grants page identity, not a +proposition. Cargo documentation is not a Rust semantic axiom. A target TCB +entry is not Rust authority; accept it only at its exact accepted identity, +proposition, consumer, and region, with conspicuous qualification where used. + +Mark `proposal_laundering` present exactly when a report uses an unimplemented +proposal as evidence that the supplied current artifact is sound, meets a +current postcondition, or has narrower obligations, or when it certifies the +proposal without implementation and fresh audit. Record G10 and any applicable +mode hard-error ID independently; this flag does not replace them. + +Mark `visible_scope_defect` present only when the report itself establishes a +material departure from the source-review scope supplied to its author. Merely +naming, quoting, hashing, or reporting the supplied package, its `SKILL.md`, or +the skill revision/digest visible inside that package is in scope and is not a +defect. Do not infer prohibited access from writing style, report similarity, +or a guessed generating condition. Record G12 independently when the report +actually evidences inspection of the specifically prohibited evaluation +materials listed there. + +Global hard errors have IDs G1 through G12 in the list order below. A mode's +own hard errors have IDs `H1`, `H2`, and so on in the list order +under that rubric's **Hard errors** heading. Record an exact applicable ID, not +a report-authored category name. Global hard errors are: + +- claiming full `PROVED` after contracting or failing to justify `Required`; +- claiming positive closure without `Required subset-of Covered`; +- inventing policy precedence or calling a conservative audit domain the + project's promise; +- treating CI, endpoints, sparse documentation, a cutoff, or a stability badge + as interval coverage; +- issuing `UNSOUND` without all four existential certificate links; +- issuing only `UNPROVED` after explicitly establishing all four links; +- issuing `CONTRACT-BROKEN` using only an execution that contains UB; +- claiming an observation remains guaranteed because it occurs before UB; +- silently trusting a third-party unsafe implementation or caller-controlled + safe behavior; +- certifying an unimplemented design or using it to narrow the current-artifact + obligation; +- necessarily relying on unchecked, invalid, or inapplicable authority; or +- evidence that the report agent inspected prohibited oracle, sibling, + condition-map, prior-report, or evaluator material. + +Do not identify, cluster, or speculate about generating conditions. Do not +inspect enclosing or sibling directories, other modes, manifests, skill +packages, condition maps, prior scores, or another scorer's output. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/allowlist.txt b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/allowlist.txt new file mode 100644 index 0000000000..6852f5fd70 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/allowlist.txt @@ -0,0 +1,6 @@ +https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy +https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations +https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits +https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn +https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut +https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/A.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/A.md new file mode 100644 index 0000000000..defb37885d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/A.md @@ -0,0 +1,62 @@ +# Focused literal audit and redesign + +## Claim, domain, and verdicts + +**Snapshot and scope.** This reviews exactly the supplied `target/lib.rs`: `Slot`, `Tail`, its `Slot` implementation, `increment`, and the one `get_unchecked_mut` call. `Required(c)` is exactly: `c` uses Rust and standard library 1.82.0, is any target on which this exact source and its used 1.82.0 standard-library items exist, and uses any ordinary profile. There are no dependencies, `cfg`s, features, generated artifacts, macros, FFI, concurrency, allocators, or other source-level configuration branches. + +**Soundness theorem.** Every well-typed safe call to the public safe API must be free of Rust undefined behavior, without an undocumented caller or implementer safety condition. + +**Verdict: UNSOUND.** The current public generic `increment` has a valid entirely-safe downstream use that necessarily calls `get_unchecked_mut` out of bounds. This verdict is independent of the redesign below. + +**Required `Tail` behavior: PROVED.** For every `c` in `Required` and every initial `pair`, `increment::` returns with element 0 unchanged and element 1 equal to its old value plus one modulo `2^32`. This user-required behavior is not documentation found in `lib.rs`; it is an explicit review requirement. + +**Trust boundary `TCB-R182`.** No additional TCB assumptions are admitted. The only semantic premises are the exact Rust 1.82.0 Reference and standard-library contracts cited below. No compiler-binary, platform-implementation, test, or tool result is trusted. + +## Boundary and obligation coverage + +The complete relevant surface is: public safe trait `Slot`; its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `impl Slot for Tail`; public safe generic function `increment`; and its private unsafe operation. There are no unsafe declarations, fields, constructors with state, callbacks other than caller-selected `Slot` implementations, hidden items, or generated surfaces. There is no owned invariant: `S::index() < 2` is merely the missing proposition consumed by the unsafe call. + +The [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) say a `pub` item is accessible externally and associated items in a public trait are public by default. Under the [orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), a downstream crate may implement a foreign trait for its own local type. `Slot` does not use `unsafe trait`; the [unsafe-trait rule](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits) reserves the implementer-side unsafe obligation for traits whose declaration begins with `unsafe`. + +### UNSOUND certificate + +A downstream crate can write only safe Rust: + +```rust +use audited_crate::{increment, Slot}; + +struct OutOfBounds; +impl Slot for OutOfBounds { + fn index() -> usize { 2 } +} + +let mut pair = [0u32; 2]; +increment::(&mut pair); +``` + +1. **Valid use:** Both imported items are public; `OutOfBounds` is local, so its safe `Slot` implementation is coherent. Neither the implementation nor `increment` requires an `unsafe` context or documents a safety obligation. +2. **Reachability:** `increment` unconditionally evaluates `S::index()` and passes the result, `2`, to `pair.get_unchecked_mut`. +3. **False required proposition:** `pair` has exactly two elements, so valid element indices are `0` and `1`; `2` is out of bounds. +4. **UB consequence:** Rust 1.82 documents for [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut): “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” UB therefore occurs at the call itself. + +This certificate applies parametrically on every `c` in `Required`: the source has no target/profile selection and the cited 1.82 contract is the same premise for the whole requested target/profile predicate. The UB-containing witness does not establish a separate `CONTRACT-BROKEN` result. + +For `Tail`, `index()` is locally fixed at `1`; `1 < 2`, so the unchecked call returns a mutable reference to element 1. The assignment touches only that element, and Rust 1.82 [`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) specifies modular addition. Thus `Covered_Tail = Required` and `Required ⊆ Covered_Tail`. The same derivation is profile- and target-parametric. + +The unsafe block has no adjacent `SAFETY` proof. A valid local proof can be reconstructed only for `S = Tail`; it cannot prove the universal generic call. Adding a comment or prose requirement to this safe trait would not repair the implementation defect. + +## Preferred design + +Replace the generic abstraction with the exact required capability, using only safe operations: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its safe contract is: for every input, return with element 0 unchanged and element 1 equal to its prior value plus one modulo `2^32`; there are no caller safety preconditions. The array type establishes length two, literal index `1` supplies the bounds fact at the use site, and safe indexing enforces it. There is no representation invariant, unsafe surface, implementer capability, or additional TCB premise. + +This is preferable to sealing or making `Slot` unsafe because no required polymorphism remains. Remove `Slot`, its implementations, and `Tail` if it has no independent nominal purpose; change `increment` to the non-generic signature above. Migrate `increment::(&mut pair)` to `increment(&mut pair)` and delete trait bounds/implementations. Downstream `Slot` implementations and generic calls intentionally cease to be supported, as authorized for this unreleased abstraction. + +This is a design proposal, not a verdict for a new artifact. After implementation, audit the exact new snapshot: enumerate its exported surface and all callers/documentation; confirm the intended removals; prove both-element postconditions for all inputs; confirm no conditional/generated variants; and re-establish `Required ⊆ Covered` for the same Rust/target/profile predicate. Re-audit on any source, contract, Rust version, target/profile-support, or generation change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/B.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/B.md new file mode 100644 index 0000000000..401f6ef712 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/B.md @@ -0,0 +1,71 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and results + +**Snapshot.** The artifact is exactly the supplied `lib.rs`; there are no other target sources, dependencies, generated artifacts, `cfg` branches, build scripts, macros, FFI, or prior results. Audit cutoff: 2026-08-01. Source-level Rust abstract semantics only. + +Let `E` be the request's exact set of targets “on which this exact source and its used Rust 1.82.0 standard-library items exist,” and `P` its symbolic set of ordinary profiles. `Required` contains every well-typed safe use of every language-reachable safe surface, with every input/state/execution, for `(Rust, target, profile) in {1.82.0} × E × P`. Thus `Required_cfg = {1.82.0} × E × P`. This is an exact restatement, not an enumeration. The source has no selection mechanism, and the proof below is parametric in `E` and `P`: target and profile cannot change the constants `2` and `1`, trait openness, or the specified operations. There are no exclusions. + +- **Safe-API soundness: UNSOUND.** A valid safe downstream implementation can return an out-of-bounds index and make `increment` execute documented undefined behavior. This certificate is independent of the redesign. +- **Requested `Tail` behavior: PROVED.** For every input array and required configuration, `increment::` returns with element 0 unchanged and element 1 equal to its old value plus one modulo `2^32`, without UB. +- **Combined current-artifact result: UNSOUND.** The positive `Tail` result does not repair the universally quantified public safe API. + +No additional robustness or documented unsafe-API postcondition is in scope. + +## Boundary and obligation inventory + +All surfaces are public and safe: `Slot`; its associated function `index`; public unit type/constructor `Tail`; its `Slot` implementation; and generic free function `increment`. The sole unsafe site is `pair.get_unchecked_mut(S::index())`. There are no fields, unsafe declarations/impls, named representation invariants, destructors, callbacks after index selection, or hidden/generated surfaces. `S::index()` may also panic; that exits before the unsafe call and before mutation. + +The Rust 1.82 authority set (TCB `R82-A`, no admitted non-Rust assumptions) is: + +- `AX-PUBLIC/IMPL`: public accessibility and trait-implementation/coherence rules. A downstream crate may name this public trait and implement it for its own local type; the local self type satisfies the orphan rule. [Visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy), [trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations). +- `AX-SAFE-BOUNDARY`: unsafe traits and functions require their respective `unsafe` declarations/obligations. Here `Slot` is not an unsafe trait and `increment` is not an unsafe function, so neither implementation nor call carries a caller safety obligation. [Unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), [unsafe functions](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn). +- `AX-GET`: Rust 1.82 documents for `get_unchecked_mut`: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” [Slice method](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut). +- `AX-WRAP`: `u32::wrapping_add` performs modular addition, wrapping at the type boundary. [Integer method](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add). + +No dependency or tool result is consumed. Re-audit `R82-A` if any cited Rust 1.82 text is corrected materially. + +| ID | Exact obligation | Disposition | +|---|---|---| +| O1 | At every executed `get_unchecked_mut(i)`, `i < 2`. | **False** for the public generic safe API; existential certificate below. | +| O2 | For `Tail`, establish O1 and the requested state transition. | **Proved:** `Tail::index()` unconditionally returns `1`; `1 < 2`; `AX-GET` therefore admits the returned reference to element 1. Assignment touches only that element. `AX-WRAP` gives the exact modulo-`2^32` result, including `u32::MAX -> 0`. | +| O3 | Existing adjacent proof explains the unsafe call. | **Deficient:** there is no `SAFETY` comment, and no sound derivation exists for arbitrary `S`. | + +For O2, the same source and argument cover every input fiber and every `(target, profile) in E × P`; no premise is configuration-specific. Hence the requested `Tail` domain is contained in its covered domain. + +## F-1 — safe generic API reaches UB + +Severity/classification: **UNSOUND implementation defect**, plus missing proof documentation. + +**Valid safe witness:** in a downstream crate, entirely safe Rust may write: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } +let mut pair = [0_u32; 2]; +increment::(&mut pair); +``` + +`Bad` is downstream-local, so `AX-PUBLIC/IMPL` permits the implementation. Neither boundary is unsafe (`AX-SAFE-BOUNDARY`), and the current API documents no precondition; this is therefore a valid in-scope safe use. + +**Reachability and falsity:** monomorphization calls `Bad::index()`, which returns `2`, then executes `get_unchecked_mut(2)` on the two-element receiver. Its valid element indices are `0` and `1`, so `2` is out of bounds. **UB consequence:** `AX-GET` states that the call itself is UB even before the reference is used. This completes every existential link on every required configuration and establishes `UNSOUND`; it is not merely a missing universal proof. The execution cannot separately witness `CONTRACT-BROKEN` because it contains UB. No generic behavioral postcondition was documented. + +Minimum repair of the current generic design would require checking the index before any unchecked access (and defining the failure behavior), or making/sealing an implementer contract and auditing every implementation. Neither complexity serves the stated requirement. + +## Preferred provable abstraction + +Specialize to the only required capability and remove unsafe code, the trait, the marker type, and genericity: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +**Proposed contract:** this is a safe function with no precondition beyond its type. On normal return, `pair[0] == old(pair[0])` and `pair[1] == old(pair[1]).wrapping_add(1)`; it returns `()`. The fixed array type makes index 1 in bounds. Safe indexing enforces its own bounds in any event, and `AX-WRAP` supplies the required arithmetic. There is no unsafe surface, implementer promise, or representation invariant. Retaining `Tail` would add nominal machinery without supplying a required capability. + +**Migration delta:** remove public `Slot` and `Tail`; change `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` impls and generic invocations cease to compile. The request expressly authorizes all of these unreleased contract/representation breaks. The wrapping result and mutation of element 1 are unchanged for the required case. + +**Fresh audit after implementation:** treat it as a new snapshot. Verify the exact exported surface and removal of old implementations/callers; prove both element postconditions for all `u32` values (especially `u32::MAX`); recheck the safe indexing and wrapping contracts against Rust 1.82; repeat the symbolic `E × P` configuration-closure argument; inventory any newly introduced code/generation; and confirm there is no remaining unsafe site. The proposal itself has no artifact verdict. + +Residual scope is exactly what the request excludes: other Rust releases, targets outside `E`, nonordinary configurations, binaries/backend correctness, and behavior of the intentionally removed generic API. Re-audit on source/API changes, support-domain changes, or material changes to the cited Rust 1.82 contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/C.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/C.md new file mode 100644 index 0000000000..82fb421517 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/C.md @@ -0,0 +1,72 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and verdicts + +**Snapshot.** The complete supplied `lib.rs` (lines 1–18), with no generated artifacts or third-party dependencies in scope. Audit cutoff: 2026-08-01. + +Let `T` be exactly “every target on which this exact source and its used Rust 1.82.0 standard-library items exist,” and `P` exactly “every ordinary profile.” `Required(case)` is the given source, Rust/compiler/stdlib 1.82.0, target in `T`, profile in `P`, every input/state/type and execution of every well-typed safe use of its public safe surfaces. The separately required behavioral domain is every valid `&mut [u32; 2]` passed to `increment::`. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every required safe use is free of Rust UB | **UNSOUND** | `F-UB` below gives a valid safe use, reaches `get_unchecked_mut`, falsifies its bounds requirement, and the applicable Rust 1.82.0 contract expressly entails UB. | +| For initial `[a,b]`, `increment::` returns with `[a, b.wrapping_add(1)]` | **PROVED** | `P-TAIL` covers every `a,b: u32`, target in `T`, and profile in `P`. | +| Existing local unsafe-proof documentation | **DEFICIENT** | The unsafe block has no adjacent `SAFETY` proof, and its needed universal premise is false. | + +The redesign below does not participate in these current-artifact verdicts. + +## Boundary and obligation inventory + +All language-reachable surfaces are: public safe trait `Slot` and its public safe associated function `index` (3–5); public unit struct and constructor `Tail` (7); its safe `Slot` implementation (9–13); and public safe generic function `increment` (15–18). There are no unsafe declarations, fields, macros, callbacks, FFI, concurrency, allocation, generated code, `cfg`, or configuration-selected paths. The sole unsafe operation is `pair.get_unchecked_mut(S::index())` (16); its result is consumed by wrapping addition and assignment (17). The only proposed invariant—`S::index() < 2` for every `S: Slot`—has no owner or enforcement boundary and is false. + +The source is identical across the symbolic `T × P` domain. Its explicit `wrapping_add` is profile-independent; no target fact, layout, panic strategy, or code-generation premise enters either certificate. Thus the proofs below are parametric over every configuration fiber, not sampled. No build or test evidence was used. + +## Checked Rust 1.82.0 axioms + +TCB `R82-AUTH-1` contains only these exact authoritative Rust 1.82.0 propositions; there are no additional assumptions. + +- `AX-VIS`: a `pub` item is accessible externally, subject to accessible ancestors ([Reference](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). +- `AX-IMPL`: a trait implementation is valid under the orphan rules when the implementing type is local; unsafe traits require `unsafe impl` ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). Rust describes an unsafe trait as one whose implementation may be unsafe and whose impl must use `unsafe` ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). `Slot` is not declared unsafe. +- `AX-BOUNDARY`: extra unchecked safety conditions belong on `unsafe fn`; an unsafe block asserts that all called-operation obligations were discharged ([unsafe functions and blocks](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). `increment` is a safe `fn`. +- `AX-GET`: `get_unchecked_mut` returns the selected mutable element without checking bounds, and: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” ([standard library](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). +- `AX-WRAP`: `u32::wrapping_add` performs modular addition, wrapping at the type boundary ([standard library](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). + +## Proofs and finding + +### F-UB — caller-controlled safe trait breaks the unchecked access + +A downstream crate may write the entirely safe witness: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +Validity: `Slot` and `increment` are public (`AX-VIS`); `Bad` is local to that downstream crate, satisfying the orphan alternative in `AX-IMPL`; neither the impl nor call accepts an unsafe obligation (`AX-IMPL`, `AX-BOUNDARY`). Reachability: `Bad::index()` returns 2, after which line 16 necessarily calls `get_unchecked_mut(2)` on the two-element array viewed as a length-two slice. False proposition: valid indices are below 2, so 2 is out of bounds. Consequence: `AX-GET` directly classifies that executed call as UB, even before line 17 uses the reference. The witness uses only values representable wherever this source exists, so it applies throughout `T × P`. This completes the existential `UNSOUND` certificate. There is no UB-free postcondition counterexample in scope from this witness. + +The smallest current implementation resolution is to stop passing unchecked memory-safety authority through a caller-controlled safe trait. Documentation alone cannot repair the safe API. + +### P-TAIL — required crate-owned behavior + +For arbitrary initial `[a,b]`, the inspected `Tail::index` returns 1. Since `1 < 2`, line 16 satisfies `AX-GET` and obtains the unique mutable reference to element 1. Line 17 computes `b + 1` modulo the `u32` range by `AX-WRAP` and stores it through that reference; element 0 is not accessed or assigned. Hence normal return yields exactly `[a, b.wrapping_add(1)]`. These source facts and axioms are independent of target and ordinary profile, so `Required_tail ⊆ Covered_tail` over all `T × P`. + +## Preferred provable abstraction + +Specialize to the sole required operation and remove both the implementer boundary and unsafe code: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +**Contract.** This safe function has no caller safety precondition beyond a valid exclusive array reference. For every initial `[a,b]`, it returns `[a, b.wrapping_add(1)]`. The fixed array type supplies length two, constant index 1 is in bounds, and the only arithmetic uses the documented modular operation. No representation invariant, unsafe implementer promise, or extra TCB entry remains. + +**Migration delta.** Delete public `Slot`, `Tail`, their impl, and the generic parameter. Change crate-owned calls from `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` impls and generic calls cease to compile; the request expressly authorizes that break because the abstraction is unreleased and only the Tail operation must survive. The observable required mutation is unchanged. + +**Fresh audit after implementation.** Treat the edit as a new snapshot. Re-inventory exports and all call sites; verify the exact implementation and any documentation; prove constant index 1 is in bounds for `[u32; 2]`, the wrapping postcondition, unchanged element 0, and absence of alternate exits for every `T × P` case; rescan conditional/generated surfaces and residual unsafe code. Any source, API contract, Rust version, target/profile policy, or generated/build input change triggers re-audit. No verdict is assigned to the unimplemented proposal. + +## Residual scope + +No broader safe-API behavior, binary/backend correctness, other source, or future version is claimed. Source execution, building, testing, and macro expansion were excluded by instruction and supply no premise. No authoritative-documentation or skill-guidance gap blocked either certificate. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/D.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/D.md new file mode 100644 index 0000000000..34ec4b57e7 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/D.md @@ -0,0 +1,76 @@ +# Focused literal audit and redesign + +## Claim, domain, and results + +**Current-artifact soundness: `UNSOUND`.** For the complete supplied `lib.rs`, a well-typed entirely safe downstream use reaches undefined behavior. This verdict is independent of the redesign below. + +**Requested `Tail` behavior: `PROVED`.** For every initial `pair = [a, b]`, `increment::(&mut pair)` returns normally with `[a, b.wrapping_add(1)]`. This is a user-requested robustness result, not a documented current-API postcondition. + +There are no documented postconditions or unsafe public APIs, so no `CONTRACT-BROKEN` claim applies. + +Let `T` be exactly the targets on which this source and its used Rust 1.82.0 standard-library items exist, and `P` every ordinary profile. A required case is + +`Required(source, rust, target, profile, S, pair, execution) := source = supplied lib.rs ∧ rust = 1.82.0 ∧ target ∈ T ∧ profile ∈ P ∧ the call is a well-typed safe use`. + +Thus `Required_cfg = {1.82.0} × T × P`. This is the request's predicate verbatim, not a finite target inventory. The source has no `cfg`, features, dependencies, generators, FFI, assembly, concurrency, allocation, or profile-sensitive operation. The proofs and counterexample below are parametric in `target ∈ T` and `profile ∈ P`; optimization, overflow-check, panic-strategy, and debug-assertion differences do not alter them. Audit cutoff: 2026-08-01. + +## Boundary and obligation inventory + +The complete language-reachable crate-owned surfaces are: public safe trait `Slot` and its public safe associated function `index`; public constructible unit struct `Tail`; the crate-owned `Slot for Tail` implementation; and public safe generic function `increment`. The sole unsafe operation is `pair.get_unchecked_mut(S::index())`. `wrapping_add` and assignment are safe. There are no fields, constructors beyond the unit-struct expression, macros, hidden items, callbacks, or explicit unsafe declarations. No enforced invariant constrains implementations of `Slot` or their returned index. + +| ID | Obligation | Disposition | +|---|---|---| +| O1 | Every safe call to `increment` must pass an in-bounds index to `get_unchecked_mut`. | **Refuted; F1.** | +| O2 | For `Tail`, the selected index is in bounds for `[u32; 2]`. | `Tail::index()` is source-constant `1`; valid indices are `0,1`. **Proved** for all required configurations. | +| O3 | The requested normal result for `Tail` is `[a, b+1 mod 2^32]`. | O2 makes the returned reference designate element 1; assignment changes that element only; `wrapping_add(1)` supplies the modular value. **Proved**. | +| O4 | Every required configuration reaches the reviewed source and the same material semantics. | Exact source only, with no selectors or generated stages; O1–O3 are target/profile-parametric. **Proved**. | + +## F1 — safe trait implementation causes out-of-bounds unchecked access + +Severity/classification: **UNSOUND implementation defect; missing local proof artifact.** The unsafe block has no adjacent `SAFETY` proof, but documentation alone cannot repair the false premise. + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +Certificate: + +1. **Valid in-scope use.** `Slot` and `increment` are public at crate root. `Slot` is a safe trait and states no behavioral contract. The Rust 1.82 orphan rule permits this implementation because `Bad` is local to the downstream crate; its relevant clause is “At least one of the types `T0..=Tn` must be a local type.” There are no uncovered type parameters. The call is to a safe function and uses no unsafe operation at the call site. ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy), [trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations), [unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)) +2. **Reachability.** `Bad::index()` returns `2`; `increment` unconditionally calls `get_unchecked_mut(2)` on the borrowed `[u32; 2]`. +3. **False safety proposition.** Index `2` is outside the two-element array's index set `{0,1}`. +4. **UB consequence.** Rust 1.82 documents: “Calling this method with an out-of-bounds index is undefined behavior even if the resulting reference is not used.” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)) + +This witness works for every `target ∈ T` and ordinary profile. One valid required execution suffices to refute universal safe-API soundness. No UB-free postcondition refutation is needed or claimed. + +## Authority and trust + +TCB revision `TCB-0` contains only the exact Rust 1.82 Reference/std propositions cited above and the `u32` contract: “Wrapping (modular) addition. Computes `self + rhs`, wrapping around at the boundary of the type.” ([`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)) These are version-matched Rust axioms, not additional assumptions. There are no dependencies, tool results, prior audits, external specifications, implementation claims, or deployment assumptions. Review was source-only; nothing was built, executed, tested, or expanded. + +## Preferred design + +Remove `Slot` and the generic free function. Retain the crate-owned name as one safe inherent operation: + +```rust +pub struct Tail; + +impl Tail { + pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); + } +} +``` + +Proposed contract: for every `[a,b]`, `Tail::increment` has no caller safety precondition, returns normally, leaves element 0 equal to `a`, and sets element 1 to `b + 1 mod 2^32`. The fixed array type makes index `1` locally in bounds; ordinary checked indexing removes all unsafe code, implementer promises, invariants, and additional TCB premises. + +Migration is intentionally source-breaking but authorized for this unreleased abstraction: replace `increment::(&mut x)` with `Tail::increment(&mut x)`; remove downstream `Slot` implementations and generic calls, which the requirement expressly does not preserve. The required `Tail` behavior is unchanged. Do not regard this sketch as audited or `PROVED`. + +After implementation, audit the new snapshot afresh: verify the actual visibility/reexports and absence of generated or conditional alternatives; inventory every remaining safe/unsafe surface; prove index `1` is in bounds from `[u32;2]`; prove normal return, element-0 preservation, and wrapping element-1 update for every input, target in `T`, and ordinary profile; reconcile the final documentation with that contract; and repeat the configuration/TCB closure if source, support policy, dependencies, or Rust version changes. + +Residual scope: binary/backend correctness, nonordinary profiles, other Rust releases, unavailable targets/items, performance, and APIs other than the supplied source are excluded by the request. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/E.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/E.md new file mode 100644 index 0000000000..cdd419fac4 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/E.md @@ -0,0 +1,76 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +**Snapshot.** Exactly the supplied 18-line `target/lib.rs`, audited as source under Rust and standard-library 1.82.0 abstract semantics. No generated source, dependencies, build machinery, features, `cfg`, FFI, assembly, allocator choice, concurrency, or prior audit appears in the supplied artifact. Nothing was executed or expanded. + +Let `E` be exactly the targets named by the request: targets on which this source and its used Rust 1.82.0 standard-library items exist. Let `P` be every ordinary profile. Then + +`Required_cfg = {Rust 1.82.0} × E × P`. + +For soundness, `Required` additionally quantifies over every well-typed safe call, every valid `&mut [u32; 2]`, every caller-provided `S: Slot`, and every permitted execution. For the requested behavior, `Required_Tail` is every call with `S = Tail` and every initial array. The source has no configuration selector, and neither proof below consumes target- or profile-specific facts; both are parametric over `E × P`. Thus no finite target/profile inventory is asserted or needed. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every valid safe use of the current public API is UB-free | **UNSOUND** | Witness `W1` below is valid, reaches the unsafe operation, falsifies its exact precondition, and the Rust 1.82 contract says the call is UB. | +| `increment::` increments element 1 modulo `2^32` and leaves element 0 unchanged | **PROVED** | `TAIL-PROOF` below covers all `Required_Tail`. | + +The current-artifact soundness verdict is independent of the proposal. + +## Boundary and obligation inventory + +The complete language-reachable surface in this source is: public safe trait `Slot` and its required safe associated function `index` (lines 3–5); constructible public unit struct `Tail` (line 7); safe `Slot for Tail` implementation returning `1` (lines 9–13); and public safe generic function `increment` (lines 15–18). There are no fields, inherent methods, macros, hidden items, callbacks, unsafe declarations/traits/impls, or destructors in the artifact. + +The sole unsafe operation is `pair.get_unchecked_mut(S::index())` (line 16). Its obligation is `S::index() < pair.len() = 2` at the call. There is no enforced invariant or check supplying that fact. The subsequent operation (line 17) must write the referenced element's old value plus one with wrapping arithmetic. The unsafe block has no adjacent `SAFETY` proof; that proof artifact is missing independently of implementation correctness. + +### `W1`: existential UB certificate + +Downstream safe code can write: + +```rust +struct Outside; +impl Slot for Outside { fn index() -> usize { 2 } } +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +1. `Slot` and `increment` are `pub`; Rust 1.82 says a `pub` item is accessible outside, and associated items of a public trait are public by default ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). +2. `Outside` is local to the downstream crate, so this implementation satisfies the orphan-rule alternative requiring a local implementing type. It defines the sole required item ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). `Slot` is not `unsafe`; only an unsafe trait establishes compiler-recognized extra implementation safety conditions and requires `unsafe impl` ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), [unsafe keyword](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). The source documents no behavioral restriction. Therefore returning `2` is a valid safe implementation and the entire witness contains no caller-side `unsafe`. +3. The safe generic call reaches line 16; `S::index()` returns `2`. A two-element array has length `2`, so `2` is out of bounds. +4. Rust 1.82 states: “Calling this method with an out-of-bounds index is undefined behavior” even if the reference is unused ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). + +This same source-level witness applies for each `E × P`; one witness suffices to refute the universal claim. A comment cannot repair it. The minimum current-shape repairs would enforce the bound, seal/control every implementation, or create an honest unsafe implementer boundary. The requested specialization makes all three unnecessary. + +### `TAIL-PROOF`: requested current behavior + +For `Tail`, the inspected implementation returns `1`. Since `1 < 2`, line 16 satisfies the only stated safety condition and returns a mutable reference to element 1. Line 17 reads and writes only through that reference, so element 0 is unchanged. Rust 1.82 defines `wrapping_add(1)` as modular addition that wraps at the type boundary ([`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Therefore element 1 becomes `(old element 1 + 1) mod 2^32` for every input. There are no alternative source paths. This reconstruction proves the `Tail` implementation obligation but does not cure the missing local proof or generic unsoundness. + +## Trust and evidence + +**TCB-R182/revision 1.** No additional assumption is admitted. The only consumed semantic premises are the exact Rust 1.82 authoritative propositions linked above: public accessibility, trait-implementation/orphan and unsafe-boundary rules, out-of-bounds `get_unchecked_mut` UB, and wrapping addition. Their scope is exactly Rust/std 1.82.0 and `E × P`; consumers are `W1` and `TAIL-PROOF`. All other premises are inspected local syntax or arithmetic. No dependency, tool result, external specification, implementation/backend assumption, deployment restriction, or probabilistic premise is consumed. Re-audit on any source/public-contract change, Rust/std version change, scope expansion, or material change to a cited proposition. + +## Preferred redesign + +The minimum required capability is one fixed operation, not caller-selected indexing. Retain nominal `Tail` only if that name is desired, remove `Slot`, remove genericity, and use safe indexing: + +```rust +pub struct Tail; + +impl Tail { + pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); + } +} +``` + +**Proposed contract.** For every valid `&mut [u32; 2]`, `Tail::increment` has no caller safety precondition, returns normally, leaves element 0 unchanged, and replaces element 1 by its old value plus one modulo `2^32`. It exposes no representation invariant and contains no unsafe operation or implementer obligation. + +**Why preferred.** It directly supplies the only required consumer proposition. A checked generic function would preserve unneeded variability; sealing would retain an unneeded trait; making `Slot` unsafe would export an unnecessary obligation. The proposal removes the false bound premise, unsafe block, generic consumer, and implementer surface rather than relocating their proofs. + +**Migration/contract delta.** Delete public `Slot`, its `Tail` impl, and `increment`. Change crate-owned calls from `increment::(&mut pair)` to `Tail::increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile, as expressly authorized; the abstraction is unreleased. The required `Tail` result is unchanged. + +**Fresh-audit status.** This is an unimplemented design, not a verdict on a new snapshot. After implementation, audit the exact source anew: enumerate its public surfaces; verify safe indexing selects element 1 and cannot panic for `[u32; 2]`; reprove wrapping arithmetic and nonmutation of element 0 on every exit; confirm no generated/configuration-dependent alternative; and re-establish parametric coverage of Rust 1.82.0 over `E × P`. No unsafe-code TCB entry or safety comment should remain. + +## Residual scope + +Repository history, manifests, packaging, downstream code, compiler/backend correctness, binaries, and any source other than the two supplied target files were neither provided nor part of this exact source-level claim. No whole-crate or later-snapshot verdict is implied. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/F.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/F.md new file mode 100644 index 0000000000..288ee57e72 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/F.md @@ -0,0 +1,70 @@ +# Focused unsafe-Rust audit and redesign + +## Claims and verdicts + +**Snapshot.** Exact supplied `lib.rs` (18 lines), reviewed without execution or expansion. Scope is Rust 1.82.0 and + +`Required = { (target, profile, use) | target admits this source and the used Rust 1.82.0 standard-library items; profile is ordinary; use is well-typed safe use of a language-reachable safe surface }`. + +There are no `cfg`s, macros, dependencies, generated artifacts, FFI, concurrency, allocator choices, or target-dependent operations in the supplied snapshot. The source contains no support-policy transformation: the request supplies the symbolic target set directly. Audit cutoff 2026-08-01 does not extend the fixed Rust release. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every safe use of the current public API is free of Rust UB over `Required`. | **UNSOUND** | F-1 gives a valid entirely-safe use, reaches `get_unchecked_mut(2)` on a length-2 slice, proves its bounds precondition false, and links that event to Rust 1.82.0's explicit UB consequence. The witness is target/profile-parametric. | +| For every initial `[a, b]`, `increment::` terminates with `[a, b.wrapping_add(1)]` without UB. | **PROVED** | P-TAIL below covers every `u32` pair and every required target/profile. | + +There is no documented unsafe public API postcondition. The request's `Tail` behavior is the only additional behavior claim. No `CONTRACT-BROKEN` verdict applies: F-1's execution contains UB, while the independently reviewed `Tail` behavior holds. + +## Boundary, invariants, and obligation ledger + +The complete relevant language-reachable surface is: public safe trait `Slot` and safe associated function `Slot::index` (`lib.rs:3-5`); public unit struct and constructor `Tail` (`:7`); its safe trait implementation (`:9-13`); and safe generic function `increment` (`:15-18`). There are no fields, derives, reexports, hidden items, exported macros, or other manual implementations. Compiler-supplied auto-trait/drop behavior carries no state and is not consumed by the unsafe block. + +The unsafe operation needs `BOUND(S): S::index() < 2`. No type, check, privacy boundary, trait contract, or invariant establishes `BOUND` for arbitrary `S`. `Slot` is public and safe. Rust 1.82.0's [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) make the root `pub` surfaces externally reachable, and its [trait-implementation/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) permit another crate to implement this trait for its own local type. + +| ID | Obligation | Status | +|---|---|---| +| O-BOUND | At `:16`, the `usize` index must be in `0..2`. | **False** for a valid implementation returning 2; proved for `Tail` because `Tail::index()` is exactly 1. | +| O-SAFE | Safe `increment` must discharge O-BOUND for every safe `S: Slot`. | **Refuted** by F-1. | +| O-TAIL | The in-bounds mutable reference denotes element 1; the write preserves element 0 and stores modular `b + 1`. | **Proved** by P-TAIL. | +| O-CONFIG | Cover all requested targets/profiles. | Control flow, array length, constants, and the exact Rust 1.82.0 contracts are invariant across the symbolic availability set; thus P-TAIL covers it, and F-1 works in every member. | + +### P-TAIL + +For `S = Tail`, source fixes `S::index()` to 1. An array `[u32; 2]` has length 2, so 1 is in bounds. Rust 1.82.0 documents that [`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) returns a mutable reference to the selected element without checking bounds and states: “Calling this method with an out-of-bounds index is undefined behavior.” Here that forbidden condition is false. The exclusive array borrow supplies the access for the returned reference, and no intervening call occurs. Rust 1.82.0 documents [`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) as computing addition “wrapping around at the boundary of the type.” Therefore the sole write changes element 1 from `b` to modular `b + 1`; element 0 remains `a`. + +## F-1 — safe implementer selects an out-of-bounds slot + +**Implementation: UNSOUND. Proof artifact: missing and not repairable under the current safe contract.** A downstream crate can write, with `audited_crate` denoting this crate: + +```rust +struct Bad; +impl audited_crate::Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0, 0]; +audited_crate::increment::(&mut pair); +``` + +This contains no unsafe operation or unmet caller obligation. The ordinary impl is legal for the downstream-local `Bad`; `Slot` imposes no safety condition. `increment` is also safe. Its call to `Bad::index()` returns 2, so line 16 executes `pair.get_unchecked_mut(2)` after array-to-slice method resolution with length 2. Thus the exact required proposition `2 < 2` is false. The linked Rust 1.82.0 standard-library contract says the call itself is UB even if its resulting reference is never used. This completes the existential certificate; it is not merely a missing universal proof. + +The absent adjacent `SAFETY` comment is independently deficient. No truthful comment can derive O-BOUND for arbitrary safe implementations. Minimum repair is to enforce the bound or remove this generic unsafe path; changing prose alone cannot add a hidden precondition to safe callers or implementers. + +## TCB and evidence + +`TCB-R033` contains only the exact Rust 1.82.0 Reference/std axioms linked above: public reachability and legal local-type trait implementation, `get_unchecked_mut`'s return/bounds contract, and `wrapping_add`'s modular result. They are the controlling authorities selected by the request, not additional assumptions. No dependency, tool result, implementation behavior, compatibility premise, test, or deployment restriction is consumed. + +## Preferred redesign + +Delete `Slot`, its impl, the marker `Tail`, the type parameter, and the unsafe operation. The stated behavior needs only a concrete safe function: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract is: no caller safety preconditions; on normal return, initial `[a, b]` becomes `[a, b.wrapping_add(1)]`. The fixed array type and constant index make the access locally checkable, while safe indexing removes the unsafe contract entirely. Keeping `Tail` as an associated-function namespace is possible but adds surface without supplying required capability. + +This intentionally breaks source compatibility: `increment::(&mut pair)` migrates to `increment(&mut pair)`; `Slot` implementations and other generic instantiations disappear. The request authorizes that delta because the abstraction is unreleased and those uses need not survive. + +The proposal is not a new verdict. After implementation, freshly audit the exact new snapshot: public surface and migrated in-scope callers, the fixed index/array-length argument, the wrapping postcondition for every `u32`, absence of unsafe or callback-selected indexing, and Rust-1.82 target/profile closure. Re-audit on source/API changes, reintroduced generic dispatch or unsafe code, new configurations/generated code, or a change to the consumed Rust contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/G.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/G.md new file mode 100644 index 0000000000..361bf9ba55 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/G.md @@ -0,0 +1,87 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +**Snapshot.** Exactly the supplied `lib.rs`; no expansion or generated artifact. Scope is Rust and standard library 1.82.0, every target on which this source and the used items exist, and every ordinary profile. Audit cutoff: 2026-08-01. There are no dependencies, features, `cfg`s, build scripts, FFI, assembly, concurrency, allocators, or additional TCB assumptions. + +**Current safe-API soundness: UNSOUND.** A well-typed safe downstream implementation of `Slot` can return `2`; `increment` then executes `get_unchecked_mut(2)` on a two-element array. Rust 1.82 documents that an out-of-bounds call is undefined behavior even if the reference is unused. + +**Required `Tail` behavior: PROVED.** For every initial `[a, b]`, `increment::` returns with `[a, b.wrapping_add(1)]`, and this execution is free of undefined behavior. This regional result does not alter the whole safe-API verdict. + +**Combined current-artifact result: UNSOUND.** The source documents no other postcondition. The `Tail` behavior is included because `REQUEST.md` expressly requires it. + +## Exact domain and configuration closure + +Let a case be `(t, p, S, pair, execution)`. `Required` means: this exact source; Rust/std 1.82.0; `t` is any target on which the source and used items exist; `p` is any ordinary profile; `S` is any type satisfying the public safe bound `Slot`; `pair` is any valid `&mut [u32; 2]`; and the call is well-typed safe Rust. `Required_cfg(t,p)` is its Rust/target/profile projection. This is an equality-preserving transcription of the request, not a sampled inventory or inferred support promise. + +The source has one unconditional path and no generation or selection stage. Target/profile facts do not control the index, length, call, or library contracts used below. The counterexample is therefore parametric over every member of `Required_cfg`; one required case is already sufficient for `UNSOUND`. The `Tail` proof is likewise parametric over the full configuration projection and all `pair` values. No version-bridging premise is used. + +## Boundary, surfaces, and invariants + +- `Slot` and its safe associated function `index` are public; associated items in a public trait are public by default, and root-public items are externally accessible. [Rust 1.82 visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy) +- A downstream crate can define local `Oob` and write `impl Slot for Oob`: the implementation supplies the sole required item, and the local implementing type satisfies the orphan rule. Only unsafe traits require `unsafe impl`; `Slot` is not declared unsafe. [Rust 1.82 trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations) +- `Tail` is a public unit struct (including its constructor) with the crate-owned `Slot` implementation. `increment` is a public safe generic free function. Its unsafe block is the only unsafe operation. +- There are no fields, methods, other trait items/impls, callbacks, macros, hidden APIs, reexports, or invariant-bearing state. No abstraction invariant constrains caller implementations of `Slot`. + +## Authority/TCB log `TCB-1` + +There are no admitted non-authoritative premises. These checked Rust 1.82 axioms are the entire authority inventory: + +- **AX-ACCESS:** the visibility and implementation propositions stated above; consumers: witness validity and safe-surface inventory. +- **AX-GET:** `get_unchecked_mut` “returns a mutable reference to an element or subslice” without bounds checking, and calling it with an out-of-bounds index is UB even if unused. The page specifically identifies `len` as UB. Consumer: the unsafe-call obligation and `Tail` result. [Rust 1.82 slice contract](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut) +- **AX-WRAP:** `wrapping_add` computes modular addition, wrapping at the type boundary. Consumer: the required value postcondition. [Rust 1.82 `u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add) + +All apply exactly to Rust/std 1.82.0; changing that identity or any cited contract triggers review. + +## Obligation ledger and proofs + +**O1 — safe generic boundary.** Every safe call must establish `S::index() < 2` before the unsafe operation. Neither `S: Slot` nor any check establishes it. **Refuted; FIND-1.** + +**O2 — unsafe call for `Tail`.** `Tail::index()` returns literal `1`; `[u32; 2]` has length `2`; hence `1 < 2`. AX-GET then supplies a mutable reference to element 1. **PROVED** for all `Tail` cases. + +**O3 — update/postcondition for `Tail`.** The sole store is through that element-1 reference. AX-WRAP makes the stored value old element 1 plus one modulo the `u32` range; element 0 is not written. There is no alternative source path. **PROVED** for all initial arrays and configurations. + +**O4 — local proof artifact.** The unsafe block has no adjacent `SAFETY` proof. The reconstruction in O2 proves only `Tail`, not arbitrary `S`, so no truthful generic safety comment can repair the current implementation. **Deficient and implementation-unsound.** + +Aggregate positive coverage for the required `Tail` claim is `O2-covered ∩ O3-covered = Required_Tail`, establishing `Required_Tail ⊆ Covered_Tail`. Aggregate coverage for universal safe-API soundness fails at O1 and is existentially refuted below. + +## FIND-1 — safe implementer selects an out-of-bounds index + +**Status: UNSOUND; proof artifact missing.** Consider downstream safe code: + +```rust +struct Oob; +impl Slot for Oob { fn index() -> usize { 2 } } +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +**Valid use.** AX-ACCESS plus the source’s public, non-unsafe declarations make the implementation and call available without any caller-side unsafe obligation. The implementation defines the only required associated item and is coherent because `Oob` is local. + +**Reachability.** Monomorphization does not change the written control flow: `S::index()` returns `2`, which is passed directly to the executed `get_unchecked_mut` call before the store. + +**False safety proposition.** The array length is `2`, so the supplied index equals `len` and is out of bounds. + +**UB consequence.** AX-GET expressly makes that call UB even if its result is never used. Thus the whole execution witnesses soundness failure; it cannot witness a defined postcondition failure. No separate required postcondition is refuted. + +Minimum repair is to stop relying on an unenforced safe-implementer promise: validate the index, make and fully document an unsafe trait, effectively seal it, or remove the genericity. The stated requirements make removal preferable. + +## Preferred redesign (not a verdict on new code) + +Replace `Slot`, `Tail`, and generic `increment` with the specialized safe operation: + +```rust +pub fn increment_tail(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract has no safety precondition: for every valid input `[a,b]`, normal return produces `[a, b + 1 mod 2^32]`. The fixed array type and safe indexing enforce the only memory-selection fact; AX-WRAP supplies the arithmetic postcondition. It exposes no unsafe caller/implementer surface, owns no invariant, and needs no additional TCB premise. This is more parsimonious than sealing a trait whose only required implementation is fixed. + +**Migration/contract delta.** Remove the public `Slot` implementer contract, `Slot::index`, the nominal `Tail` constructor/implementation, and generic calls. Change the required internal call from `increment::(&mut pair)` to `increment_tail(&mut pair)`. Downstream implementations and generic calls intentionally cease to compile; the request authorizes that break and states the API is unreleased. The required observable behavior is unchanged. + +**Fresh audit after implementation.** Treat it as a new snapshot: re-inventory its actual visibility and all call sites; verify the safe element-selection semantics and AX-WRAP applicability on every requested target/profile; prove both elements’ post-state and all exits; confirm no conditional/generated alternative; and redo `Required ⊆ Covered`. This proposal itself is **not implemented and has no audit verdict**. + +## Evidence, residual scope, and triggers + +No target was built, run, tested, expanded, or tool-verified; none of those facts supports a conclusion. This is a source-level Rust-semantics audit, not a compiler-backend, binary, platform-implementation, performance, panic-freedom-beyond-the-required-case, or maximal-safe-subset claim. Re-audit on source/API/contract changes, Rust/std or support-domain changes, addition of configuration/generation/dependencies, or implementation of the redesign. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/H.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/H.md new file mode 100644 index 0000000000..43ad25268d --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/H.md @@ -0,0 +1,73 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, domain, and verdicts + +**Snapshot.** Exact supplied `lib.rs`, lines 1–18; no generated artifacts, dependencies, conditional compilation, or build inputs are present in the supplied scope. Review was static only. Skill basis: supplied unsafe-Rust package. + +Let `D` be exactly: Rust compiler and standard library 1.82.0; every target on which this source and the used 1.82.0 standard-library items exist; every ordinary profile. This preserves the requester’s symbolic target predicate rather than inventing a finite target list. + +**SOUND-CURRENT — UNSOUND over `D`.** Claim: every well-typed safe use of the public surfaces `Slot`, `Tail`, and `increment` is free of Rust undefined behavior. Finding F1 gives a valid safe-use UB witness. It is target-, edition-, optimization-, overflow-check-, and panic-strategy-independent, so it refutes the claim in every case in `D`. No proposal below affects this verdict. + +**REQ-TAIL — PROVED over `D`.** For every initial `[a, b]: [u32; 2]`, `increment::` returns normally with `[a, b.wrapping_add(1)]` and no UB. This is the requester’s required crate-owned behavior, not an inferred documented guarantee of the otherwise undocumented current API. + +There are no documented unsafe-API postconditions: the crate declares no unsafe API. The requested Tail behavior is assessed separately above. + +## Boundary and obligation inventory + +All items are at crate root. `Slot` is a public **safe** trait; its required associated function `index` is public by default. `Tail` is a public unit struct, with a safe `Slot` implementation returning `1`. `increment` is a public safe generic function accepting every safe implementation satisfying the type bound. Its sole unsafe operation is `pair.get_unchecked_mut(S::index())`; the returned exclusive reference is then read via `wrapping_add(1)` and written. + +There is no representation invariant. The only needed local proposition is `S::index() < 2` at line 16. No type, validation, privacy boundary, or trait contract establishes it. The `unsafe` block has no adjacent safety proof. + +| ID | Obligation | Status | +|---|---|---| +| O1 | Every safe `Slot` implementation used with `increment` returns an index below 2. | False; F1 | +| O2 | At line 16, the unchecked index is in bounds. | False for F1; true for `Tail` | +| O3 | For `Tail`, only element 1 changes, to modular old-value-plus-one. | Proved below | +| O4 | `Required = D` is covered. | F1 and the Tail proof are parametric over all of `D` | + +## F1 — safe implementer controls an unchecked index + +**Implementation classification:** UNSOUND. **Proof artifact:** missing, and no correct proof exists for the current generic contract. + +A downstream crate can write entirely safe code equivalent to: + +```rust +struct OutOfBounds; +impl Slot for OutOfBounds { + fn index() -> usize { 2 } +} + +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +This is a valid in-scope use. Rust 1.82 says a `pub` item is externally accessible when its ancestor modules are accessible, and associated items in a public trait are public by default ([visibility](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy)). The downstream implementing type is local there, satisfying the orphan rule’s local-type alternative ([trait implementations](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). `Slot` is not an unsafe trait; Rust reserves `unsafe trait`/`unsafe impl` for extra implementer safety conditions ([unsafe traits](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). Thus neither defining the implementation nor calling `increment` requires an unsafe act or an undocumented obligation from this caller. + +The call reaches line 16 with a slice of length 2 and index 2. Rust 1.82 specifies that calling `get_unchecked_mut` with an out-of-bounds index is undefined behavior even if the resulting reference is unused ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). The false required proposition is `2 < 2`. The UB occurs at the call itself. Rust also states that an unsafe block asserts its operations’ extra safety conditions have been discharged; it does not impose them on callers of a containing safe function ([unsafe functions/blocks](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). This closes valid use → reachability → false safety condition → documented UB. + +No UB-free postcondition counterexample is needed or claimed. Minimum repair is to stop relying on an unenforced safe-implementer property: check the index, make and document an unsafe trait, effectively seal it, or remove the genericity. The last is preferred because only `Tail` is required. + +## Proof of REQ-TAIL + +`Tail::index()` is exactly `1`; `[u32; 2]` has length 2, hence `1 < 2`, satisfying the unchecked call’s complete stated bounds condition. The input `&mut` borrow supplies exclusive mutable access for the returned reference. Line 17 touches only that reference. Rust 1.82 defines `u32::wrapping_add` as modular addition wrapping at the type boundary ([`wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Therefore element 0 remains `a`, element 1 becomes `b + 1 mod 2^32`, and no arithmetic profile branch arises. These facts and cited contracts apply uniformly to `D`, so `D ⊆ Covered`. + +## TCB log + +**TCB-R182-1:** only the five Rust 1.82 Reference/std propositions cited above are consumed as authoritative AXIOM entries; each was checked at its exact versioned allowlisted URL. There are no SAFE-DEP, UNSAFE-DEP, external, implementation, tool, deployment, compatibility, or probabilistic assumptions. Consumers: F1 and REQ-TAIL. Re-audit on source/API change, support-domain change, or material change to any cited Rust 1.82 contract. No tool-derived evidence or prior audit was used. + +## Recommended abstraction + +Replace `Slot`, `Tail`, and generic `increment` with the single safe operation the requirement needs: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + let tail = &mut pair[1]; + *tail = tail.wrapping_add(1); +} +``` + +Its proposed contract is: for every `[a, b]`, return `[a, b + 1 mod 2^32]`; it has no caller safety precondition. The fixed array type and constant index make the selected element locally checkable, safe indexing performs the bounds enforcement, and all unsafe code, implementer obligations, invariants, and generic proof fan-out disappear. A sealed marker would preserve unnecessary machinery; an unsafe trait would export an unnecessary unsafe obligation. + +**Migration delta.** Delete the public `Slot` trait and `Tail` type; change calls from `increment::(&mut pair)` to `increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile, expressly permitted because the abstraction is unreleased and they need not be preserved. The required observable Tail behavior is unchanged. + +This design is not implemented and has no audit verdict. After implementation, freshly audit the exact new snapshot: enumerate its resulting public surface and all call sites/reexports; prove constant index 1 is in bounds for `[u32; 2]`; prove the modular postcondition and that element 0 is unchanged; confirm no generated/configuration-specific alternate implementation; and re-establish `D ⊆ Covered`. Re-audit any change to the signature, array length, chosen index, arithmetic, visibility, support predicate, or cited contracts. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/I.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/I.md new file mode 100644 index 0000000000..805e5fe938 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/I.md @@ -0,0 +1,55 @@ +# Focused literal audit and redesign + +## Claim, snapshot, and verdict + +The snapshot is exactly `target/lib.rs` as supplied. `Required` is Rust 1.82.0, every target on which this source and the used 1.82.0 standard-library items exist, every ordinary profile, and every well-typed safe use of the public API. There are no `cfg`s, features, dependencies, generated artifacts, macros, FFI, concurrency, allocator choices, or profile-sensitive arithmetic in the source. Thus the source, API, and proof obligations are identical throughout that symbolic target/profile domain; no finite target inventory is assumed. + +**Current-artifact soundness: UNSOUND.** A valid downstream safe implementation can supply an out-of-bounds index to the executed `get_unchecked_mut` call. The complete witness is below. This result is independent of the redesign. + +**Crate-owned Tail behavior: PROVED.** For every initial `pair == [a, b]` in `Required`, `increment::(&mut pair)` changes it to `[a, b.wrapping_add(1)]`. This is the separately requested behavioral subclaim, not a repair of the universal safe-API verdict. The source documents no API postcondition, so there is no additional documented-postcondition verdict. + +TCB `TCB-R003` contains only the exact Rust 1.82.0 Reference/std axioms cited below; there are no additional assumptions, dependencies, prior results, or tool-derived evidence. No source was built, executed, tested, or expanded. + +## Boundary, invariant, and obligation coverage + +The complete relevant surface is: public safe trait `Slot`; its public safe associated function `index`; public unit struct `Tail`; crate-owned safe `impl Slot for Tail`; public safe generic function `increment`; and its internal unsafe call at line 16. Public-trait associated items are public by default, and public items are externally accessible through accessible ancestors ([visibility authority](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy): “Associated items in a `pub` Trait are public by default”). A downstream crate may implement this trait for its own nominal type: the orphan rule permits an implementation when a participating type is local and the earlier uncovered-parameter restriction is met, vacuously here ([implementation authority](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations)). + +The needed generic invariant is `S::index() < 2` at line 16. Nothing owns or enforces it: `Slot` is neither private/sealed nor `unsafe`, `index` has no checked range type, and `increment` performs no check. Unsafe traits are the mechanism whose implementations accept extra safety conditions; they and their implementations require `unsafe` ([unsafe-trait authority](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits)). Here both implementation and call are ordinary safe Rust; `increment` exposes no caller safety contract. Rust 1.82 describes unsafe functions as the functions carrying compiler-unchecked caller conditions and requires the `unsafe` prefix ([unsafe-function authority](https://doc.rust-lang.org/1.82.0/reference/unsafe-keyword.html#unsafe-functions-unsafe-fn)). + +| ID | Exact obligation | Status | +|---|---|---| +| O1 | Every safe `increment::` call must give `get_unchecked_mut` an in-bounds index. | **Refuted; UNSOUND witness F1.** | +| O2 | For `Tail`, the index is in bounds. | **Proved:** the inspected impl returns literal `1`, and `[u32; 2]` has indices 0 and 1. | +| O3 | The Tail call increments exactly element 1 with wrapping arithmetic. | **Proved:** the unsafe API returns a mutable reference to the selected element when its precondition holds; assignment targets that element, while element 0 is untouched. `wrapping_add(1)` computes modular addition ([wrapping authority](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add): “Wrapping (modular) addition ... wrapping around at the boundary of the type”). | +| O4 | Configuration closure. | **Proved for O2–O3:** the derivation is parametric over every requested target/profile. O1 is refuted throughout that same domain, so a positive aggregate closure certificate is neither claimed nor needed. | + +## F1 — safe implementer causes undefined behavior + +```rust +struct Bad; +impl Slot for Bad { + fn index() -> usize { 2 } +} +let mut pair = [0u32, 0u32]; +increment::(&mut pair); +``` + +This is a valid in-scope safe use: `Bad` is local downstream, its ordinary trait implementation satisfies coherence, and `increment` is safe. The call reaches line 16 with `S::index() == 2`; a two-element array has no element 2. Rust 1.82 states: “Calling this method with an out-of-bounds index is undefined behavior,” even if the reference is unused ([`get_unchecked_mut` contract](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)). Therefore the executed operation's exact safety proposition is false and authoritative semantics supplies the UB consequence. This completes the existential `UNSOUND` certificate for every requested target/profile. Because the witness contains UB, it is not used as a postcondition refutation. + +The unsafe block has no `SAFETY` proof, but documentation alone cannot repair O1: there is no true derivation to document. The minimum generic repair would enforce bounds with safe checked indexing. Given the narrower authorized requirement, the design below is smaller. + +## Preferred provable design + +Replace the trait, marker type, generic parameter, and unsafe operation with one safe specialized function: + +```rust +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Its contract is: for every initial `[a, b]`, normal return leaves `[a, b.wrapping_add(1)]`; it has no caller-side safety precondition. It has no invariant-bearing representation, implementer boundary, or unsafe/TCB premise. The array type fixes the length, literal index 1 supplies the needed projection locally, and `wrapping_add` supplies the required overflow behavior. + +Migration deletes `Slot` and `Tail`; `increment::(&mut pair)` becomes `increment(&mut pair)`. Downstream `Slot` implementations and generic calls cease to compile. Those are deliberate contract/API removals authorized because the abstraction is unreleased and only Tail behavior must remain. + +This proposal is not implemented and has no artifact verdict. After implementation, freshly audit the exact new snapshot: enumerate its public surfaces and any newly introduced configuration/generated code; verify safe indexing is in bounds for `[u32; 2]`; prove the exact element-0 preservation and modular element-1 postcondition; confirm removal/migration of every old trait/generic consumer; and re-establish target/profile closure. Re-audit on any source, signature, behavioral contract, Rust version, supported-target/profile, or standard-library-contract change. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/J.md b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/J.md new file mode 100644 index 0000000000..a2cb2e7bae --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/reports/J.md @@ -0,0 +1,82 @@ +# Focused unsafe-Rust audit and redesign + +## Claim, snapshot, and verdicts + +Snapshot: the supplied `lib.rs` exactly as inspected; scope is its complete surface (`Slot`, `Tail`, their associated items/impl, and `increment`). `REQUEST.md` supplies the only behavioral requirement. No generated artifacts, dependencies, prior audit, build tooling, or tests are used. This is a source-level Rust-abstract-semantics review. + +`DOMAIN-R` is + +`rustc = std = 1.82.0 ∧ target supports this exact source and the used 1.82.0 items ∧ profile is ordinary`. + +The proof is parametric over every such target, profile, and Rust-1.82-supported edition in which the source compiles. + +| Claim | Verdict | Certificate | +|---|---|---| +| Every well-typed safe use of the current public surface is UB-free | **UNSOUND** throughout `DOMAIN-R` | `F-UB` below gives a valid safe witness in every case. | +| `increment::` changes `[a,b]` to `[a,b.wrapping_add(1)]` | **PROVED** throughout `DOMAIN-R` | `P-TAIL`; `Covered = DOMAIN-R`, hence `Required ⊆ Covered`. | +| Source-documented postconditions | none | No `CONTRACT-BROKEN` verdict applies. The requested Tail behavior is proved separately above. | + +The redesign authorization does not narrow the current artifact's safe public contract, so the proposal below does not affect **UNSOUND**. + +## Boundary, invariants, and obligations + +Safe surfaces are the public safe trait `Slot`, its safe associated function `index`, downstream implementations, public unit type/constructor `Tail`, its implementation, and public safe generic function `increment`. The only unsafe site is `pair.get_unchecked_mut(S::index())`. There are no fields, unsafe traits/impls, macros, hidden items, callbacks, FFI, concurrency, custom allocation, or destruction behavior relevant to that site. + +There is no enforced invariant. The needed proposition `S::index() < 2` cannot be an invariant of every `S: Slot`: `Slot` is public, safe, and unsealed, and neither its type system nor a check constrains the return value. + +| ID | Exact obligation | Status | +|---|---|---| +| O-BOUNDS | At the unsafe call, `S::index()` indexes the two-element slice in bounds. | **Refuted** for the generic safe surface by `F-UB`; proved for `S=Tail`. | +| O-TAIL | On normal return for `Tail`, mutate only element 1 to its old value plus one modulo `2^32`. | **PROVED** by `P-TAIL`. | +| O-DOC | Adjacent proof must derive O-BOUNDS from enforceable facts. | **Missing**, and no truthful generic derivation exists. | + +### F-UB — complete existential certificate + +A downstream crate can write entirely safe code: + +```rust +struct Bad; +impl Slot for Bad { fn index() -> usize { 2 } } + +let mut pair = [0, 0]; +increment::(&mut pair); +``` + +`Slot` and `increment` are externally reachable public items under the Rust 1.82 [visibility rules](https://doc.rust-lang.org/1.82.0/reference/visibility-and-privacy.html#visibility-and-privacy). Because `Bad` is downstream-local, this implementation satisfies the [trait-implementation coherence/orphan rules](https://doc.rust-lang.org/1.82.0/reference/items/implementations.html#trait-implementations). `Slot` is not an [unsafe trait](https://doc.rust-lang.org/1.82.0/reference/items/traits.html#unsafe-traits), so neither implementation nor call accepts a safety obligation. + +The call reaches `get_unchecked_mut(2)` on a slice of length 2. Its exact 1.82.0 contract says: “Calling this method with an out-of-bounds index is undefined behavior” ([`get_unchecked_mut`](https://doc.rust-lang.org/1.82.0/std/primitive.slice.html#method.get_unchecked_mut)); it expressly applies even when the result is unused. Thus the executed unsafe operation's required proposition is false and Rust's contract entails UB. No earlier operation in the witness is unsafe. `2` and `[u32; 2]` exist in every `DOMAIN-R` case, and cfg/profile/optimization does not alter this path. + +### P-TAIL — reconstructed local proof + +`Tail::index()` is definitionally `1`; `[u32; 2]` has length 2, so `1 < 2`. The unsafe method therefore returns a mutable reference to element 1. There is no intervening call or escaped alias. Rust 1.82 documents `wrapping_add` as “Wrapping (modular) addition” ([`u32::wrapping_add`](https://doc.rust-lang.org/1.82.0/std/primitive.u32.html#method.wrapping_add)). Assigning that result through the reference changes element 1 to `(old + 1) mod 2^32`; element 0 is untouched. This material derivation is absent from the source, but it proves only the Tail case and cannot repair the generic contract. + +## Configuration closure and TCB + +The controlling expression is exactly `DOMAIN-R`; no normalization or exclusion was added. Actual axes are target, ordinary profile, and compiling Rust-1.82 edition. There is one handwritten, unconditional path. Fixed array length, index values, the UB witness, and modular arithmetic are independent of those axes, giving parametric coverage. There are no sampled configurations or tool-derived claims. + +TCB log `TCB-R016-r1` has no additional assumptions. Its accepted authoritative axioms are: `AX-GET`, the quoted Rust-1.82 `get_unchecked_mut` contract (consumer O-BOUNDS); `AX-WRAP`, the quoted Rust-1.82 modular-addition contract (O-TAIL); and `AX-TRAIT`, the linked Rust-1.82 visibility, implementation, and unsafe-trait rules (F-UB). Exact identities are the linked versioned pages; scope is `DOMAIN-R`. Re-audit on source/API changes, Rust or support-domain changes, or material changes to those pages. + +## Finding and required resolution + +`F-UB` is an implementation defect in the current safe generic API; severity critical. The proof artifact is also missing: there is no `SAFETY` comment. Adding prose such as “implementers return an in-bounds index” would leave a hidden safety precondition on a safe trait and would not fix the defect. A generic design would need enforcement (for example, checked indexing) or an unsafe/sealed implementer boundary. The stated requirement needs no genericity, making those larger contracts unnecessary. + +## Preferred redesign + +Remove `Slot`, `Tail`, the type parameter, and all unsafe code: + +```rust +/// Replaces `[a, b]` with `[a, b.wrapping_add(1)]`. +pub fn increment(pair: &mut [u32; 2]) { + pair[1] = pair[1].wrapping_add(1); +} +``` + +Contract: every well-typed safe call has no safety precondition beyond the parameter type; on return element 0 equals its old value and element 1 equals its old value plus one modulo `2^32`. The array type makes index 1 in bounds, safe indexing enforces bounds regardless, and `wrapping_add` supplies the exact arithmetic. There is no invariant, unsafe boundary, implementer obligation, or additional TCB premise. + +Migration: `increment::(&mut pair)` becomes `increment(&mut pair)`. The `Slot` implementation surface, generic calls, and nominal `Tail` type disappear; the request expressly authorizes those breaking changes and says the abstraction is unreleased. Tail's observable required effect is unchanged. + +This sketch is **not implemented and has no audit verdict**. After implementation, freeze a new snapshot and freshly audit every remaining/reexported safe surface; verify removal of the trait, impls, and unsafe site; prove index 1 in bounds, element 0 unchanged, and the wrapping postcondition; redo `DOMAIN-R` configuration closure; and review the final documentation and migrated consumers. + +## Residual scope + +Binary/backend correctness, non-ordinary configurations, other Rust releases, and any source not supplied are excluded. No target was built, tested, executed, or macro-expanded. diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/score.schema.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/score.schema.json new file mode 100644 index 0000000000..ab7adee463 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/packets/R/s2/score.schema.json @@ -0,0 +1,91 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "unsafe-rust-v4-focused-blind-score-v1", + "type": "object", + "additionalProperties": false, + "required": ["schema_version", "mode", "scorer_id", "reports", "ambiguities"], + "properties": { + "schema_version": {"const": 1}, + "mode": {"enum": ["P", "B", "L", "Q", "R"]}, + "scorer_id": {"enum": ["s1", "s2"]}, + "reports": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "label", + "atoms", + "hard_errors", + "proposal_laundering", + "tcb_authority_defect", + "visible_scope_defect", + "novel_findings" + ], + "properties": { + "label": {"type": "string", "pattern": "^[A-J]$"}, + "atoms": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "required": ["id", "decision", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^[PBLQR][1-9][0-9]*$"}, + "decision": {"enum": ["PASS", "FAIL"]}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + }, + "hard_errors": { + "type": "array", + "items": {"$ref": "#/$defs/hard_error"} + }, + "proposal_laundering": {"$ref": "#/$defs/flag"}, + "tcb_authority_defect": {"$ref": "#/$defs/flag"}, + "visible_scope_defect": {"$ref": "#/$defs/flag"}, + "novel_findings": { + "type": "array", + "items": {"$ref": "#/$defs/novel_finding"} + } + } + } + }, + "ambiguities": { + "type": "array", + "items": {"type": "string", "pattern": "\\S"} + } + }, + "$defs": { + "hard_error": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^(G[1-9][0-9]*|[PBLQR]H[1-9][0-9]*)$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "novel_finding": { + "type": "object", + "additionalProperties": false, + "required": ["id", "evidence"], + "properties": { + "id": {"type": "string", "pattern": "^N[1-9][0-9]*$"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + }, + "flag": { + "type": "object", + "additionalProperties": false, + "required": ["present", "evidence"], + "properties": { + "present": {"type": "boolean"}, + "evidence": {"type": "string", "pattern": "\\S"} + } + } + } +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/B/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/B/s1.json new file mode 100644 index 0000000000..321da00d31 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/B/s1.json @@ -0,0 +1,298 @@ +{ + "schema_version": 1, + "mode": "B", + "scorer_id": "s1", + "reports": [ + { + "label": "H", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Defines the three targets, both burst and allocator states, all profiles, both debug states, every u8, and only wasm32/arena excluded under Rust/Cargo 1.85.1."}, + {"id": "B2", "decision": "FAIL", "evidence": "Calls the six classes exhaustive, but AX-ENV omits Result's Ok/Err exhaustiveness and tuple-struct-pattern semantics needed to exclude another outcome."}, + {"id": "B3", "decision": "FAIL", "evidence": "The R,S success row lacks verified block sequencing, successful println line effect, and implicit main-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The R,A success row asserts normal return without verified source-order, successful-output, or function-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "It states R,A then explicit panic/no library, but the completed-line and source-order premises are not verified by its authorities."}, + {"id": "B6", "decision": "FAIL", "evidence": "The R-only rejection rows lack tuple-pattern/source-order and successful-line authority sufficient for both raw classes."}, + {"id": "B7", "decision": "FAIL", "evidence": "Although q models failed-call bytes, no block-order or successful-println premise verifies the prior completed R prefix at allocator-write failures."}, + {"id": "B8", "decision": "FAIL", "evidence": "The Cargo qualification is conspicuous, but the successful/failing local traces and exact Rust cfg selection needed for composition remain unproved."}, + {"id": "B9", "decision": "FAIL", "evidence": "BUILD-2 states the requested sequence, but relies on unverified R-before-A successful and arena-stop local traces."}, + {"id": "B10", "decision": "FAIL", "evidence": "CFG-1 asserts all(...) truth and cfg inclusion without verifying all, key/value-option truth, and true/false cfg-attribute rules."}, + {"id": "B11", "decision": "FAIL", "evidence": "The U/not-U body partition is asserted without verified all/not, key/value, and true-versus-false cfg semantics."}, + {"id": "B12", "decision": "FAIL", "evidence": "The UNSOUND witness reaches the first body only through the incomplete build/cfg derivation, so authoritative reachability is missing."}, + {"id": "B13", "decision": "FAIL", "evidence": "The formula is correct, but both containments rely on the unverified body/build partition and unverified false-if flow."}, + {"id": "B14", "decision": "FAIL", "evidence": "The regional zero argument relies on the unverified complementary cfg selection and build-to-source closure."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED is stated correctly, but its required UB and regional-panic certificates are incomplete because B12/B14 are unproved."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It issues UNSOUND while supported-Q reachability rests on unverified build-return and exact cfg-selection premises."}, + {"id": "BH7", "evidence": "SOUND-1 lacks a valid authoritative reachability link from raw arena through the current library to the unchecked body."}, + {"id": "G11", "evidence": "Its positive build/source conclusions necessarily use unchecked Rust block, println-success, return, and all/not semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly future work requiring re-audit and is not used for any current verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is bounded, but multiple material Rust premises supporting PROVED/UNSOUND claims are not verified by applicable versioned text."}, + "visible_scope_defect": {"present": false, "evidence": "The report describes only supplied target files/policies and allowed source-level authorities; it evidences no prohibited evaluator material."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Supported names every target, feature/allocator state, profile, debug state, u8 value, Rust/Cargo 1.85.1, and only the wasm32/arena exclusion."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six rows are stated exhaustive, but Result exhaustiveness and tuple-struct enum-pattern semantics are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "R,S and normal success are asserted, but successful println output, tuple-pattern handling of NotPresent, and implicit return are not authoritatively established."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row has the right endpoint but lacks verified successful-output and implicit-function-return premises for the complete trace."}, + {"id": "B5", "decision": "FAIL", "evidence": "The arena-stop row has the right panic/no-library result, but successful A-line completion is not verified by the cited println premise."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode rows are present, but successful R output and tuple-struct-pattern semantics are incomplete."}, + {"id": "B7", "decision": "FAIL", "evidence": "It handles failed calls and incomplete bytes, but the completed R prefix used after second-write failure lacks a verified successful-println effect."}, + {"id": "B8", "decision": "FAIL", "evidence": "Exact TCB consumers are listed, but upstream successful traces and Rust all/not source selection are incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness prose is exact, yet the prerequisite successful arena and completed-line local trace lacks full Rust authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The exclusion uses all(...) without verifying Rust all/key-value truth semantics, and depends on incomplete successful-selector closure."}, + {"id": "B11", "decision": "FAIL", "evidence": "It calls the blocks complementary but never verifies all/not configuration semantics or complete build-to-source reachability."}, + {"id": "B12", "decision": "FAIL", "evidence": "The witness states all four ideas, but authoritative reachability through the successful arena build and selected block is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M has the intended formula, but the positive and complement proofs consume the unproved body/build partition."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-C zero proof is conditional on an unproved current-source partition and therefore does not cover the required build relation."}, + {"id": "B15", "decision": "FAIL", "evidence": "It gives the intended UNPROVED wording, but the underlying B12 and B14 derivations are incomplete."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued without an authoritative complete reachability chain through normal build-script return and exact cfg selection."}, + {"id": "BH7", "evidence": "The asserted witness lacks a validly established supported-current-library reachability link."}, + {"id": "G11", "evidence": "PROVED and UNSOUND conclusions necessarily rely on unchecked successful-println, function-return, Result-pattern, and all/not premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The suggested repair is not treated as implemented or as support for the current verdicts."}, + "tcb_authority_defect": {"present": true, "evidence": "The TCB itself is kept narrow, but material Rust premises for build completion and cfg selection are not verified."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing in the report establishes inspection beyond the supplied crate/policies and versioned documentation."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "F/C include Rust and Cargo 1.85.1, the three supported targets, both feature/allocator/debug states, every profile/u8, and only W/arena excluded."}, + {"id": "B2", "decision": "FAIL", "evidence": "The table lists all six classes, but exact Result/VarError variant exhaustiveness and literal/wildcard/tuple-pattern semantics are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "The two system rows lack verified enum/literal pattern selection and implicit main-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row states R,A0 success but does not verify literal-pattern selection or normal function return."}, + {"id": "B5", "decision": "FAIL", "evidence": "R,A0 then panic/no library is stated, but reaching the arena-stop arm is unsupported by applicable literal-pattern authority."}, + {"id": "B6", "decision": "FAIL", "evidence": "The rejection rows are correct textually, but wildcard and NotUnicode tuple-pattern selection are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Explicitly covers first-write failure, every allocator-write failure, prior [R], incomplete failed-call bytes, panic, and no library under the exact TCB."}, + {"id": "B8", "decision": "FAIL", "evidence": "Cargo effects are narrowly qualified, but the successful local traces and exact Rust cfg truth/selection relation remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The requested stale-build outcomes are enumerated, but prerequisite arena/arena-stop path selection and successful return are unverified."}, + {"id": "B10", "decision": "FAIL", "evidence": "It asserts the wasm32/arena all predicate and converse without verifying all, option-truth, and false-cfg removal semantics."}, + {"id": "B11", "decision": "FAIL", "evidence": "Q/not-Q are called complementary without verified all/not cfg rules and complete successful mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "The stated safe zero witness lacks a valid authoritative source-reachability derivation."}, + {"id": "B13", "decision": "FAIL", "evidence": "The maximal formula and case split are correct, but rely on unproved cfg/build reachability and false-if behavior."}, + {"id": "B14", "decision": "FAIL", "evidence": "The regional panic assertion lacks a complete cfg/body and false/true conditional-semantics derivation over Required."}, + {"id": "B15", "decision": "FAIL", "evidence": "The verdict is worded correctly, but neither its complete UB certificate nor regional proof is established."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "The UNSOUND verdict rests on an incompletely authorized successful-selector and cfg-body reachability chain."}, + {"id": "BH7", "evidence": "The existential certificate's reachability link is not validly established from the cited Rust premises."}, + {"id": "G11", "evidence": "The report necessarily relies on unchecked Result/pattern, function-return, and all/not semantics for its affirmative conclusions."} + ], + "proposal_laundering": {"present": false, "evidence": "Its repair is explicitly prospective and not used to certify the supplied implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "Although BUILD-MAP-ORDERED is bounded, required Rust semantic leaves for exhaustive paths and cfg selection are missing."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences review only of supplied target material and versioned allowed authorities."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "S exactly states all target, burst, allocator, profile/debug, and u8 axes under 1.85.1, excluding only wasm32/arena."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six classes are explicitly called exhaustive, but Result's two-way shape and tuple-struct enum matching are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "Absent/system R,Sline normal return lacks verified successful-println and implicit-return premises, with tuple matching also omitted for absence."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena success trace asserts a complete Aline and normal return without verifying println success or function-body return."}, + {"id": "B5", "decision": "FAIL", "evidence": "The arena-stop ordering is stated, but completion of R/Aline on successful println calls is not verified."}, + {"id": "B6", "decision": "FAIL", "evidence": "The two R-only rejection rows lack verified successful-line and NotUnicode tuple-pattern premises."}, + {"id": "B7", "decision": "FAIL", "evidence": "q correctly avoids atomicity assumptions, but the completed [R] premise after a later failure lacks verified println-success semantics."}, + {"id": "B8", "decision": "FAIL", "evidence": "The TCB is conspicuous and cfg rules are cited, but upstream successful return/output and exhaustive selector traces are incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness sequence is exact textually, yet its successful prior [R,Aline] premise is not authoritatively established."}, + {"id": "B10", "decision": "FAIL", "evidence": "The conditional compile_error proof is correct in isolation, but effective build closure depends on the incomplete successful-arena mapping in B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "all/not semantics are stated, but the exact supported current-source partition still depends on the incomplete B4/B8 mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "Valid use, false precondition, and UB are stated; the authoritative current-library reachability link is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M and both set arguments are stated, but every excluded-case UB proof consumes the incomplete reachability certificate."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-K zero source argument is present, but the required build-to-body coverage remains incomplete."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED/not-CONTRACT-BROKEN is correct, but the report has not completed the prerequisite whole UB and regional coverage proofs."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It reports UNSOUND while the supported-current-library reachability link lacks verified successful-output and function-return semantics."}, + {"id": "BH7", "evidence": "F-1's reachability certificate is incomplete even though its false-precondition and UB links are correct."}, + {"id": "G11", "evidence": "Its PROVED/UNSOUND results necessarily rely on unchecked Result/tuple, println-success, and function-return premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed check is clearly a future repair followed by re-audit, not current evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is not widened, but material Rust semantics needed for current selector success and exhaustiveness are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "No report text evidences access to prohibited evaluation, sibling, oracle, or condition material."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q/U include Rust/Cargo 1.85.1, exact targets, both feature/allocator/debug states, every profile and u8, with only wasm32/arena removed."}, + {"id": "B2", "decision": "FAIL", "evidence": "It calls the partition exhaustive but explicitly lets BUILD.md supply it; Result/VarError exhaustiveness and exact pattern behavior are not verified as Rust semantics."}, + {"id": "B3", "decision": "FAIL", "evidence": "The system rows lack exact match/pattern and implicit-return authority despite showing the intended R,L_s endpoint."}, + {"id": "B4", "decision": "FAIL", "evidence": "The arena row shows R,L_a success but does not verify exact literal-arm selection or falling-through main return."}, + {"id": "B5", "decision": "FAIL", "evidence": "Its arena-stop prefix/panic outcome is correct, but reaching that literal arm is not established by the cited vague match premise."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode outcomes are listed, but wildcard and tuple-struct pattern semantics are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Covers failed first and every applicable second write, earlier complete R, arbitrary failed-call bytes, panic exits, and exact TCB no-library consequences."}, + {"id": "B8", "decision": "FAIL", "evidence": "Exact TCB use is described, but selector success/exhaustiveness and Rust cfg all/not source selection remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The three rerun failures are right, but the prior-success and arena-stop arm derivations rely on unchecked local Rust semantics."}, + {"id": "B10", "decision": "FAIL", "evidence": "B-03 asserts all(...) and exact rejection without verifying all/key-value cfg semantics or complete B8 mapping."}, + {"id": "B11", "decision": "FAIL", "evidence": "The C/not-C block split is asserted without version-matched all/not and false-cfg semantics, atop incomplete mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "F-01 states four bullets, but supported current-source reachability is not validly established by the report's authorities."}, + {"id": "B13", "decision": "FAIL", "evidence": "S has the intended formula, but its complement proof relies on the incomplete cfg/build reachability chain."}, + {"id": "B14", "decision": "FAIL", "evidence": "S-01's zero panic proof is only conditional on an unproved complementary source selection."}, + {"id": "B15", "decision": "FAIL", "evidence": "POST-01 gives the intended verdict, but B12/B14 are not complete applicable derivations."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued without a valid authoritative reachability link through the accepted raw arena path and cfg body."}, + {"id": "BH7", "evidence": "F-01's current-library/source reachability link is incomplete despite correct zero and UB propositions."}, + {"id": "G11", "evidence": "The report expressly uses BUILD.md to supply a Rust-semantic raw partition and also omits material return/all-not authorities."} + ], + "proposal_laundering": {"present": false, "evidence": "No proposed repair is used to narrow or certify the current artifact; it calls for re-audit."}, + "tcb_authority_defect": {"present": true, "evidence": "It treats BUILD.md as supplying the complete raw semantic partition and leaves other material Rust cfg/return premises unchecked."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no access outside supplied source/policy material and allowed documentation."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C/S/U recover all exact release, target, feature, allocator, profile/debug, and u8 cases with only W/arena excluded."}, + {"id": "B2", "decision": "PASS", "evidence": "Explicitly gives the six disjoint raw classes and verifies Result, VarError, as_str, first-match, literal, tuple, and wildcard exhaustiveness."}, + {"id": "B3", "decision": "FAIL", "evidence": "The R,CS rows assert return success, but no versioned function-body premise establishes implicit normal return after the final println."}, + {"id": "B4", "decision": "FAIL", "evidence": "The R,CA arena row likewise lacks authoritative implicit-return completion despite correct order/output reasoning."}, + {"id": "B5", "decision": "PASS", "evidence": "Shows arena-stop as [R,CA], then explicit panic, unsuccessful exit, and no current library; allocator-write failure is separately distinguished."}, + {"id": "B6", "decision": "PASS", "evidence": "Both other-Unicode and non-Unicode reach explicit panic with exactly prior complete [R], no allocator attempt, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "Enumerates common and all class-specific println failures, prior successful prefixes, arbitrary failed-call bytes, no later steps, and exact TCB rejection."}, + {"id": "B8", "decision": "FAIL", "evidence": "Cargo/cfg composition is otherwise exact, but the only-successful-return premise consumes unverified implicit main-return semantics from B3/B4."}, + {"id": "B9", "decision": "PASS", "evidence": "Conditioning on a prior successful arena build, it proves R preceded CA; the exact TCB then stales arena, forces the arena-stop rerun, and rejects every rerun exit without reuse."}, + {"id": "B10", "decision": "FAIL", "evidence": "The compile_error proof is exact conditionally, but effective build-to-source closure still depends on the incomplete successful-arena B8 derivation."}, + {"id": "B11", "decision": "FAIL", "evidence": "The all/not body proof is exact conditionally, but current supported-source reachability depends on the incomplete B4/B8 success relation."}, + {"id": "B12", "decision": "FAIL", "evidence": "Safe use, false NZ, and zero-UB are authoritative; current-library reachability remains incomplete at the build-script normal-return edge."}, + {"id": "B13", "decision": "FAIL", "evidence": "M/WIT are algebraically exact, but maximality consumes the incomplete supported reachability certificate."}, + {"id": "B14", "decision": "FAIL", "evidence": "The zero-source proof is correct conditionally, but Required-to-current-body coverage is incomplete through B8/B11."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended UNPROVED reasoning is present, but its prerequisite complete B12 and B14 certificates do not hold."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It issues UNSOUND although the current supported library reachability link omits verified implicit-return semantics."}, + {"id": "BH7", "evidence": "F-UB's raw-arena-to-current-library reachability certificate is incomplete at normal main return."}, + {"id": "G11", "evidence": "Its build/source and maximality affirmatives necessarily rely on unchecked function-return semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "F-UB's remediation is future code requiring re-audit, not evidence for this snapshot."}, + "tcb_authority_defect": {"present": true, "evidence": "The exact TCB is carefully bounded, but normal build-script return is a material unverified Rust premise used by positive verdicts."}, + "visible_scope_defect": {"present": false, "evidence": "No prohibited evaluation or sibling material is mentioned or otherwise evidenced."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "R names 1.85.1, all three support targets, both feature/allocator/debug states, every profile/u8, and removes exactly Wasm/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The six raw classes are exhaustive via explicitly verified env::var, Result, VarError, match, tuple/literal/wildcard, and as_str propositions."}, + {"id": "B3", "decision": "FAIL", "evidence": "Absent/system [RERUN,CS] normal return is asserted without verified println success or implicit function-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "Arena [RERUN,CA] normal return lacks verified completed-line and implicit-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "Arena-stop's later panic is right, but successful CA completion is not verified because AX-EXIT covers only println failure."}, + {"id": "B6", "decision": "FAIL", "evidence": "Both rejection classes are partitioned correctly, but the completed RERUN prefix lacks verified successful println output semantics."}, + {"id": "B7", "decision": "FAIL", "evidence": "It handles every failure and arbitrary partial bytes, but the required preceding completed [RERUN] is not supported by a verified successful-println proposition."}, + {"id": "B8", "decision": "FAIL", "evidence": "The TCB and cfg stages are explicit, but the successful/failure local relation remains incomplete through B3-B7."}, + {"id": "B9", "decision": "FAIL", "evidence": "Freshness outcomes are enumerated, but the prior successful [RERUN,CA] trace lacks output/return authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The wasm/arena cfg proof is correct conditionally, but actual effective closure depends on incomplete B8 selector success."}, + {"id": "B11", "decision": "FAIL", "evidence": "AX-CFG proves complementarity conditionally, but supported current-source selection depends on incomplete B4/B8."}, + {"id": "B12", "decision": "FAIL", "evidence": "The zero/NZ/UB links are correct, but current Q-library reachability is incomplete at successful script output/return."}, + {"id": "B13", "decision": "FAIL", "evidence": "Smax and the four cases are exact algebraically, but every-complement UB reachability is not completely established."}, + {"id": "B14", "decision": "FAIL", "evidence": "The checked-body zero proof is correct conditionally, but complete Required-to-body coverage through B8 is absent."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended verdict is stated, but B12/B14 do not provide complete applicable certificates."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "The report issues UNSOUND without a fully verified successful-build reachability link."}, + {"id": "BH7", "evidence": "Its A64/on/arena safe-call certificate is incomplete at println success and normal main return."}, + {"id": "G11", "evidence": "PROVED/UNSOUND conclusions necessarily rely on unchecked successful-println and function-return semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "Repair options are explicitly prospective and do not certify the current implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED is bounded correctly, but material successful-output and normal-return Rust premises are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences no inspection of prohibited oracle, evaluator, sibling, or condition material."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C exactly includes Rust/Cargo 1.85.1, all listed target/feature/allocator/profile/debug/u8 cases, and only the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "Verifies env::var, both Result/VarError variants, as_str, match, tuple/literal/wildcard rules and states the exact six-class exhaustive partition."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent and Unicode system are traced R then READ then S then normal main return, with exactly [R,S] and no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena is traced R then READ then A then normal return, with exactly [R,A] and no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "arena-stop yields [R,A] then explicit panic after successful writes and no current compilation under exact BUILD-MAP-ORDERED."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode each leave only completed [R], attempt no allocator line, explicitly panic, and produce no library."}, + {"id": "B7", "decision": "PASS", "evidence": "Covers first-write and every applicable allocator-write failure, prior complete prefixes, no later operation, and no current library without consuming failed bytes."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful system/arena returns feed exact allocator cfgs; admitted feature/target mappings plus verified cfg semantics select source, with TCB scope conspicuous."}, + {"id": "B9", "decision": "PASS", "evidence": "Proves prior arena wrote R before A, present-to-present change stales it, exhaustive rerun failures yield no current or reused library."}, + {"id": "B10", "decision": "PASS", "evidence": "For all feature/profile/debug fibers, wasm32 plus arena retains compile_error and fails; all other pairs remove it, and E is outside C."}, + {"id": "B11", "decision": "PASS", "evidence": "Defines B as the exact three-leaf conjunction and proves the first block versus not(B) checked block are exhaustive and complementary."}, + {"id": "B12", "decision": "PASS", "evidence": "A supported aarch64/burst/arena lane_id(0) safe use reaches new_unchecked(0), falsifies nonzero, invokes the exact zero-UB contract, and yields UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND = C×u8 minus B/zero; proves all included cases sound and every excluded case UB, establishing exact maximality relative to the TCB."}, + {"id": "B14", "decision": "PASS", "evidence": "Every zero case outside B selects the checked body, equality reaches panic before unsafe, covering all target/allocator/feature/profile/debug fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "States whole zero-panic theorem UNPROVED, not CONTRACT-BROKEN/PROVED, because B/zero has UB while every other zero case is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The report treats repair as future implementation followed by re-audit, never as current evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "It identifies exact BUILD-MAP-ORDERED identity/consumers/exclusions and verifies material Rust propositions with applicable versioned authorities."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing indicates inspection beyond the supplied target and exact versioned documentation."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q/L/U include Rust/Cargo 1.85.1, exact targets, both feature/allocator/debug states, every profile/u8, and sole wasm32/arena exclusion."}, + {"id": "B2", "decision": "FAIL", "evidence": "It states exact Result/VarError and literal/wildcard cases, but does not verify match-arm choice or tuple-struct enum-pattern semantics."}, + {"id": "B3", "decision": "FAIL", "evidence": "The [R,S] system returns lack verified match selection and implicit function-return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "The [R,A] arena return lacks verified match-arm and falling-through-main return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "The complete arena-stop prefix/panic is stated, but exact arm selection is unsupported without match semantics."}, + {"id": "B6", "decision": "FAIL", "evidence": "The R-only rows are stated, but NotUnicode tuple matching and match control are not verified."}, + {"id": "B7", "decision": "PASS", "evidence": "Defines prefixes as earlier successful complete lines, leaves failed-call bytes unconstrained, and covers every write failure, later-step cutoff, and no-library result."}, + {"id": "B8", "decision": "FAIL", "evidence": "The Cargo mapping is exact conditionally, but upstream selector partition/success traces lack match and return authority."}, + {"id": "B9", "decision": "FAIL", "evidence": "The stale sequence is complete textually, but the successful arena and arena-stop source paths are not validly established."}, + {"id": "B10", "decision": "FAIL", "evidence": "The compile_error argument is correct conditionally, but effective current-build mapping remains incomplete through B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "Cfg all/not semantics are supplied, but the supported current-source partition depends on incomplete B4/B8 reachability."}, + {"id": "B12", "decision": "FAIL", "evidence": "Zero falsity and UB are authoritative, but the safe call's current-library reachability is incomplete."}, + {"id": "B13", "decision": "FAIL", "evidence": "M has the exact intended set shape, but inclusion/maximality also use unverified if/comparison behavior and incomplete reachability."}, + {"id": "B14", "decision": "FAIL", "evidence": "It asserts zero enters the checked panic without verifying Rust if/comparison semantics or complete build-to-body coverage."}, + {"id": "B15", "decision": "FAIL", "evidence": "UNPROVED is stated, but its UB and regional-panic prerequisite proofs are incomplete."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "It reports UNSOUND without a valid authoritative match/return-supported current-library reachability link."}, + {"id": "BH7", "evidence": "The stated aarch64/burst/arena certificate is incomplete at build-path and source reachability."}, + {"id": "G11", "evidence": "Its affirmative conclusions necessarily rely on unchecked match, tuple-pattern, function-return, and if/comparison semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed repair is prospective and accompanied by a re-audit requirement."}, + "tcb_authority_defect": {"present": true, "evidence": "The Cargo TCB is bounded, but several material Rust control-flow and pattern premises are absent from its authority log."}, + "visible_scope_defect": {"present": false, "evidence": "No report evidence shows access to prohibited evaluation or sibling artifacts."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "C/U recover all exact release, target, feature, allocator, profile/debug, and u8 cases and remove only wasm32/arena."}, + {"id": "B2", "decision": "FAIL", "evidence": "The six classes are stated, but Result/VarError exact variants and literal/wildcard/tuple-pattern propositions are not verified."}, + {"id": "B3", "decision": "FAIL", "evidence": "System-success rows lack verified pattern selection, successful println output, and implicit return semantics."}, + {"id": "B4", "decision": "FAIL", "evidence": "Arena success asserts CFG(arena) and return without verified literal-pattern, completed-line, or function-return premises."}, + {"id": "B5", "decision": "FAIL", "evidence": "arena-stop's complete line then panic is stated, but literal-arm reachability and successful-line semantics are unverified."}, + {"id": "B6", "decision": "FAIL", "evidence": "Other-Unicode/non-Unicode R-only rejections lack verified wildcard/tuple patterns and successful stdout-line effect."}, + {"id": "B7", "decision": "FAIL", "evidence": "It models failed-call byte prefixes and all sites, but the preceding complete RERUN relies on uncited println-success semantics."}, + {"id": "B8", "decision": "FAIL", "evidence": "BUILD-MAP use is narrow, but successful raw traces and exact Rust all/not cfg source mapping remain incomplete."}, + {"id": "B9", "decision": "FAIL", "evidence": "The freshness outcomes are correct textually, but prerequisite successful-arena and arena-stop local traces lack full authority."}, + {"id": "B10", "decision": "FAIL", "evidence": "The exclusion asserts all truth/falsehood without verifying Rust all/key-value semantics and depends on incomplete B8."}, + {"id": "B11", "decision": "FAIL", "evidence": "H/not-H selection is asserted without version-matched all/not and false-cfg authority or complete mapping."}, + {"id": "B12", "decision": "FAIL", "evidence": "BAD has the right safe-zero and UB facts, but current-body reachability rests on incomplete build/cfg derivations."}, + {"id": "B13", "decision": "FAIL", "evidence": "SOUND is algebraically right, but its positive and excluded-case proofs rely on unverified cfg and if/comparison behavior."}, + {"id": "B14", "decision": "FAIL", "evidence": "The not-H zero panic assertion has no verified if/equality semantics and lacks complete Required-to-body mapping."}, + {"id": "B15", "decision": "FAIL", "evidence": "The intended verdict is present, but B12/B14 do not supply complete applicable certificates."} + ], + "hard_errors": [ + {"id": "G5", "evidence": "UNSOUND is issued while the current-source reachability link lacks verified pattern, output, return, and cfg semantics."}, + {"id": "BH7", "evidence": "BAD's reachability chain is incomplete despite correct safe-use, false-precondition, and UB assertions."}, + {"id": "G11", "evidence": "PROVED/UNSOUND claims necessarily rely on unchecked Result/pattern, println-success, function-return, all/not, and if/comparison premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly a future change requiring re-audit and does not support a current positive verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "BUILD-MAP-ORDERED remains narrow, but numerous material Rust semantic premises are unverified."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of prohibited oracle, condition, sibling, or evaluator access."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "The frozen rules do not define how much quotation is required for a proposition correctly paraphrased beside an exact versioned URL. I credited explicit, accurate paraphrases tied to the applicable page, but not a bare page identity or a citation that states only a different clause.", + "The atom dependency lists do not explicitly prescribe mechanical failure propagation. I evaluated later atoms on whether their needed dependency propositions were actually established; an earlier atom failing only an unrelated clause did not automatically force failure.", + "B7 says failed-call byte details are not required. I treated E's empty/list prefixes as lists of earlier successfully completed directives, not as an assertion that a failing write emitted zero bytes." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/B/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/B/s2.json new file mode 100644 index 0000000000..258e9aca47 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/B/s2.json @@ -0,0 +1,258 @@ +{ + "schema_version": 1, + "mode": "B", + "scorer_id": "s2", + "reports": [ + { + "label": "C", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain section fixes Rust/Cargo 1.85.1 and all target, burst, allocator, profile, debug, and u8 cases, excluding only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered-relation table explicitly calls omitted, system, arena, arena-stop, other Unicode, and non-Unicode exhaustive."}, + {"id": "B3", "decision": "PASS", "evidence": "Its first two table rows give R then READ then the system line and normal return when both writes succeed, with no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R then READ then the arena line and normal return on successful writes, with no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "The arena-stop row gives completed R,A followed by explicit panic and states that BUILD-MAP-ORDERED produces no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other-Unicode and non-Unicode rows leave only R, panic before any allocator attempt, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It treats failed R before READ and failed system/arena writes after completed R, permits incomplete bytes, and assigns every failure no library."}, + {"id": "B8", "decision": "PASS", "evidence": "It limits cfg consumption to successful selector returns, names exact allocator, feature, and target mappings, applies Rust cfg rules, and conspicuously qualifies BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness challenge derives prior R,A, present-to-present arena-stop invalidation, rerun, exhaustive failed exits, and no stale result."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32 plus arena retains compile_error! for either feature and all profile/debug fibers, while that pair has no API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines Q as exactly aarch64/burst-on/arena and proves the two cfg bodies are the exhaustive disjoint Q and not-Q selections."}, + {"id": "B12", "decision": "PASS", "evidence": "It gives a supported safe lane_id(0) in Q, reaches new_unchecked(0), falsifies nonzero, applies the 1.85.1 UB contract, and says UNSOUND relative to BUILD-MAP-ORDERED."}, + {"id": "B13", "decision": "PASS", "evidence": "It states M = C×U minus Q/zero, proves checked and Q/nonzero sufficiency, and proves every excluded Q/zero point has UB, establishing exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every zero-input not-Q case takes the checked branch and panics before unsafe code, parametrically over profiles and debug assertions."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately reports the whole zero-panic postcondition UNPROVED, not CONTRACT-BROKEN, because Q/zero has UB while all other zero cases are proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "Repairs are explicitly future changes requiring re-audit and are not used to certify the current snapshot."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is identified and narrowly consumed only for its accepted Cargo/freshness/status mappings; Rust premises use versioned official authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied snapshot and explicitly disclaims builds, tests, prior audits, and out-of-scope binary/backend evidence."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The exact-domain section fixes 1.85.1 and defines L×U over all targets, burst states, allocators, profiles, debug states, and u8, subtracting only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "Step 2 proves the exact absent, three named Unicode, other-Unicode, and non-Unicode partition from Result, VarError, as_str, literals, and wildcard."}, + {"id": "B3", "decision": "PASS", "evidence": "Step 3 gives omitted/system as R,S then successful return when both writes succeed, and exactly the system cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "Step 3 gives Unicode arena as R,A then successful return on successful writes, and exactly the arena cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Step 4 gives arena-stop either allocator-write failure after R or completed R,A followed by explicit panic, with no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Step 4 gives other Unicode and non-Unicode explicit panic after R, no allocator line, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "Steps 1, 3, and 4 cover first and every second-write failure, preserve only earlier complete lines, allow failed-call bytes, and assign no library."}, + {"id": "B8", "decision": "PASS", "evidence": "Step 5 restricts downstream consumption to successful R,S/R,A, then maps exact allocator, burst, target cfgs, and Rust-selected source under qualified BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "Its freshness proof uses the prior R,A run, arena-to-arena-stop staleness, forced rerun, three failed outcomes, and prohibition on prior-artifact reuse."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves the wasm32/arena predicate retains compile_error! independently of burst, profile, and debug assertions and excludes that pair from L and the witness."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines C as exactly aarch64/burst-on/arena and proves cfg selects the immediate unchecked block there and the complementary checked block elsewhere."}, + {"id": "B12", "decision": "PASS", "evidence": "The opening certificate gives supported safe lane_id(0), selected unchecked reachability, false nonzero condition, exact zero-UB consequence, and an UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "M excludes exactly C/zero; the report proves every included checked or nonzero case sound and every complement fiber UB, hence exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves zero enters the checked branch and panics before unsafe code for every supported not-C configuration, with profile/debug fibers covered."}, + {"id": "B15", "decision": "PASS", "evidence": "It states the global panic promise is UNPROVED rather than CONTRACT-BROKEN or PROVED because the only uncovered zero executions contain UB."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The suggested repairs are not implemented or used as evidence for any current-snapshot verdict."}, + "tcb_authority_defect": {"present": false, "evidence": "The report names BUILD-MAP-ORDERED exactly, confines its consumers, and separately supports Rust semantics with versioned Reference/std authority."}, + "visible_scope_defect": {"present": false, "evidence": "It describes only the supplied files and expressly says no build, run, expansion, modification, prior material, or tool evidence was used."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Required is defined as Rust/Cargo 1.85.1, C×all u8, with all T×B×A×P×D fibers and exactly the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "BUILD-1 explicitly proves absent, system, arena, arena-stop, other Unicode, and non-Unicode are the exhaustive raw classes."}, + {"id": "B3", "decision": "PASS", "evidence": "The table gives omitted/system successful R,S and normal return, with exactly system selected and no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "The table gives Unicode arena successful R,A and normal return, with exactly arena selected and no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop with successful writes leaves R,A and explicitly panics; the same row and TCB qualification say no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave R, panic before an allocator print, and have no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "The table covers first-write and every class-specific second-write failure, models arbitrary failed-call fragment q, and gives no library on all failures."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selector rows feed exact allocator cfgs; BUILD-1 and the projection apply admitted feature/target mappings and Rust cfg selection with explicit TCB boundaries."}, + {"id": "B9", "decision": "PASS", "evidence": "BUILD-2 derives prior R,A, present-to-present invalidation, mandatory rerun, all three failed outcomes, and no current or stale arena library."}, + {"id": "B10", "decision": "PASS", "evidence": "CFG-1 proves wasm32/arena includes compile_error! for both feature states and all profile/debug fibers and yields no supported library."}, + {"id": "B11", "decision": "PASS", "evidence": "The source projection and U definition prove the unchecked body exactly for aarch64/burst-on/arena and the checked complementary body everywhere else."}, + {"id": "B12", "decision": "PASS", "evidence": "SOUND-1 supplies a supported safe zero call, exact selected reachability, false nonzero precondition, documented UB, and whole-domain UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "S is not-U or nonzero; the positive proof covers every member and SOUND-1 applies to every omitted U/zero fiber, proving exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "The panic section proves every supported not-U zero input executes panic before unsafe, with the domain proof retaining all profiles and debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "It gives the full panic theorem UNPROVED, not CONTRACT-BROKEN, because U/zero is UB while every other zero case is regionally proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The minimum repair is presented only as future remediation followed by re-audit, not as current evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is conspicuously limited to its exact accepted build propositions, while material Rust leaves cite 1.85.1 authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report says it used the supplied crate/policies only and no build, test, prior audit, dependency, generated material, or tool result."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "It defines S×U from Rust/Cargo 1.85.1 and the full target, feature, allocator, profile, debug, and u8 product, removing only wasm32/arena."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered table and preceding Result/VarError proof explicitly exhaust omitted, system, arena, arena-stop, other Unicode, and non-Unicode."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted and Unicode system rows give R,CS then normal success if both writes succeed, with no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R,CA then normal success if both writes succeed, with no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "The arena-stop row gives completed R,CA then explicit panic, or prior R on write failure, and TCB-ORDERED supplies no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode rows give completed R, no allocator attempt, explicit panic, and no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It enumerates common line 4 and class-specific lines 8, 12, 15, 18 failures, allows arbitrary partial bytes, and rejects every exit."}, + {"id": "B8", "decision": "PASS", "evidence": "Exactly the accepted successful classes feed current allocator cfgs; the report then applies admitted burst/target leaves and Rust cfg semantics under an explicit TCB alias."}, + {"id": "B9", "decision": "PASS", "evidence": "The same-directory proof derives prior R,CA, arena-stop staleness, rerun, all write/panic exits, and no reuse of the old library."}, + {"id": "B10", "decision": "PASS", "evidence": "The exact-exclusion section proves both directions of wasm32/arena compile_error! rejection for every feature/profile/debug fiber and no API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines K exactly as aarch64/burst-on/arena and proves the first and not-all blocks select K and its complement over all P×D."}, + {"id": "B12", "decision": "PASS", "evidence": "F-UB gives a supported safe lane_id(0), K reachability, false NZ, exact new_unchecked zero UB, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "M removes exactly WIT=K/zero; all M cases discharge NZ or panic, and each complement point has UB, proving equality and maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "The report proves every not-K zero case executes the equality branch and panic before unsafe across the supported configuration fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "It reports the universal panic contract UNPROVED, not CONTRACT-BROKEN or PROVED, because K/zero has UB and the complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed checked-constructor repair is clearly future work and does not alter the current UNSOUND/UNPROVED judgments."}, + "tcb_authority_defect": {"present": false, "evidence": "TCB-ORDERED is explicitly defined as the exact BUILD-MAP-ORDERED entry and is not widened; Rust claims use versioned official sources."}, + "visible_scope_defect": {"present": false, "evidence": "It confines the audit to supplied files and expressly excludes builds, tests, prior audits, external dependencies, backend, and binary evidence."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Its normalization gives exactly all 1.85.1 T×F×A×P×D×u8 cases except wasm32/arena, with both policy containments explicit."}, + {"id": "B2", "decision": "PASS", "evidence": "The ordered relation exhausts absent, system, arena, arena-stop, every other Unicode string, and non-Unicode using exact Result/VarError and match facts."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent and Unicode system attempt R then S and, on both successful writes, return normally with exactly system and no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena attempts R then A and, on both successful writes, returns normally with exactly arena and no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop either fails its A write after R or completes R,A then explicitly panics; the report states no current compilation follows."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode explicitly panic after R, attempt no allocator line, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers R failure before READ and every second-write failure after R, counts only complete earlier lines, and gives every failure no library."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selector runs supply exactly one allocator cfg; the report applies exact admitted feature/target cfgs and checked Rust selection without widening BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness paragraph derives prior R,A, arena-stop staleness and rerun, all three unsuccessful outcomes, and no current or earlier arena artifact."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena makes all(...) true and compile_error! fail for both feature states and all P,D, while every other tuple removes the item."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines B exactly as aarch64/burst-on/arena and proves the source cfg predicates are B and not-B, selecting exactly one corresponding body."}, + {"id": "B12", "decision": "PASS", "evidence": "The certificate chooses supported aarch64/burst-on/arena lane_id(0), reaches the unchecked call, falsifies NZ, applies exact UB text, and declares UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND excludes exactly B/zero; all included cases are proved safe or panic before unsafe, and every complement point has UB, establishing unique maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It states the exact proved panic region is every supported not-B zero case and derives equality, if, and panic before unsafe across all P,D."}, + {"id": "B15", "decision": "PASS", "evidence": "The report separately says the full postcondition is UNPROVED, not CONTRACT-BROKEN, because B/zero has UB while the exact complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "F-1's proposed repair is not implemented or used to narrow or certify the current artifact."}, + "tcb_authority_defect": {"present": false, "evidence": "It records the exact accepted BUILD-MAP-ORDERED identity and consumers, explicitly denies widening, and checks Rust leaves against 1.85.1 authority."}, + "visible_scope_defect": {"present": false, "evidence": "It identifies the supplied snapshot and says no build, execution, expansion, test, tool evidence, or additional assumptions were used."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain R and surrounding prose fix 1.85.1 and the full T×burst×allocator×P×D×u8 product, subtracting all wasm32/arena fibers only."}, + {"id": "B2", "decision": "PASS", "evidence": "The complete relation expressly exhausts absent, system, arena, arena-stop, all other Unicode, and non-Unicode via Result/VarError and pattern semantics."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent/system success is exactly RERUN,CS then normal return and the system cfg; no arena line is present."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena success is exactly RERUN,CA then normal return and the arena cfg; no system line is present."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop with successful writes leaves RERUN,CA then explicit panic, and the report states the completed selector cannot produce a current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave only RERUN, explicitly panic without allocator output, and produce no library."}, + {"id": "B7", "decision": "PASS", "evidence": "It models partial(L), covers first-write and every second-write failure, preserves only earlier complete RERUN, and rejects every failed execution."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful RERUN,CS/CA is consumed; exact allocator, burst, and target cfgs then select source under conspicuously bounded BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness witness derives prior RERUN,CA, present-value change, forced rerun, three unsuccessful cases, and no stale/current arena result."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena alone activates compile_error! independent of burst, profile, and debug assertions, with no library or witness from that pair."}, + {"id": "B11", "decision": "PASS", "evidence": "The source closure defines F exactly as aarch64/burst-on/arena and selects only the unchecked body there and only the checked body elsewhere."}, + {"id": "B12", "decision": "PASS", "evidence": "It supplies supported A64/burst-on/arena lane_id(0), safe-use validity, selected reachability, false NZ, authoritative zero UB, and UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "Smax is not-F or nonzero; three included cases prove soundness and F/zero proves every complement point UB, establishing maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-F zero case takes the equality branch and panics before unsafe, with all P×D fibers retained."}, + {"id": "B15", "decision": "PASS", "evidence": "It reports the global zero-panic theorem UNPROVED rather than CONTRACT-BROKEN because only UB cases remain after the proved not-F region."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The minimum repair is future remediation and is not used as support for the current artifact's verdicts."}, + "tcb_authority_defect": {"present": false, "evidence": "The exact BUILD-MAP-ORDERED entry and its narrow consumers are recorded; Cargo is not used as Rust authority and Rust claims cite 1.85.1 sources."}, + "visible_scope_defect": {"present": false, "evidence": "It states that only the supplied snapshot was audited and that no build, execution, expansion, test, prior audit, or external result was used."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain section fixes exact 1.85.1 C0×u8, every target, burst, allocator, profile, and debug fiber, with only wasm32/arena removed."}, + {"id": "B2", "decision": "PASS", "evidence": "The build section calls absent, system, arena, arena-stop, other Unicode including empty, and non-Unicode an exact exhaustive partition."}, + {"id": "B3", "decision": "PASS", "evidence": "Absent/system successful writes give exactly R,Sline and normal return, selecting system only."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena successful writes give exactly R,Aline and normal return, selecting arena only."}, + {"id": "B5", "decision": "PASS", "evidence": "Successful arena-stop writes completed R,Aline then explicitly panics, and BUILD-MAP-ORDERED is used to derive no current library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode panic with completed R before any allocator attempt and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers failed R before READ and all second-write failures after R, permits an arbitrary fragment q, and assigns no source effect or library."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful selectors supply exact allocator cfgs; admitted burst/target leaves and Rust cfg then select source under explicit BUILD-MAP-ORDERED limits."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness certificate derives prior completed R, arena-stop invalidation, rerun, all failed outcomes, and no old library as current."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena exactly retains compile_error! for both feature states and every profile/debug fiber and is rejected before any API use."}, + {"id": "B11", "decision": "PASS", "evidence": "K is exactly aarch64/burst-on/arena; cfg semantics are used to prove the first body on K and the complementary checked body on not-K."}, + {"id": "B12", "decision": "PASS", "evidence": "F-1 gives a supported successful arena build and safe lane_id(0), reaches new_unchecked(0), falsifies its contract, applies UB, and says UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "M is not-K or nonzero; the report proves each included case safe and every omitted K/zero point UB, so the region is exact and maximal."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-K zero execution takes the check and panics before unsafe, parametrically over profiles and debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately concludes the whole panic postcondition is UNPROVED, not CONTRACT-BROKEN, because K/zero is UB and not-K is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The repair is explicitly prospective and no design change is used to affect the current-snapshot verdicts."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is accepted only at its stated identity and consumers; Cargo pages are corroboration only and Rust premises use versioned authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied files and expressly says no prior audit, test, dependency, tool result, generated source, or backend evidence was used."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Supported fixes Rust/Cargo 1.85.1 and all T×B×A×P×D×V cases, with V all u8 and only wasm32/arena excluded."}, + {"id": "B2", "decision": "PASS", "evidence": "The relation explicitly says its omitted, system, arena, arena-stop, other Unicode, and non-Unicode rows are all raw classes."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted/system rows give R,S and normal success when both writes succeed, with system as the exact mapping and no arena line."}, + {"id": "B4", "decision": "PASS", "evidence": "The Unicode arena row gives R,A and normal success when both writes succeed, with arena as the exact mapping and no system line."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop gives completed R,A then explicit panic when writes succeed and is explicitly excluded from any successful current execution/library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other-Unicode and non-Unicode give completed R, explicit panic, no allocator attempt, and no current library under the accepted premise."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers failed R before classification and each allocator-write failure after R, allows incomplete failing bytes, and gives every failed exit no library."}, + {"id": "B8", "decision": "PASS", "evidence": "The successful mapping is limited to accepted returns; exact allocator, burst, and target cfgs feed Rust source selection with BUILD-MAP-ORDERED conspicuously bounded."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness proof derives prior R,A, present-to-present arena-stop invalidation, rerun, every failed outcome, and no prefix or old artifact as current."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves successful wasm32/arena sets both cfg leaves, retains compile_error! for all feature/profile/debug cases, and yields no library."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines C exactly as aarch64/burst-on/arena and proves the cfg blocks form an exhaustive complementary C/not-C source partition."}, + {"id": "B12", "decision": "PASS", "evidence": "It gives supported safe zero use in C, exact unchecked reachability, false nonzero proposition, versioned zero-UB consequence, and whole-domain UNSOUND."}, + {"id": "B13", "decision": "PASS", "evidence": "M is Supported×V with C/zero removed; the report proves all M cases safe and all excluded points UB, hence both containment and exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every not-C zero call takes the equality branch and panics before the unsafe call across all profile/debug fibers."}, + {"id": "B15", "decision": "PASS", "evidence": "It says the whole panic promise is UNPROVED, not CONTRACT-BROKEN, because C/zero contains UB while not-C/zero is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The suggested validation change is clearly a future repair and is not used to certify the current source."}, + "tcb_authority_defect": {"present": false, "evidence": "The report identifies BUILD-MAP-ORDERED and restricts it to exact accepted Cargo/status/freshness leaves; Rust claims use 1.85.1 official sources."}, + "visible_scope_defect": {"present": false, "evidence": "It describes the complete supplied snapshot and explicitly disclaims dependencies, generated files, tool results, builds, tests, and prior audits."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "Q and U cover exact Rust/Cargo 1.85.1 T×F×A×P×D×u8, subtracting every wasm32/arena feature/profile/debug fiber and no other case."}, + {"id": "B2", "decision": "PASS", "evidence": "B-01 explicitly labels omitted, system, arena, arena-stop, every other Unicode, and non-Unicode as the exhaustive remaining relation."}, + {"id": "B3", "decision": "PASS", "evidence": "Omitted/system successful R,L_s writes end in normal return and exactly system; no arena selector occurs."}, + {"id": "B4", "decision": "PASS", "evidence": "Unicode arena successful R,L_a writes end in normal return and exactly arena; no system selector occurs."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop completes R,L_a then explicitly panics when writes succeed, and both its exits are assigned no current result."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave R, panic before any selector attempt, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It quantifies arbitrary failed-write bytes p(X), covers first and every applicable second write, preserves only prior R, and rejects all failures."}, + {"id": "B8", "decision": "PASS", "evidence": "Only normal accepted exits supply the exact current allocator cfg; admitted feature/target mappings and Rust cfg select source under explicit BUILD-MAP-ORDERED limits."}, + {"id": "B9", "decision": "PASS", "evidence": "B-02 derives prior successful R,L_a, present arena-stop staleness, forced rerun, three failed outcomes, and no stale/current library."}, + {"id": "B10", "decision": "PASS", "evidence": "B-03 proves every wasm32/arena fiber retains compile_error! and fails compilation, while this pair is outside Q and no API is produced."}, + {"id": "B11", "decision": "PASS", "evidence": "B-03 defines C exactly as aarch64/burst-on/arena and states cfg selects only the immediate unchecked body on C and only the checked body on not-C."}, + {"id": "B12", "decision": "PASS", "evidence": "F-01 gives a supported safe lane_id(0), C reachability, false nonzero requirement, exact standard-library UB, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "S is not-C or nonzero; S-01/S-02 prove every included case sound and every excluded C/zero case UB, establishing exact maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "S-01 proves every supported not-C zero input executes panic before unsafe and explicitly covers all profile/debug states."}, + {"id": "B15", "decision": "PASS", "evidence": "POST-01 declares the universal panic theorem UNPROVED rather than CONTRACT-BROKEN, because C/zero has UB and the complement is proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "F-01's code repair is only a recommendation followed by re-audit, never evidence for present soundness or postconditions."}, + "tcb_authority_defect": {"present": false, "evidence": "BUILD-MAP-ORDERED is named, scoped to its exact accepted Cargo propositions and consumers, and not substituted for cited Rust 1.85.1 semantics."}, + "visible_scope_defect": {"present": false, "evidence": "The report limits itself to supplied files and says no build, execution, test, expansion, dependency, tool result, or extra premise was used."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "B1", "decision": "PASS", "evidence": "The domain fixes Rust/Cargo 1.85.1 and C×U over all T×B×A×P×D and u8, with exactly the wasm32/arena exclusion."}, + {"id": "B2", "decision": "PASS", "evidence": "It explicitly defines the disjoint exhaustive raw set as absent, three named Unicode values, other Unicode, and non-Unicode."}, + {"id": "B3", "decision": "PASS", "evidence": "The table and failure prose give absent/system as successful RERUN then READ then CFG(system) then return, with no arena cfg."}, + {"id": "B4", "decision": "PASS", "evidence": "They give Unicode arena as successful RERUN then READ then CFG(arena) then return, with no system cfg."}, + {"id": "B5", "decision": "PASS", "evidence": "Arena-stop completes RERUN,CFG(arena) then explicitly panics when writes succeed, and BUILD-MAP-ORDERED makes the prefix inert with no library."}, + {"id": "B6", "decision": "PASS", "evidence": "Other Unicode and non-Unicode leave RERUN, attempt no allocator write, explicitly panic, and produce no current library."}, + {"id": "B7", "decision": "PASS", "evidence": "It covers first-write failure before READ and each later CFG failure after RERUN, permits byte prefixes, and assigns no library to every failed exit."}, + {"id": "B8", "decision": "PASS", "evidence": "Only successful current CFG(a) reaches compilation; exact admitted allocator, feature, and target mappings feed Rust cfg source selection under qualified BUILD-MAP-ORDERED."}, + {"id": "B9", "decision": "PASS", "evidence": "The freshness witness derives prior RERUN,CFG(arena), registered present-value change, mandatory rerun, exhaustive failed exits, and no stale artifact."}, + {"id": "B10", "decision": "PASS", "evidence": "It proves wasm32/arena makes the compile_error! cfg true regardless of burst and rejects all such current compilations, with no excluded API case."}, + {"id": "B11", "decision": "PASS", "evidence": "It defines H exactly as aarch64/burst-on/arena and states admitted mappings plus all/not cfg semantics select the first body on H and the checked complement otherwise."}, + {"id": "B12", "decision": "PASS", "evidence": "BAD supplies supported safe lane_id(0), H-selected reachability, false nonzero condition, exact zero-UB consequence, and the UNSOUND verdict."}, + {"id": "B13", "decision": "PASS", "evidence": "SOUND removes exactly H/zero; the positive bullets cover every member and BAD applies to every complement profile/debug fiber, proving maximality."}, + {"id": "B14", "decision": "PASS", "evidence": "It proves every supported not-H zero input executes the check and panic before the unsafe call, with profiles and debug states retained."}, + {"id": "B15", "decision": "PASS", "evidence": "It separately reports the full panic postcondition UNPROVED, not CONTRACT-BROKEN, because H/zero has UB while all not-H zero cases are proved."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The recommended dominating check is prospective remediation and is not used to certify or narrow current obligations."}, + "tcb_authority_defect": {"present": false, "evidence": "The TCB log names BUILD-MAP-ORDERED, exact identity and consumers, denies widening, and uses official versioned Rust pages for semantic premises."}, + "visible_scope_defect": {"present": false, "evidence": "It confines the audit to the supplied manifest, policies, TCB, build script, and library and disclaims tests, prior audits, generated files, and tool results."}, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/L/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/L/s1.json new file mode 100644 index 0000000000..da2e7dcb4f --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/L/s1.json @@ -0,0 +1,239 @@ +{ + "schema_version": 1, + "mode": "L", + "scorer_id": "s1", + "reports": [ + { + "label": "F", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "Calls in-bounds the exact get_unchecked obligation, notes OOB is UB, and derives I < L."}, + {"id": "L2", "decision": "FAIL", "evidence": "AX-IF quotes false => else but the proof uses the unsupported converse else => false."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN explicitly identifies L as an element count represented as usize; as a natural count, L != 0 yields L >= 1."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability/profile independence as predecessor arithmetic without checking Rust subtraction or overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 explicitly derives I = L - 1 and 0 <= I < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The full-scope PROVED closure depends on the unsupported branch, usize-domain, and subtraction premises."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately deems the lifetime-only comment deficient because it omits the bounds obligation and derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "Supplies adjacent text from false is_empty through nonzero length, defined predecessor, and the in-bounds conclusion."}, + {"id": "L9", "decision": "FAIL", "evidence": "The four-entry inventory omits built-in subtraction/overflow and the rubric's separate usize-domain entry."}, + {"id": "L10", "decision": "FAIL", "evidence": "Required numeric/subtraction/overflow entries are absent, and AX-IF's quote does not establish the proposition claimed."}, + {"id": "L11", "decision": "FAIL", "evidence": "Its claim that no other Rust proposition is consumed conflicts with the unchecked numeric and control-flow premises."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Claims a complete authoritative reconciliation while silently consuming subtraction/overflow semantics and reversing AX-IF."}, + {"id": "G11", "evidence": "The positive verdict necessarily relies on unchecked subtraction/overflow semantics and an inapplicable implication direction for AX-IF."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is only a repair; the current-artifact verdict is not based on its implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "The asserted Rust-only TCB omits consumed subtraction/overflow authority and overclaims the cited if proposition."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences only the supplied source and versioned allowlisted Rust authorities."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states the in-bounds requirement and OOB UB for the usize call."}, + {"id": "L2", "decision": "PASS", "evidence": "O1 and AX-IF establish false on the else path; AX-EMPTY contraposition yields n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN and AX-USIZE establish n: usize, unsigned, hence n > 0."}, + {"id": "L4", "decision": "PASS", "evidence": "O2 checks subtraction and overflow authority and proves n - 1 representable in every profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 derives 0 <= n - 1 < n and identifies index with that value."}, + {"id": "L6", "decision": "PASS", "evidence": "Gives full requested scope, exhaustive branch coverage, and an explicit Required subset-of Covered certificate."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately marks the lifetime comment deficient for omitting the exact bounds proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false branch, zero-length contract, positivity, no underflow, index < len, and get_unchecked's requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "Inventories if, is_empty, len/type, usize, subtraction, overflow, and get_unchecked, separating source facts and mathematics."}, + {"id": "L10", "decision": "PASS", "evidence": "Each consumed Rust/std premise has a narrow 1.82.0 URL, exact excerpt, proposition, consumer, and applicability statement."}, + {"id": "L11", "decision": "PASS", "evidence": "Explicitly maps every AX entry to O1-O3 and states no unlisted Rust/std or tool premise supplies an inference."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is not used to certify the current implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The Rust 1.82 authority inventory is complete, applicable, checked, and reconciled."}, + "visible_scope_defect": {"present": false, "evidence": "The report stays within the supplied source and allowlisted versioned authority."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A7 identifies in-bounds indexing as required and an OOB index as UB."}, + {"id": "L2", "decision": "FAIL", "evidence": "A2 quotes false => else but claims that execution of else entails false, reversing the cited implication."}, + {"id": "L3", "decision": "PASS", "evidence": "A3 gives len's usize type and A4 gives unsigned nonnegativity, yielding L >= 1 from L != 0."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 plus L >= 1 establish representability and no overflow under any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 identifies index = L - 1 and derives 0 <= index < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The claimed exhaustive full-scope closure depends materially on A2's unsupported converse."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately calls the current lifetime-only comment deficient and distinguishes artifact from implementation."}, + {"id": "L8", "decision": "PASS", "evidence": "Provides adjacent wording covering false branch, zero-length implication, nonzero length, defined predecessor, bound, and callee requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A7 inventory all required Rust/std leaves and identifies remaining derivation as source facts or mathematics."}, + {"id": "L10", "decision": "FAIL", "evidence": "The exact A2 excerpt does not supply its verified proposition that else execution entails a false condition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact reconciliation overlooks the unsupported direction of the consumed branch premise."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Attests complete premise reconciliation although A2's quoted authority does not establish the branch proposition consumed."}, + {"id": "G11", "evidence": "The PROVED result necessarily relies on an invalid converse of the quoted if rule."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement is a documentation proposal, not evidence for the current proof."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-1 overstates what its A2 authority excerpt verifies."}, + "visible_scope_defect": {"present": false, "evidence": "No prohibited material or out-of-scope inspection is evidenced."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states the in-bounds obligation and OOB UB; the proof targets index < len."}, + {"id": "L2", "decision": "FAIL", "evidence": "AX-IF supplies false => else, not the claimed else => false needed on the unsafe path."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize and AX-USIZE gives nonnegativity, so n != 0 implies n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "AX-SUB/AX-OVERFLOW and n >= 1 prove n - 1 representable under every overflow setting."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 4 derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "Its closure relies on the unsupported AX-IF converse and defines Required without the valid-call/input dimension."}, + {"id": "L7", "decision": "PASS", "evidence": "Correctly separates a deficient lifetime comment from a sound implementation claim."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text gives false branch, len > 0, non-underflowing subtraction, index < len, same slice, and get_unchecked."}, + {"id": "L9", "decision": "PASS", "evidence": "Inventories all seven required Rust/std premises and classifies local/source and arithmetic reasoning."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF's quoted sentence does not verify the report's only-for-false proposition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The stated exact reconciliation misses the invalid implication direction at the control-flow leaf."} + ], + "hard_errors": [ + {"id": "G1", "evidence": "The formal Required product omits valid calls/inputs even though the full PROVED verdict quantifies over them."}, + {"id": "LH4", "evidence": "Claims every nonlocal premise is checked and reconciled while AX-IF does not support the consumed converse."}, + {"id": "G11", "evidence": "The positive proof necessarily relies on an inapplicable direction of its cited if authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The comment repair is not treated as implemented current evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "The asserted Rust-only authority set contains an unsupported AX-IF proposition."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied source and allowed Rust pages."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A4 states OOB UB and the required in-bounds usize index."}, + {"id": "L2", "decision": "FAIL", "evidence": "A3 quotes only false => consequent skipped and vaguely invokes other branch rules; it does not extract authority proving else-path false."}, + {"id": "L3", "decision": "FAIL", "evidence": "It calls the element count a natural number but never verifies len's usize type or usize's nonnegative domain."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability/no underflow across profiles without inventorying built-in subtraction or Rust overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 explicitly derives index = n - 1 with 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The PROVED closure depends on unsupported control-flow, unsigned-domain, and subtraction premises."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately finds the lifetime comment materially deficient for omitting the in-bounds derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false is_empty, nonzero len, representable predecessor, index < len, and get_unchecked's bounds need."}, + {"id": "L9", "decision": "FAIL", "evidence": "The four-entry list omits len's usize type, usize domain, built-in subtraction, and overflow behavior."}, + {"id": "L10", "decision": "FAIL", "evidence": "Required numeric/arithmetic authorities are absent and A3's excerpt does not supply the asserted branch biconditional."}, + {"id": "L11", "decision": "FAIL", "evidence": "Its completeness/no-silent-premise claim conflicts with the omitted Rust numeric and branch premises."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Calls the authority list complete while silently consuming usize, subtraction, overflow, and inadequately checked branch semantics."}, + {"id": "G11", "evidence": "The positive result necessarily relies on unchecked Rust numeric and control-flow authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement wording is not used as if already implemented."}, + "tcb_authority_defect": {"present": true, "evidence": "The purported authoritative inventory omits multiple consumed Rust premises."}, + "visible_scope_defect": {"present": false, "evidence": "Only supplied source facts and allowlisted Rust documentation are evidenced."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A-GET quotes both the in-bounds obligation's OOB UB consequence and the element-reference result."}, + {"id": "L2", "decision": "PASS", "evidence": "A-IF quotes both arm-selection directions; A-EMPTY contraposition yields nonzero length on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A-LEN establishes n: usize and A-USIZE nonnegativity, deriving n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A-SUB/A-OVERFLOW plus n >= 1 establish no underflow or overflow in every profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 derives index = n - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "Exhaustive paths, parametric target/profile proof, and Required subset-of Covered are explicit."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately labels the lifetime statement deficient because it omits the bounds and arithmetic proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Adjacent replacement covers false branch, zero-length implication, nonzero len, defined subtraction, strict bound, and get_unchecked."}, + {"id": "L9", "decision": "PASS", "evidence": "A-GET through A-USIZE inventory every required Rust/std leaf and separate source facts and mathematics."}, + {"id": "L10", "decision": "PASS", "evidence": "All entries use narrow 1.82.0 URLs, exact excerpts, verified propositions, consumers, and full-domain qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "TCB/reconciliation states the exact consumers and excludes any additional premise, dependency, tool, or test."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The repair proposal is separate from the proof of the supplied implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The authority set is version-matched, proposition-checked, complete, and consumer-mapped."}, + "visible_scope_defect": {"present": false, "evidence": "No evidence of inspecting anything beyond supplied source and allowed authority appears."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states that OOB is UB and requires an in-bounds usize element index."}, + {"id": "L2", "decision": "PASS", "evidence": "AX-IF quotes true/false arm selection and AX-EMPTY contraposition establishes L != 0 on the unsafe path."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives L: usize and AX-USIZE gives minimum zero, so L != 0 implies L >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "AX-SUB/AX-OVERFLOW show L - 1 remains in range in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Steps 3-4 derive index = L - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "It covers both Boolean paths across the exact target/profile domain and explicitly proves Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately deems the existing comment deficient despite proving the implementation."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text gives the false branch, nonzero length, representable subtraction, strict bound, and get_unchecked obligation."}, + {"id": "L9", "decision": "PASS", "evidence": "The seven-entry inventory covers all required Rust/std premises and classifies local facts and integer reasoning."}, + {"id": "L10", "decision": "PASS", "evidence": "Every entry has the matching 1.82.0 narrow URL, extracted text/table fact, verified proposition, and applicability."}, + {"id": "L11", "decision": "PASS", "evidence": "The proof consumes AX-IF through AX-GET as mapped and expressly excludes additional TCB or unlisted premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is a repair recommendation, not current-artifact proof evidence."}, + "tcb_authority_defect": {"present": false, "evidence": "TCB-R182-v1 contains checked, applicable Rust authority for every consumed semantic premise."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no inspection beyond the supplied target and allowlisted authority."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 states the in-bounds usize obligation and OOB UB."}, + {"id": "L2", "decision": "FAIL", "evidence": "A4 quotes false => else but uses it as else => false on the unsafe path."}, + {"id": "L3", "decision": "FAIL", "evidence": "A2 verifies only element count; the proof's n: usize premise is neither inventoried nor checked as len's return type."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and n >= 1 establish an in-range subtraction in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "The proof explicitly computes i = n - 1 and derives 0 <= i < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "Full Required closure depends on the unsupported branch converse and unverified len-to-usize link."}, + {"id": "L7", "decision": "PASS", "evidence": "The report separately finds the lifetime-only comment deficient and not an implementation defect."}, + {"id": "L8", "decision": "PASS", "evidence": "Adjacent replacement covers false branch, zero-length relation, nonzero len, safe predecessor, strict bound, and callee."}, + {"id": "L9", "decision": "FAIL", "evidence": "It omits len's usize return type as a Rust/std premise and instead misclassifies inferred index typing as a local source fact."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 does not extract the usize return type, and A4's quote does not establish its claimed reverse implication."}, + {"id": "L11", "decision": "FAIL", "evidence": "The no-unlisted-premise reconciliation conflicts with the unchecked len typing and branch direction."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Certifies A1-A7 as complete while silently consuming len's return type and reversing the checked A4 implication."}, + {"id": "G11", "evidence": "The implementation verdict necessarily relies on unchecked/inapplicable Rust authority at two material links."} + ], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is not treated as part of the supplied artifact."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-1 omits the consumed len return-type proposition and overclaims A4."}, + "visible_scope_defect": {"present": false, "evidence": "The report evidences no prohibited or out-of-scope source access."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 quotes OOB UB and states the in-bounds usize index requirement."}, + {"id": "L2", "decision": "FAIL", "evidence": "A4's exact quote establishes false => else, not execution of else => false as consumed in O2."}, + {"id": "L3", "decision": "PASS", "evidence": "A2 establishes n: usize and A5 its zero minimum, deriving n >= 1 from n != 0."}, + {"id": "L4", "decision": "PASS", "evidence": "A6 checks subtraction/overflow and proves n - 1 representable across all ordinary profiles."}, + {"id": "L5", "decision": "PASS", "evidence": "O2-O3 explicitly derive index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The advertised Required subset-of Covered certificate materially relies on A4's unsupported converse."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately reports the comment deficient for omitting the actual bounds proof."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states false branch, nonzero len, representability, strict bound, and the adjacent in-bounds obligation."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A6 inventory all required semantic leaves, with subtraction/overflow combined and consumers reconciled."}, + {"id": "L10", "decision": "FAIL", "evidence": "A4's quoted proposition does not supply the verified proposition used for branch reachability."}, + {"id": "L11", "decision": "FAIL", "evidence": "The explicit reconciliation overlooks that A4 is consumed in an unverified direction."} + ], + "hard_errors": [ + {"id": "LH4", "evidence": "Claims only checked version-matched premises and complete reconciliation while A4 does not support the consumed converse."}, + {"id": "G11", "evidence": "The positive proof necessarily relies on an inapplicable direction of its if authority."} + ], + "proposal_laundering": {"present": false, "evidence": "The documentation repair is not used as current implementation evidence."}, + "tcb_authority_defect": {"present": true, "evidence": "TCB-LAST-R1 overstates the branch proposition established by A4."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of prohibited evaluation or sibling material access."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A5 quotes OOB UB and states 0 <= index < n as the usize in-bounds obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "A3 quotes both branch-selection directions and A2 contraposition yields n != 0 on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A1 gives n: usize and A4 gives minimum zero, hence a nonzero n is at least one."}, + {"id": "L4", "decision": "PASS", "evidence": "A4 checks integer minus and overflow bounds, proving n - 1 in range for every width/profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O1 derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 exhaust both branches and explicitly establish Required subset-of Covered over the full symbolic domain."}, + {"id": "L7", "decision": "PASS", "evidence": "Separately finds the existing lifetime comment inadequate while retaining implementation PROVED."}, + {"id": "L8", "decision": "PASS", "evidence": "Replacement text states branch false, nonzero length, defined subtraction, strict bound, and get_unchecked's requirement."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A5 cover all seven required Rust/std propositions, with numeric and arithmetic entries grouped, and classify remaining logic/source facts."}, + {"id": "L10", "decision": "PASS", "evidence": "Every consumed premise has a narrow 1.82.0 URL, exact quoted prose/signature/table entry, verified proposition, and scope."}, + {"id": "L11", "decision": "PASS", "evidence": "The TCB log and O1-O3 mapping reconcile every authority to a consumer and exclude silent assumptions."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is a proposed artifact repair and does not narrow or certify the current obligation."}, + "tcb_authority_defect": {"present": false, "evidence": "A1-A5 are version-matched, proposition-checked, applicable, complete, and reconciled."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied source and allowlisted Rust documentation."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "L8 does not specify whether a replacement must spell out the usize nonnegative-to-positive bridge verbatim; I treated direct nonzero/positive-length to defined-subtraction wording as sufficient when the bound and callee obligation were explicit." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/L/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/L/s2.json new file mode 100644 index 0000000000..f65fe1280a --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/L/s2.json @@ -0,0 +1,228 @@ +{ + "schema_version": 1, + "mode": "L", + "scorer_id": "s2", + "reports": [ + { + "label": "J", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states that an out-of-bounds get_unchecked index is UB, and O3 identifies in-bounds as the call obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "O1/O2 place the call in the false else arm and contrapose AX-EMPTY to obtain n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize and AX-USIZE supplies the unsigned domain, from which O2 derives n > 0."}, + {"id": "L4", "decision": "PASS", "evidence": "O2 proves n - 1 remains in range and explicitly makes the result independent of overflow checks and profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 substitutes index = n - 1 and derives 0 <= n - 1 < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report connects the branch/arithmetic proof to AX-GET, claims PROVED over the full requested scope, and gives Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately calls the comment deficient because the lifetime sentence establishes neither the bounds obligation nor its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The proposed adjacent comment names is_empty and get_unchecked and exposes nonzero length, defined subtraction, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "The inventory includes if selection, is_empty, len/type, usize, subtraction, overflow, and get_unchecked, while classifying source and mathematical steps."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF quotes true=>consequent and false=>else but omits the text that a true condition skips else, so the quotation does not supply the consumed else-reached=>false direction."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact reconciliation depends on the inadequately extracted AX-IF branch-selection proposition."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is proposed only after the current implementation is proved; it is not used to narrow or certify the implementation obligation."}, + "tcb_authority_defect": {"present": true, "evidence": "The AX-IF quotation does not establish the converse branch fact the proof consumes."}, + "visible_scope_defect": {"present": false, "evidence": "The report discusses only the supplied source/request and the permitted Rust 1.82.0 authorities."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-UNCHECKED states that an out-of-bounds index is UB and step 4 treats in-bounds as the exact obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "Step 2 identifies the false else path and contraposes the zero-length is_empty contract to L != 0."}, + {"id": "L3", "decision": "FAIL", "evidence": "Although AX-LEN notes a usize return, the report substitutes 'natural count' and never checks the required nonnegative usize value-domain premise."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representability and profile independence without checking Rust 1.82.0 integer-minus or overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 explicitly uses I = L - 1 and predecessor arithmetic to derive 0 <= I < L."}, + {"id": "L6", "decision": "FAIL", "evidence": "The all-scope PROVED closure depends on the unverified usize-domain, subtraction, and overflow premises, so the implementation certificate is incomplete."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime-only comment deficient and distinguishes that defect from implementation status."}, + {"id": "L8", "decision": "FAIL", "evidence": "The proposed comment gives a bounds chain but neither identifies get_unchecked in the text nor refers to checked usize/subtraction/overflow propositions, which the report lacks."}, + {"id": "L9", "decision": "FAIL", "evidence": "The claimed complete inventory omits the usize value domain, built-in subtraction meaning, and overflow/profile semantics materially used by steps 2-3."}, + {"id": "L10", "decision": "FAIL", "evidence": "No version-matched checked entries or exact quotations are supplied for usize, subtraction, or overflow; AX-IF also quotes only false=>else."}, + {"id": "L11", "decision": "FAIL", "evidence": "The report says no other Rust proposition is consumed despite silently using the omitted integer premises."} + ], + "hard_errors": [ + {"id": "G11", "evidence": "The PROVED result necessarily relies on unchecked Rust usize-domain, integer-subtraction, and overflow premises."}, + {"id": "LH4", "evidence": "It claims the authority inventory is complete while silently consuming Rust integer-domain, subtraction, and overflow semantics."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is not used as evidence that the current implementation is sound."}, + "tcb_authority_defect": {"present": true, "evidence": "Material Rust integer premises are asserted without applicable checked Rust 1.82.0 authority."}, + "visible_scope_defect": {"present": false, "evidence": "Nothing in the report evidences inspection beyond the supplied source/request and permitted authority pages."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 quotes the out-of-bounds UB rule and O3 discharges the corresponding in-bounds obligation."}, + {"id": "L2", "decision": "PASS", "evidence": "O2 states that reaching else makes is_empty false and uses A3 to derive n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "A2 establishes len as usize and A5 establishes minimum zero, yielding n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A6 and O2 prove n - 1 is representable and non-overflowing throughout the profile domain."}, + {"id": "L5", "decision": "PASS", "evidence": "O3 derives 0 <= index = n - 1 < n = bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 are connected to a full-scope PROVED verdict and an explicit Required subset-of Covered certificate."}, + {"id": "L7", "decision": "PASS", "evidence": "The report separately says the lifetime comment neither states nor proves the in-bounds caller obligation."}, + {"id": "L8", "decision": "PASS", "evidence": "The adjacent replacement exposes false is_empty, nonzero len, representable subtraction, and index < len for the displayed unsafe call."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A6 inventory all required Rust/std leaves, and the proof treats assignments and inequalities as local source facts and mathematics."}, + {"id": "L10", "decision": "FAIL", "evidence": "A4 quotes only false=>else but claims the converse, execution-of-else=>false; the exact quotation does not supply that consumed proposition."}, + {"id": "L11", "decision": "FAIL", "evidence": "The asserted exact reconciliation inherits A4's unsupported converse branch-selection premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The documentation-only replacement is not used to justify the current implementation verdict."}, + "tcb_authority_defect": {"present": true, "evidence": "The checked A4 excerpt does not establish the direction of if semantics consumed by O2."}, + "visible_scope_defect": {"present": false, "evidence": "The report confines itself to the supplied target/request and allowed versioned Rust authorities."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A1 states out-of-bounds get_unchecked is UB and OBL-1 proves the index in bounds."}, + {"id": "L2", "decision": "PASS", "evidence": "OBL-1 identifies the false else path and contraposes A3 to n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "The proof explicitly takes n: usize, applies A7's unsigned domain, and derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and OBL-1 prove n - 1 stays in range and cannot overflow in any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "OBL-1 substitutes i = n - 1 and derives 0 <= i < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report connects the exhaustive branch proof to A1, reports full-scope PROVED, and states Covered = Required."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately identifies the lifetime-only comment as deficient for omitting the bounds derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The proposed adjacent comment names is_empty and get_unchecked and exposes the complete nonzero/subtraction/bounds chain."}, + {"id": "L9", "decision": "FAIL", "evidence": "The report misclassifies index: usize as a local source/type-signature fact; the supplied source has no such annotation, and len's return type is a consumed std premise."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 quotes and verifies only len's element-count meaning, not its usize return type; A4 also quotes only false=>else while consuming the converse."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed no-silent-premise reconciliation omits authoritative establishment of len's usize return type and inadequately extracts if selection."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement wording follows, rather than supplies, the proof of the current source."}, + "tcb_authority_defect": {"present": true, "evidence": "A consumed standard-library return-type premise is not inventoried and quoted as authority, and AX-IF's excerpt is directionally incomplete."}, + "visible_scope_defect": {"present": false, "evidence": "The report gives no evidence of inspecting prohibited evaluation or sibling material."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A-GET quotes the exact out-of-bounds UB rule and O3 discharges in-bounds for the usize index."}, + {"id": "L2", "decision": "PASS", "evidence": "A-IF supplies both branch directions and O1 contraposes A-EMPTY to obtain nonzero length."}, + {"id": "L3", "decision": "PASS", "evidence": "A-LEN establishes n: usize, A-USIZE supplies nonnegativity, and O2 derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A-SUB/A-OVERFLOW and O2 establish representability and no underflow or overflow in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 explicitly concludes index = n - 1 < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O4 close the unsafe obligation over the full stated domain and the report gives Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the existing comment deficient because a lifetime property does not prove the sole bounds precondition."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names is_empty/get_unchecked and exposes false branch, nonzero len, defined subtraction, and the strict bound."}, + {"id": "L9", "decision": "PASS", "evidence": "A-GET through A-USIZE inventory every required Rust/std premise and separately identify local source facts and mathematical inference."}, + {"id": "L10", "decision": "PASS", "evidence": "Every entry has the matching 1.82.0 narrow URL, exact supporting quotation or displayed signature, verified proposition, consumer, and scope qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "The report explicitly maps all authority entries to O1-O4 and states that no other Rust/std premise or TCB assumption is used."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is a proof-artifact repair and is not used to establish current soundness."}, + "tcb_authority_defect": {"present": false, "evidence": "All material nonlocal premises are supported by matching official Rust 1.82.0 authority; no target TCB assumption is used."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied source/request and permitted official authorities."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET quotes out-of-bounds UB and step 5 treats in-bounds as the exact unsafe-call requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "AX-IF gives both branch directions and steps 1-2 use AX-EMPTY contrapositively to derive L != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN establishes L: usize; AX-USIZE gives minimum zero; step 3 derives 1 <= L."}, + {"id": "L4", "decision": "PASS", "evidence": "Steps 3-4 and AX-SUB/AX-OVERFLOW prove L - 1 is in range and non-underflowing in every ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Steps 3-4 derive index = L - 1 and index < bytes.len()."}, + {"id": "L6", "decision": "PASS", "evidence": "The exhaustive proof discharges AX-GET across the exact scope, reports PROVED, and explicitly certifies Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "DOC-1 separately explains that the lifetime comment mentions neither bounds nor the material derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement identifies get_unchecked's obligation and states false is_empty, nonzero len, representable subtraction, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "AX-IF through AX-GET inventory all required semantic leaves, with source observations and arithmetic identified separately."}, + {"id": "L10", "decision": "PASS", "evidence": "All seven entries have narrow 1.82.0 URLs, exact supporting text/signatures, verified propositions, and full-domain applicability."}, + {"id": "L11", "decision": "PASS", "evidence": "The derivation consumes each AX entry and expressly states there are no added environmental, implementation, or pending TCB premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement comment is offered after a complete proof of the unchanged implementation."}, + "tcb_authority_defect": {"present": false, "evidence": "The proof relies only on applicable, proposition-matched Rust 1.82.0 Reference/std authority."}, + "visible_scope_defect": {"present": false, "evidence": "No report statement evidences access beyond the supplied target/request and allowed authorities."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A5 quotes the get_unchecked out-of-bounds UB rule and O2 discharges its in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "A3 supplies true/false branch semantics and O1 contraposes A2 to n != 0 on else."}, + {"id": "L3", "decision": "PASS", "evidence": "A1 establishes n: usize and A4 gives the zero minimum, yielding n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A4 and O1 show n - 1 lies in the usize range and cannot overflow under any profile setting."}, + {"id": "L5", "decision": "PASS", "evidence": "O1 explicitly derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "O1-O3 close the sole unsafe consumer for every requested case and provide Required subset-of Covered with a full-scope PROVED verdict."}, + {"id": "L7", "decision": "PASS", "evidence": "The proof-artifact verdict separately calls the lifetime sentence inadequate for the in-bounds obligation and its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names slice::get_unchecked and states false emptiness, nonzero length, no overflow, and index < len."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A5 cover every required Rust/std leaf, while the remaining source observations and logic/arithmetic are explicitly separated."}, + {"id": "L10", "decision": "PASS", "evidence": "Each consumed authority has a narrow 1.82.0 URL, exact quotation/signature, verified proposition, and target/profile qualification."}, + {"id": "L11", "decision": "PASS", "evidence": "The O1-O3 mapping consumes every inventoried entry and disclaims all extra TCB, dependency, tool, and platform assumptions."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The comment repair is not used to prove or narrow the current implementation's obligations."}, + "tcb_authority_defect": {"present": false, "evidence": "All materially used Rust propositions are supported by applicable official 1.82.0 authority."}, + "visible_scope_defect": {"present": false, "evidence": "The report only reviews the supplied artifact and allowed authoritative pages."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "AX-GET states out-of-bounds is UB, and step 5 discharges the in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "Steps 1-2 place execution in the false else arm and contrapose AX-EMPTY to n != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "AX-LEN gives n: usize, AX-USIZE supplies nonnegativity, and step 3 derives n >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "Step 4 and AX-SUB/AX-OVERFLOW show n - 1 is representable under every overflow-check setting."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 4 explicitly derives index = n - 1 and 0 <= index < n."}, + {"id": "L6", "decision": "PASS", "evidence": "The report closes both obligations and the empty path over the full domain, with PROVED and Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime-only comment deficient for omitting both the exact bound and its derivation."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names get_unchecked and exposes the false-branch, positive-length, no-underflow, strict-bound chain."}, + {"id": "L9", "decision": "PASS", "evidence": "AX-EMPTY through AX-GET inventory all material Rust leaves and distinguish local source facts from arithmetic and contraposition."}, + {"id": "L10", "decision": "FAIL", "evidence": "AX-IF quotes false=>else but uses it for else-reached=>false and true-path exclusion; the quotation does not supply those converse/exclusivity facts."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed complete reconciliation depends on branch-selection authority not established by the quoted AX-IF text."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The replacement is a requested documentation repair, not evidence for current soundness."}, + "tcb_authority_defect": {"present": true, "evidence": "The AX-IF evidence is directionally insufficient for the proposition the proof consumes."}, + "visible_scope_defect": {"present": false, "evidence": "The report contains no evidence of access outside the supplied source/request and permitted Rust authorities."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A4 states that out-of-bounds get_unchecked is UB and O2 treats in-bounds as its exact requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "O2 places the call on false is_empty and contraposes A1 to n != 0."}, + {"id": "L3", "decision": "FAIL", "evidence": "A2 verifies only element-count meaning; the report never establishes len's usize type or the unsigned/nonnegative usize domain."}, + {"id": "L4", "decision": "FAIL", "evidence": "It asserts representable subtraction and profile independence without checking built-in minus or integer-overflow semantics."}, + {"id": "L5", "decision": "PASS", "evidence": "O2 uses index = n - 1 and ordinary predecessor arithmetic to derive 0 <= index < n."}, + {"id": "L6", "decision": "FAIL", "evidence": "The full-scope PROVED closure relies on unverified type, unsigned-domain, subtraction, and overflow premises."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately finds the lifetime comment deficient because it omits get_unchecked's bounds obligation and derivation."}, + {"id": "L8", "decision": "FAIL", "evidence": "The replacement states the desired chain but refers to no checked authority for its material usize and subtraction/overflow steps."}, + {"id": "L9", "decision": "FAIL", "evidence": "The supposedly complete inventory omits len's usize return type, usize's value domain, built-in subtraction, and overflow/profile behavior."}, + {"id": "L10", "decision": "FAIL", "evidence": "There are no matching checked entries or quotations for the omitted integer premises, and A3 does not quote the full branch-selection rule it claims."}, + {"id": "L11", "decision": "FAIL", "evidence": "The report claims no overflow, width, or other Rust fact is silently consumed while its derivation depends on exactly those omitted premises."} + ], + "hard_errors": [ + {"id": "G11", "evidence": "The PROVED conclusion necessarily relies on unchecked Rust type/domain, subtraction, and overflow propositions."}, + {"id": "LH4", "evidence": "It affirmatively calls the authority list complete while silently consuming the omitted integer premises."} + ], + "proposal_laundering": {"present": false, "evidence": "The proposed comment is not used to certify or narrow the present implementation obligation."}, + "tcb_authority_defect": {"present": true, "evidence": "Several material Rust/std premises have no checked version-matched authority entry."}, + "visible_scope_defect": {"present": false, "evidence": "The report remains within the supplied target/request and permitted authority set."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id": "L1", "decision": "PASS", "evidence": "A7 states out-of-bounds get_unchecked is UB, and step 4 discharges its in-bounds requirement."}, + {"id": "L2", "decision": "PASS", "evidence": "Steps 1-2 identify false is_empty on else and contrapose A1 to L != 0."}, + {"id": "L3", "decision": "PASS", "evidence": "A3 gives L: usize, A4 gives the unsigned domain, and step 2 derives L >= 1."}, + {"id": "L4", "decision": "PASS", "evidence": "A5-A6 and step 3 prove L - 1 remains representable and does not overflow in any ordinary profile."}, + {"id": "L5", "decision": "PASS", "evidence": "Step 3 substitutes index = L - 1 and concludes 0 <= index < L."}, + {"id": "L6", "decision": "PASS", "evidence": "The exhaustive branch proof closes A7 for the entire exact domain, reports PROVED, and states Required subset-of Covered."}, + {"id": "L7", "decision": "PASS", "evidence": "It separately says the lifetime comment does not establish the bounds obligation and requires reconstruction."}, + {"id": "L8", "decision": "PASS", "evidence": "The replacement names is_empty and get_unchecked and supplies nonzero length, non-underflow, and the strict bound."}, + {"id": "L9", "decision": "PASS", "evidence": "A1-A7 inventory all required Rust/std premises and map them to steps, leaving only source and mathematical facts outside."}, + {"id": "L10", "decision": "FAIL", "evidence": "A2 quotes only false=>else but claims else-execution=>false; the exact quotation does not supply the consumed converse."}, + {"id": "L11", "decision": "FAIL", "evidence": "The claimed exact A1-A7 reconciliation inherits A2's inadequately supported branch proposition."} + ], + "hard_errors": [], + "proposal_laundering": {"present": false, "evidence": "The requested replacement comment follows an independent proof of the current implementation."}, + "tcb_authority_defect": {"present": true, "evidence": "The quoted A2 text is insufficient for the branch direction used in the proof."}, + "visible_scope_defect": {"present": false, "evidence": "The report shows no inspection of prohibited oracle, sibling, condition-map, prior-report, or evaluator material."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "L8 does not say whether an adjacent replacement must contain an inline URL or axiom label. I treated explicit method/contract references to already checked entries as unambiguous, but not references to material arithmetic premises for which the report supplied no checked entry.", + "L10 asks for exact prose although return types are ordinarily supplied by displayed signatures. I accepted an expressly inspected/displayed versioned signature, but not an unquoted or misclassified type fact.", + "For if semantics, an excerpt stating only false=>else does not logically establish else-reached=>false. I scored that as an L10/L11 authority-extraction defect where the omitted true-arm exclusion was not quoted, but did not infer the exact LH4 hard-error trigger merely from an incomplete excerpt." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/P/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/P/s1.json new file mode 100644 index 0000000000..f1e0e9e393 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/P/s1.json @@ -0,0 +1,383 @@ +{ + "schema_version": 1, + "mode": "P", + "scorer_id": "s1", + "reports": [ + { + "label": "G", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"G lines 19–23 state the exact Scarlet predicate, including V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"G lines 28–32 state the exact Indigo predicate, including V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"G line 34 substitutes (1.84.0,X,true,false) and proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"G line 34 substitutes (1.84.0,X,true,true) and proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"G line 10 calls exact-promise identity UNPROVED and line 60 keeps the union only as an audit envelope."}, + {"id":"P6","decision":"PASS","evidence":"G lines 36–42 define D_S over all seven coordinates, all profiles, both d states, and all Option inputs."}, + {"id":"P7","decision":"PASS","evidence":"G lines 36–42 define D_I over the same complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"G line 58 separately maps every Scarlet disjunct into U and preserves remaining dimensions."}, + {"id":"P9","decision":"PASS","evidence":"G line 58 separately maps every Indigo disjunct into U and preserves remaining dimensions."}, + {"id":"P10","decision":"PASS","evidence":"G line 80 proves f=true,t=W falsifies every Scarlet turbo disjunct for arbitrary remaining coordinates."}, + {"id":"P11","decision":"PASS","evidence":"G line 80 proves the same universal wasm exclusion for Indigo."}, + {"id":"P12","decision":"PASS","evidence":"G lines 64, 68, 75, and 80 combine exact TCB mapping, all/cfg semantics, and compile_error! for the full R_W fiber."}, + {"id":"P13","decision":"PASS","evidence":"G lines 66 and 82 apply each exact-version unwrap_or contract to None and Some(x) on C_N."}, + {"id":"P14","decision":"PASS","evidence":"G lines 66 and 84 trace r into the syntactically constructed Some(r), excluding a None receiver."}, + {"id":"P15","decision":"PASS","evidence":"G line 84 composes unwrap_or, Some(r), and unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"G lines 54–55 define Required=D_A while retaining v,t,f,h,p,d,input."}, + {"id":"P17","decision":"PASS","evidence":"G lines 75–77 and 93 define Covered_sound from full seven-coordinate C_N/C_T predicates."}, + {"id":"P18","decision":"PASS","evidence":"G lines 82–84 prove both covered source branches; lines 90–95 admit exactly their full-case union."}, + {"id":"P19","decision":"PASS","evidence":"G lines 97–101 carry every Required coordinate through the !f/f split and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"G lines 7 and 97–104 state TCB-relative whole-domain soundness and supply its closure certificate."}, + {"id":"P21","decision":"PASS","evidence":"G lines 75–77 and 94 define Covered_behavior with all seven coordinates retained."}, + {"id":"P22","decision":"PASS","evidence":"G lines 82–84 prove Q on both branches admitted by Covered_behavior."}, + {"id":"P23","decision":"PASS","evidence":"G lines 97–102 prove Required subset Covered_behavior without projecting any coordinate."}, + {"id":"P24","decision":"PASS","evidence":"G lines 8 and 97–104 state the qualified whole-domain postcondition and its certificate."}, + {"id":"P25","decision":"PASS","evidence":"G line 68 limits BUILD-MAP-POLICY to the exact releases, mappings, profiles, and reachability/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"G lines 7–9 explicitly qualify all three mapping-dependent conclusions; line 68 labels the premise accepted trust, not Rust semantics."}, + {"id":"P27","decision":"PASS","evidence":"G lines 64–66 quote and link per-release cfg, compile_error!, unwrap_or, and unwrap_unchecked authority."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"G neither proposes nor certifies any unimplemented design."}, + "tcb_authority_defect": {"present":false,"evidence":"G gives exact TCB scope/qualification and version-matched quoted Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"G evidences review only of the supplied source snapshot and permitted authorities."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"I lines 40–44 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"I lines 45–49 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"I lines 51–53 prove (1.84.0,X,true,false) is Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"I lines 53–55 prove (1.84.0,X,true,true) is Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"I lines 17 and 21–22 leave exact-promise identity UNPROVED and separate it from Required."}, + {"id":"P6","decision":"PASS","evidence":"I lines 57–63 define D_S over the full tuple, every profile, both debug states, and every valid input."}, + {"id":"P7","decision":"PASS","evidence":"I lines 57–64 define D_I over that same full product."}, + {"id":"P8","decision":"PASS","evidence":"I lines 67–70 separately prove D_S subset Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"I lines 67–70 separately prove D_I subset Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"I lines 103–105 universally substitute f=true,t=W into Scarlet and exclude it."}, + {"id":"P11","decision":"PASS","evidence":"I lines 103–105 give the same universal substitution for Indigo."}, + {"id":"P12","decision":"PASS","evidence":"I lines 76–101 quote the exact cfg/all/macro rules and lines 91–107 apply the accepted mapping over h,p,d,i."}, + {"id":"P13","decision":"PASS","evidence":"I lines 111–126 apply exact-version unwrap_or prose to every input on the non-turbo branch."}, + {"id":"P14","decision":"PASS","evidence":"I lines 111–127 connect the local Some(y) receiver to the unchecked call's None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"I line 128 composes y from unwrap_or with unwrap_unchecked's contained-value result."}, + {"id":"P16","decision":"PASS","evidence":"I lines 57–65 define Required with v,t,f,h,p,d,i retained."}, + {"id":"P17","decision":"PASS","evidence":"I lines 137–145 define Base and Covered_sound with every case coordinate."}, + {"id":"P18","decision":"PASS","evidence":"I lines 124–133 prove the unsafe obligation on every branch in the stated coverage region."}, + {"id":"P19","decision":"PASS","evidence":"I lines 147–157 carry Base coordinates and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"I lines 15 and 155–161 give the TCB-qualified PROVED soundness conclusion and closure."}, + {"id":"P21","decision":"PASS","evidence":"I lines 137–145 define Covered_post using full Base(c)."}, + {"id":"P22","decision":"PASS","evidence":"I lines 126–128 provide complete Q derivations for both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"I lines 147–158 separately prove Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"I lines 16 and 155–161 state the postcondition PROVED under the same TCB qualification and certificate."}, + {"id":"P25","decision":"PASS","evidence":"I lines 165–171 identify the exact TCB entry, mappings, releases, and only permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"I lines 15–16 make the shared TCB qualification explicit, and lines 165–170 distinguish trust from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"I lines 76–89 and 111–120 provide quotations and exact-version URLs for every used Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"I contains no unimplemented proposal used as current evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"I precisely scopes and qualifies the TCB and supplies complete exact-version Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"I shows no inspection of prohibited evaluation or sibling material."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"A lines 40–44 reproduce the exact Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"A lines 45–49 reproduce the exact Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"A lines 58–60 establish the stated Scarlet-only witness in both predicates."}, + {"id":"P4","decision":"PASS","evidence":"A lines 60–63 establish the stated Indigo-only witness in both predicates."}, + {"id":"P5","decision":"PASS","evidence":"A lines 17 and 21–22 call policy identity UNPROVED and deny that Required resolves it."}, + {"id":"P6","decision":"PASS","evidence":"A lines 34–55 define D_S across all seven requested coordinates."}, + {"id":"P7","decision":"PASS","evidence":"A lines 34–55 define D_I across all seven requested coordinates."}, + {"id":"P8","decision":"PASS","evidence":"A lines 80–83 separately prove D_S subset Required with unchanged p,d,o."}, + {"id":"P9","decision":"PASS","evidence":"A lines 80–83 separately prove D_I subset Required with unchanged p,d,o."}, + {"id":"P10","decision":"PASS","evidence":"A lines 76–80 derive the union and expressly show Scarlet has no f,t=W case."}, + {"id":"P11","decision":"PASS","evidence":"A lines 76–80 likewise show Indigo has no f,t=W case."}, + {"id":"P12","decision":"PASS","evidence":"A lines 87–104, 119–126, and 158–164 supply exact mapping, all/cfg/macro authority, and universal rejection."}, + {"id":"P13","decision":"PASS","evidence":"A lines 106–117 and 148–150 prove the non-turbo result for every Option input."}, + {"id":"P14","decision":"PASS","evidence":"A lines 110–116 and 151–156 prove the unchecked receiver is the locally constructed Some(r)."}, + {"id":"P15","decision":"PASS","evidence":"A lines 151–157 compose both Option contracts to prove the turbo result."}, + {"id":"P16","decision":"PASS","evidence":"A lines 68–74 define Required over v,t,f,h,p,d,o."}, + {"id":"P17","decision":"PASS","evidence":"A lines 138–145 define full K(c) and Covered_sound without projection."}, + {"id":"P18","decision":"PASS","evidence":"A lines 148–157 prove every case admitted by Covered_sound on its selected branch."}, + {"id":"P19","decision":"PASS","evidence":"A lines 166–170 prove U implies the covered source region and Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"A lines 14, 19–22, and 168–172 give a TCB-qualified whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"A lines 138–145 define Covered_behavior over the full K tuple."}, + {"id":"P22","decision":"PASS","evidence":"A lines 148–157 prove Q for both branches included in Covered_behavior."}, + {"id":"P23","decision":"PASS","evidence":"A lines 166–172 separately prove Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"A lines 15, 19–22, and 168–172 give the qualified whole-domain behavioral conclusion."}, + {"id":"P25","decision":"PASS","evidence":"A lines 119–127 identify BUILD-MAP-POLICY via its alias and keep its exact identity, region, mappings, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"A lines 14–16 and 19–21 conspicuously qualify every mapping-dependent conclusion; lines 119–126 distinguish the TCB from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"A lines 87–117 pair every material cfg, compile_error!, and Option premise with quotations and exact-version URLs."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"A proposes only a comment improvement and does not use it to certify current code."}, + "tcb_authority_defect": {"present":false,"evidence":"A's TCB-BUILD-MAP alias is expressly identified as exact BUILD-MAP-POLICY and is correctly scoped and qualified."}, + "visible_scope_defect": {"present":false,"evidence":"A evidences no access beyond supplied source-review material and allowed authorities."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"J lines 28–34 state Scarlet exactly with the outer V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"J lines 36–42 state Indigo exactly with the outer V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"J lines 44–46 substitute and prove the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"J lines 46–50 substitute and prove the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"J lines 19 and 73–77 leave exact-promise identity UNPROVED and distinguish the audit union."}, + {"id":"P6","decision":"PASS","evidence":"J lines 54–68 define Base and D_S over all seven full-case coordinates."}, + {"id":"P7","decision":"PASS","evidence":"J lines 54–68 define Base and D_I over all seven full-case coordinates."}, + {"id":"P8","decision":"PASS","evidence":"J lines 69–75 separately prove D_S subset Required by disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"J lines 69–75 separately prove D_I subset Required by disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"J lines 90–93 universally falsify every Scarlet disjunct at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"J lines 90–93 universally falsify every Indigo disjunct at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"J lines 85–100 combine per-version all/cfg/macro authority with exact TCB mapping across the rejected fiber."}, + {"id":"P13","decision":"PASS","evidence":"J lines 84 and 106–112 apply unwrap_or to both exhaustive inputs on every non-turbo case."}, + {"id":"P14","decision":"PASS","evidence":"J lines 84 and 114–119 show the exact unchecked receiver is Some(value), never None."}, + {"id":"P15","decision":"PASS","evidence":"J lines 114–122 compose both Option operations and prove the turbo result for all inputs."}, + {"id":"P16","decision":"PASS","evidence":"J lines 60–70 define Required through full Base(c), retaining all coordinates."}, + {"id":"P17","decision":"PASS","evidence":"J lines 135–140 define Covered_sound using full Base(c)."}, + {"id":"P18","decision":"PASS","evidence":"J lines 106–122 prove each branch admitted by Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"J lines 143–148 prove Required subset Covered_sound while carrying Base(c)."}, + {"id":"P20","decision":"PASS","evidence":"J lines 16 and 143–149 give TCB-relative soundness and its full-case certificate."}, + {"id":"P21","decision":"PASS","evidence":"J lines 135–140 define Covered_post with every Base coordinate."}, + {"id":"P22","decision":"PASS","evidence":"J lines 106–122 establish g(i) on every branch included in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"J lines 143–149 independently prove Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"J lines 17 and 143–149 state the postcondition PROVED with the same TCB qualification and closure."}, + {"id":"P25","decision":"PASS","evidence":"J lines 155–160 restrict BUILD-MAP-POLICY to exact releases, manifest/source, mappings, and permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"J lines 16–18 explicitly qualify all dependent verdicts; lines 155–161 separate trusted mapping from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"J lines 81–86 quote and link all material Option, cfg/all/not, and compile_error! rules for each exact release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"J does not use any unimplemented design as current evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"J has complete exact TCB accounting, conspicuous qualification, and exact-version Rust quotations."}, + "visible_scope_defect": {"present":false,"evidence":"J establishes no material departure from supplied source-review scope."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"H lines 49–59 give the exact Scarlet predicate within full Base(c)."}, + {"id":"P2","decision":"PASS","evidence":"H lines 61–71 give the exact Indigo predicate within full Base(c)."}, + {"id":"P3","decision":"PASS","evidence":"H lines 73–76 prove the full Scarlet-only witness by substitution."}, + {"id":"P4","decision":"PASS","evidence":"H lines 76–79 prove the full Indigo-only witness by substitution."}, + {"id":"P5","decision":"PASS","evidence":"H lines 20–23 and 89–91 leave project-promise identity UNPROVED and label A only an audit domain."}, + {"id":"P6","decision":"PASS","evidence":"H lines 42–59 define DS through Base(c), which retains all seven coordinates and full fibers."}, + {"id":"P7","decision":"PASS","evidence":"H lines 42–71 define DI through the same complete Base(c)."}, + {"id":"P8","decision":"PASS","evidence":"H lines 81–89 separately prove DS subset A by the left union disjunct."}, + {"id":"P9","decision":"PASS","evidence":"H lines 81–89 separately prove DI subset A by the right union disjunct."}, + {"id":"P10","decision":"PASS","evidence":"H lines 95–97 universally exclude f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"H lines 95–97 universally exclude f=true,t=W from Indigo."}, + {"id":"P12","decision":"FAIL","evidence":"H lines 99–112 assert cfg(all(...)) rejection, but quote only cfg-attribute and compile_error! text; no exact-version authority supplies the material all predicate rule."}, + {"id":"P13","decision":"PASS","evidence":"H lines 124–143 cite each exact unwrap_or contract and prove both non-turbo input cases."}, + {"id":"P14","decision":"PASS","evidence":"H lines 124–149 cite the None prohibition and trace the receiver to constructed Some(x)."}, + {"id":"P15","decision":"PASS","evidence":"H lines 144–149 compose unwrap_or with unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"H lines 42–46 and 81–85 define Required=A over all seven coordinates."}, + {"id":"P17","decision":"PASS","evidence":"H lines 158–163 define Executable and Covered_sound through full Base(c)."}, + {"id":"P18","decision":"FAIL","evidence":"H's non-turbo coverage proof at lines 139–143 relies on not(feature=\"turbo\") selection, but no version-matched not semantics is cited or quoted."}, + {"id":"P19","decision":"FAIL","evidence":"H lines 168–174 claim closure, but Covered_sound applicability is incomplete because the non-turbo cfg-not selection premise is unchecked."}, + {"id":"P20","decision":"FAIL","evidence":"H lines 11–14 claim whole-domain soundness, but its required P19 certificate rests on the incomplete Covered_sound derivation."}, + {"id":"P21","decision":"PASS","evidence":"H lines 158–165 define Covered_post through full Base(c), retaining v,t,f,h,p,d,i."}, + {"id":"P22","decision":"FAIL","evidence":"H lines 139–149 prove local results, but Covered_post applicability for f=false still relies on uncited exact-version not semantics."}, + {"id":"P23","decision":"FAIL","evidence":"H lines 168–175 claim behavioral closure from a Covered_post derivation whose non-turbo source-selection premise is unchecked."}, + {"id":"P24","decision":"FAIL","evidence":"H lines 15–16 state behavior PROVED without importing the TCB qualification and the P23 closure certificate is incomplete."}, + {"id":"P25","decision":"PASS","evidence":"H lines 180–185 accurately limit BUILD-MAP-POLICY to exact releases, supplied inputs, mappings, and allowed reachability/rejection consumers."}, + {"id":"P26","decision":"FAIL","evidence":"H's behavior verdict at lines 15–16 says only 'on that same domain'; unlike soundness and rejection, it does not conspicuously carry the BUILD-MAP-POLICY qualification."}, + {"id":"P27","decision":"FAIL","evidence":"H's authority inventory omits exact-version quotations/URLs for the all and not semantics materially used at lines 102 and 139."} + ], + "hard_errors": [ + {"id":"G11","evidence":"H's positive rejection and coverage claims necessarily rely on unchecked all/not Rust semantics absent from its exact-version authority inventory."} + ], + "proposal_laundering": {"present":false,"evidence":"H proposes only a comment rewrite and does not use it to certify the current implementation."}, + "tcb_authority_defect": {"present":true,"evidence":"H omits material all/not Rust authority and fails to carry the accepted-TCB qualification into its behavioral conclusion."}, + "visible_scope_defect": {"present":false,"evidence":"H evidences no prohibited oracle, sibling, condition-map, prior-score, or evaluator access."}, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"C lines 23–25 state Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"C lines 27–29 state Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"C line 37 proves the stated configuration is Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"C line 38 proves the stated configuration is Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"C lines 11–13 and 115 leave exact-promise identity UNPROVED/unresolved and distinguish R."}, + {"id":"P6","decision":"PASS","evidence":"C lines 17–33 define K and D_S with every full-case coordinate and fiber."}, + {"id":"P7","decision":"PASS","evidence":"C lines 17–33 define K and D_I with every full-case coordinate and fiber."}, + {"id":"P8","decision":"PASS","evidence":"C lines 42–46 separately prove D_S subset R by its left disjunct."}, + {"id":"P9","decision":"PASS","evidence":"C lines 42–46 separately prove D_I subset R by its right disjunct."}, + {"id":"P10","decision":"PASS","evidence":"C line 66 substitutes f=true,t=W and universally excludes Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"C line 66 performs the same universal Indigo exclusion."}, + {"id":"P12","decision":"PASS","evidence":"C lines 50–66 combine exact-version all/cfg/macro text and exact TCB mapping over the whole wasm fiber."}, + {"id":"P13","decision":"PASS","evidence":"C lines 54 and 74–76 prove the non-turbo postcondition for every input."}, + {"id":"P14","decision":"PASS","evidence":"C lines 54 and 77 prove the unchecked receiver is the locally constructed Some(value)."}, + {"id":"P15","decision":"PASS","evidence":"C lines 77–78 compose both Option results into spec(i)."}, + {"id":"P16","decision":"PASS","evidence":"C lines 17–21 and 42–44 define Required=R over the complete c tuple."}, + {"id":"P17","decision":"PASS","evidence":"C lines 93–101 define Covered_sound via c in K, preserving all seven axes."}, + {"id":"P18","decision":"PASS","evidence":"C lines 58–64 and 74–78 give complete branch-selection and unsafe proofs for every covered case."}, + {"id":"P19","decision":"PASS","evidence":"C lines 101–105 carry each Required case into the applicable covered branch and state the containment."}, + {"id":"P20","decision":"PASS","evidence":"C lines 9, 13, and 103–107 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"C lines 97–101 define Covered_post through full K membership."}, + {"id":"P22","decision":"PASS","evidence":"C lines 76–78 prove spec(i) on both branches in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"C lines 103–105 prove Required subset Covered_post as part of the exact intersection closure."}, + {"id":"P24","decision":"PASS","evidence":"C lines 10, 13, and 103–107 state qualified behavior PROVED with its closure."}, + {"id":"P25","decision":"PASS","evidence":"C lines 58 and 109–113 keep BUILD-MAP-POLICY at its exact mapping, profile region, and permitted consumers."}, + {"id":"P26","decision":"PASS","evidence":"C lines 9–13 conspicuously qualify both conclusions, while lines 109–113 distinguish TCB from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"C lines 48–54 provide exact-version quotations and URLs for every material Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"C's suggested comment is not used as evidence for the current artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"C supplies exact TCB accounting and complete, version-matched authority closure."}, + "visible_scope_defect": {"present":false,"evidence":"C's naming of the supplied skill package is expressly in scope; no prohibited material is evidenced."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"D lines 33–39 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"D lines 41–49 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"D lines 51–53 state the valid Scarlet-only witness after giving exact formulas."}, + {"id":"P4","decision":"PASS","evidence":"D lines 51–53 state the valid Indigo-only witness after giving exact formulas."}, + {"id":"P5","decision":"PASS","evidence":"D lines 22–24 and 70–71 say the audit union does not identify the crate promise."}, + {"id":"P6","decision":"PASS","evidence":"D lines 28–30 and 55–60 define D_S across v,t,f,h,p,d,i."}, + {"id":"P7","decision":"PASS","evidence":"D lines 28–30 and 55–60 define D_I across v,t,f,h,p,d,i."}, + {"id":"P8","decision":"PASS","evidence":"D lines 62–70 separately prove D_S subset Required by left disjunction."}, + {"id":"P9","decision":"PASS","evidence":"D lines 62–70 separately prove D_I subset Required by right disjunction."}, + {"id":"P10","decision":"PASS","evidence":"D lines 95–101 universally exclude f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"D lines 95–101 universally exclude f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"D lines 86–101 and 165–181 combine exact mapping with quoted option-predicate, all, cfg, and macro rules over all build axes."}, + {"id":"P13","decision":"PASS","evidence":"D lines 128–129 and 154–158 prove unwrap_or's result for both non-turbo inputs."}, + {"id":"P14","decision":"PASS","evidence":"D lines 130 and 159–164 prove the exact unchecked receiver is Some(x), not None."}, + {"id":"P15","decision":"PASS","evidence":"D lines 130–131 and 159–164 compose unwrap_or with the contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"D lines 55–65 define Required through complete D_S/D_I full-case predicates."}, + {"id":"P17","decision":"PASS","evidence":"D lines 75–84 define Covered_SND via B(c), retaining every coordinate."}, + {"id":"P18","decision":"PASS","evidence":"D lines 86–94 and 128–131 establish applicable soundness on both branches admitted by Covered_SND."}, + {"id":"P19","decision":"PASS","evidence":"D lines 103–115 prove Required subset Covered_SND while carrying h,p,d,i parametrically."}, + {"id":"P20","decision":"PASS","evidence":"D lines 17–20 and 103–111 give TCB-qualified whole-domain soundness and closure."}, + {"id":"P21","decision":"PASS","evidence":"D lines 75–84 define Covered_POST via full B(c)."}, + {"id":"P22","decision":"PASS","evidence":"D lines 129–131 give complete Q proofs for both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"D lines 103–115 independently prove Required subset Covered_POST."}, + {"id":"P24","decision":"PASS","evidence":"D lines 19–20 and 103–111 state POST PROVED under the same TCB and its closure."}, + {"id":"P25","decision":"PASS","evidence":"D lines 183–189 state the exact Cargo/releases, mappings, profiles, consumers, exclusions, and triggers."}, + {"id":"P26","decision":"PASS","evidence":"D lines 17–20 share an explicit TCB qualification, and lines 183–189 label it out-of-band rather than Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"D lines 150–181 quote and link every material Option, cfg/all/not, and compile_error! premise per release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"D does not use its proposed comment replacement to certify an unimplemented artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"D has exact TCB scope, conspicuous qualification, and complete exact-version Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"D evidences no source-scope departure or prohibited evaluator access."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"B lines 23–28 state Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"B lines 29–34 state Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"B line 40 substitutes and proves the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"B line 40 substitutes and proves the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"B lines 12 and 53 distinguish unresolved crate-level Required from theorem-only Required_A."}, + {"id":"P6","decision":"PASS","evidence":"B lines 16–18 and 36–38 define S(c) across the complete full-case product."}, + {"id":"P7","decision":"PASS","evidence":"B lines 16–18 and 36–38 define I(c) across the complete full-case product."}, + {"id":"P8","decision":"PASS","evidence":"B lines 42–51 separately prove S subset A with every p,d,i unchanged."}, + {"id":"P9","decision":"PASS","evidence":"B lines 42–51 separately prove I subset A with every p,d,i unchanged."}, + {"id":"P10","decision":"PASS","evidence":"B lines 45–51 and 69–70 establish Scarlet's universal turbo/W exclusion."}, + {"id":"P11","decision":"PASS","evidence":"B lines 45–51 and 69–70 establish Indigo's universal turbo/W exclusion."}, + {"id":"P12","decision":"PASS","evidence":"B lines 57–70 quote and apply exact mapping, all/cfg, and compile_error! rules across all required axes."}, + {"id":"P13","decision":"PASS","evidence":"B lines 61 and 72–75 prove unwrap_or's exact non-turbo result for all inputs."}, + {"id":"P14","decision":"PASS","evidence":"B lines 61 and 75 show the unsafe receiver is constructed as Some(x), never None."}, + {"id":"P15","decision":"PASS","evidence":"B line 75 composes the first result with unwrap_unchecked's contained-value return."}, + {"id":"P16","decision":"PASS","evidence":"B lines 16–18, 42, and 53 define Required_A over the complete case tuple."}, + {"id":"P17","decision":"PASS","evidence":"B lines 87–99 define Covered_sound through full A(c) and the complete selected execution."}, + {"id":"P18","decision":"PASS","evidence":"B lines 67 and 74–75 prove every selected branch admitted by Covered_sound UB-free."}, + {"id":"P19","decision":"PASS","evidence":"B lines 101–102 give the exhaustive full-case split and prove Required_A subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"B lines 9 and 101–102 state TCB-qualified whole-domain soundness with exact closure."}, + {"id":"P21","decision":"PASS","evidence":"B lines 87–99 define Covered_post through A(c), retaining all dimensions and input."}, + {"id":"P22","decision":"PASS","evidence":"B lines 74–75 prove q(i) on both branches admitted by Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"B lines 101–102 prove Required_A subset Covered_post and exact aggregate closure."}, + {"id":"P24","decision":"PASS","evidence":"B lines 10 and 101–102 give the TCB-qualified whole-domain postcondition conclusion."}, + {"id":"P25","decision":"PASS","evidence":"B line 63 records the exact releases, supplied inputs, mappings, all profiles, and permitted selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"B lines 9–11 use an explicit shared qualification; line 63 distinguishes BUILD-MAP-POLICY from Rust authority."}, + {"id":"P27","decision":"PASS","evidence":"B lines 57–61 quote and link every material cfg/all/not, compile_error!, and Option proposition per exact release."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"B's comment suggestion is not used to narrow or certify current obligations."}, + "tcb_authority_defect": {"present":false,"evidence":"B accurately scopes and qualifies BUILD-MAP-POLICY and supplies complete exact-version authority."}, + "visible_scope_defect": {"present":false,"evidence":"B establishes no review of prohibited evaluation materials."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"F line 37 states the exact Scarlet predicate with V/T bounds."}, + {"id":"P2","decision":"PASS","evidence":"F line 41 states the exact Indigo predicate with V/T bounds."}, + {"id":"P3","decision":"PASS","evidence":"F lines 45–47 substitute and prove the Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"F lines 48–50 substitute and prove the Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"F lines 25–27 and 65–66 leave exact-promise identity UNPROVED and distinguish R."}, + {"id":"P6","decision":"PASS","evidence":"F lines 31–33 and 52–56 define D_S over all seven coordinates and complete fibers."}, + {"id":"P7","decision":"PASS","evidence":"F lines 31–33 and 52–56 define D_I over all seven coordinates and complete fibers."}, + {"id":"P8","decision":"PASS","evidence":"F lines 58–64 separately prove D_S subset R as a full-case containment."}, + {"id":"P9","decision":"PASS","evidence":"F lines 58–64 separately prove D_I subset R as a full-case containment."}, + {"id":"P10","decision":"PASS","evidence":"F lines 115–117 universally falsify Scarlet at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"F lines 115–117 universally falsify Indigo at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"F lines 83–95 and 119–125 provide exact all/cfg/macro authority, TCB mapping, and full-fiber rejection."}, + {"id":"P13","decision":"PASS","evidence":"F lines 70–80 and 138–143 prove the non-turbo result for every valid input and exact release."}, + {"id":"P14","decision":"PASS","evidence":"F lines 70–80 and 145–150 connect Some(x) at the exact unsafe receiver to the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"F lines 145–152 compose unwrap_or and unwrap_unchecked to establish Q."}, + {"id":"P16","decision":"PASS","evidence":"F lines 10–12 and 52–60 define Required=R over v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"F lines 164–176 define Covered_sound=R and explicitly retain every dimension through universal branch lemmas."}, + {"id":"P18","decision":"PASS","evidence":"F lines 109–113 and 138–152 prove each branch in Covered_sound has a complete soundness derivation."}, + {"id":"P19","decision":"PASS","evidence":"F lines 171–180 exhaust f and prove Required=Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"F lines 22 and 178–184 give the BUILD-MAP-POLICY-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"F lines 164–176 define Covered_post=R while explicitly retaining v,t,f,h,p,d,i."}, + {"id":"P22","decision":"PASS","evidence":"F lines 138–152 prove Q completely on both branches admitted by Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"F lines 171–183 separately prove Required=Covered_post and its containment."}, + {"id":"P24","decision":"PASS","evidence":"F lines 23 and 180–184 give the qualified whole-domain behavioral conclusion and closure."}, + {"id":"P25","decision":"PASS","evidence":"F lines 97–105 keep BUILD-MAP-POLICY to exact bundled releases, mappings, supplied artifact, profiles, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"F lines 22–24 conspicuously qualify all verdicts, and lines 97–104 distinguish accepted mapping from Rust semantics."}, + {"id":"P27","decision":"PASS","evidence":"F lines 70–95 pair all used Option, cfg/all/not, and compile_error! propositions with exact-version URLs and quotations."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"F uses no unimplemented design as proof of current soundness or behavior."}, + "tcb_authority_defect": {"present":false,"evidence":"F provides exact TCB scope and conspicuous qualification plus complete versioned Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"F evidences no review outside supplied source scope and permitted authority pages."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"E lines 26–33 reproduce Scarlet exactly."}, + {"id":"P2","decision":"PASS","evidence":"E lines 35–42 reproduce Indigo exactly."}, + {"id":"P3","decision":"PASS","evidence":"E lines 44–48 state a valid Scarlet-only witness, (1.84.0,A,true,true)."}, + {"id":"P4","decision":"PASS","evidence":"E lines 44–48 state a valid Indigo-only witness, (1.84.0,X,true,true)."}, + {"id":"P5","decision":"PASS","evidence":"E lines 12 and 17–19 leave exact-promise identity UNPROVED and deny renaming the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"E lines 53–59 define D_S over all profiles, both debug states, and every Option input."}, + {"id":"P7","decision":"PASS","evidence":"E lines 53–60 define D_I over the same complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"E lines 66–80 separately prove D_S is contained in the transparent full-case superset Required."}, + {"id":"P9","decision":"PASS","evidence":"E lines 66–80 separately prove D_I is contained in Required."}, + {"id":"P10","decision":"PASS","evidence":"E line 82 universally falsifies Scarlet at f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"E line 82 universally falsifies Indigo at f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"E lines 82–88 and 95–107 apply exact all/cfg/macro authority and BUILD-MAP-POLICY across the complete wasm fiber."}, + {"id":"P13","decision":"PASS","evidence":"E lines 108–116 and 125–129 prove the non-turbo postcondition for every input and exact release."}, + {"id":"P14","decision":"PASS","evidence":"E lines 108–116 and 131–137 prove the unsafe receiver is immediately constructed as Some(y), not None."}, + {"id":"P15","decision":"PASS","evidence":"E lines 131–139 compose unwrap_or and unwrap_unchecked to prove the turbo result."}, + {"id":"P16","decision":"PASS","evidence":"E lines 66–72 define Required over the full F(c) tuple with no projected dimension."}, + {"id":"P17","decision":"PASS","evidence":"E lines 148–154 define Covered_sound from full L0/L1 case predicates."}, + {"id":"P18","decision":"PASS","evidence":"E lines 125–139 prove soundness on every case in L0 or L1."}, + {"id":"P19","decision":"PASS","evidence":"E lines 157–162 exhaust f and prove Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"E lines 13, 17–18, and 157–164 give the BUILD-MAP-POLICY-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"E lines 148–155 define Covered_behavior from full L0/L1 predicates, retaining every case coordinate."}, + {"id":"P22","decision":"PASS","evidence":"E lines 125–139 prove the exact documented result on both covered branches."}, + {"id":"P23","decision":"PASS","evidence":"E lines 157–164 separately prove Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"E lines 14, 17–18, and 157–164 give the qualified whole-domain behavioral conclusion and closure."}, + {"id":"P25","decision":"PASS","evidence":"E lines 168–173 limit BUILD-MAP-POLICY to exact releases, mappings, supplied artifact, and selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"E lines 13–18 conspicuously qualify all dependent conclusions, and lines 168–173 distinguish the TCB from Rust axioms."}, + {"id":"P27","decision":"PASS","evidence":"E lines 90–116 pair each material cfg/all/not, compile_error!, and Option premise with exact-version quotations and URLs."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"E's suggested comment is not used as evidence for the current artifact."}, + "tcb_authority_defect": {"present":false,"evidence":"E gives exact TCB accounting, explicit qualification, and complete version-matched Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"E establishes no material departure from the supplied review scope."}, + "novel_findings": [] + } + ], + "ambiguities": [ + "H: the rubric does not explicitly state how far an unchecked cfg-combinator authority premise cascades beyond P12/P27. I scored P18–P24 downstream failures where complete applicability and listed dependencies require that source-selection premise.", + "H: 'on that same domain' could import only the preceding domain or also its TCB qualification. I scored P26 FAIL because the behavioral verdict does not conspicuously say it shares the BUILD-MAP-POLICY qualification." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/P/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/P/s2.json new file mode 100644 index 0000000000..5dc9a90b5e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/P/s2.json @@ -0,0 +1,382 @@ +{ + "schema_version": 1, + "mode": "P", + "scorer_id": "s2", + "reports": [ + { + "label": "C", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L23-25 gives the complete Scarlet formula, including V/T bounds and all three disjuncts."}, + {"id":"P2","decision":"PASS","evidence":"L27-29 gives the complete Indigo formula, including both versioned turbo arms."}, + {"id":"P3","decision":"PASS","evidence":"L35-38 substitutes (1.84.0,X,true,false) and proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L35-38 substitutes (1.84.0,X,true,true) and proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L11 and L42-46 leave exact-promise identity UNPROVED while using the union only as an audit requirement."}, + {"id":"P6","decision":"PASS","evidence":"L17-21 and L31-33 define D_S over the complete seven-coordinate product."}, + {"id":"P7","decision":"PASS","evidence":"L17-21 and L31-33 define D_I over the complete seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"L42-46 proves D_S subseteq R by the left union disjunct."}, + {"id":"P9","decision":"PASS","evidence":"L42-46 separately proves D_I subseteq R by the right union disjunct."}, + {"id":"P10","decision":"PASS","evidence":"L66 universally falsifies every Scarlet arm when f=true,t=W."}, + {"id":"P11","decision":"PASS","evidence":"L66 universally falsifies every Indigo arm when f=true,t=W."}, + {"id":"P12","decision":"PASS","evidence":"L50-52 and L58-66 apply exact BUILD-MAP-POLICY, all/cfg, and compile_error contracts over v,h,p,d."}, + {"id":"P13","decision":"PASS","evidence":"L54 and L76 apply each exact-version unwrap_or contract to None and Some."}, + {"id":"P14","decision":"PASS","evidence":"L54 and L77 trace unwrap_or's byte into the exact Some(value) receiver and discharge the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L54 and L78 compose unwrap_or, Some construction, and unwrap_unchecked's return contract."}, + {"id":"P16","decision":"PASS","evidence":"L21, L42-44, and L93 define Required=R over complete tuples in K."}, + {"id":"P17","decision":"PASS","evidence":"L95 and L101 retain v,t,f,h,p,d,i in Covered_sound through K."}, + {"id":"P18","decision":"PASS","evidence":"L76-77 and L95 prove both no-unsafe and turbo-unsafe regions admitted to Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L103-105 maps each Required f branch to proved coverage and states Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L9, L13, and L103-107 conclude whole-domain soundness PROVED relative to BUILD-MAP-POLICY from closure."}, + {"id":"P21","decision":"PASS","evidence":"L97-101 retain all seven coordinates in Covered_post through K."}, + {"id":"P22","decision":"PASS","evidence":"L76, L78, and L97-99 establish the postcondition on every case admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L103-105 independently gives Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L10, L13, and L103-107 conclude the full-domain postcondition PROVED with the TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L58 and L111-113 confine BUILD-MAP-POLICY to its exact mapping identity, consumers, and region."}, + {"id":"P26","decision":"PASS","evidence":"L9-10, L13, L66, and L79 conspicuously carry BUILD-MAP-POLICY into all dependent conclusions."}, + {"id":"P27","decision":"PASS","evidence":"L50-54 supplies exact-version URLs and quotations for cfg/all/not, compile_error, unwrap_or, and unwrap_unchecked."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L81-89 labels the suggested comment as documentation-only and proves the current implementation independently."}, + "tcb_authority_defect": {"present":false,"evidence":"L50-54 and L111-113 separate exact Rust authority from the narrowly accepted build mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5 identifies only the supplied snapshot and expressly disclaims prior-audit use."}, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L39-44 reproduces Scarlet with its exact bounds and versioned X/A arms."}, + {"id":"P2","decision":"PASS","evidence":"L45-49 reproduces Indigo with its exact bounds and versioned X/A arms."}, + {"id":"P3","decision":"PASS","evidence":"L58-60 checks (1.84.0,X,true,false) in Scarlet and out of Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L60-63 checks (1.84.0,X,true,true) in Indigo and out of Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L17 and L19-22 state policy identity UNPROVED and distinguish Required from the project promise."}, + {"id":"P6","decision":"PASS","evidence":"L28-36 and L51-56 define D_S with all seven coordinates and every valid Option input."}, + {"id":"P7","decision":"PASS","evidence":"L28-36 and L51-56 define D_I with all seven coordinates and every valid Option input."}, + {"id":"P8","decision":"PASS","evidence":"L76-83 separately proves D_S subseteq Required via S implies S or I."}, + {"id":"P9","decision":"PASS","evidence":"L76-83 separately proves D_I subseteq Required via I implies S or I."}, + {"id":"P10","decision":"PASS","evidence":"L76-80 and L158-160 show Scarlet has no f=true,t=W case for arbitrary remaining axes."}, + {"id":"P11","decision":"PASS","evidence":"L76-80 and L158-160 show Indigo has no f=true,t=W case for arbitrary remaining axes."}, + {"id":"P12","decision":"PASS","evidence":"L87-104 and L158-164 give the exact mapping, all/cfg inclusion, and compile_error failure for every full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L106-117 and L148-150 apply exact-version unwrap_or prose to both Option variants."}, + {"id":"P14","decision":"PASS","evidence":"L151-157 traces r through unwrap_or into the immediate Some(r) receiver and rules out None."}, + {"id":"P15","decision":"PASS","evidence":"L151-157 composes both Option return contracts to obtain Q(o)."}, + {"id":"P16","decision":"PASS","evidence":"L67-74 defines Required over v,t,f,h,p,d,o without projection."}, + {"id":"P17","decision":"PASS","evidence":"L138-146 defines K and Covered_sound with every case coordinate."}, + {"id":"P18","decision":"PASS","evidence":"L148-157 proves the safe and turbo regions included in Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L166-172 carries all common conjuncts and proves Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L14, L19-22, and L166-172 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L138-146 defines Covered_behavior over the same complete K tuple."}, + {"id":"P22","decision":"PASS","evidence":"L148-157 proves Q(o) on every non-turbo and turbo case admitted to behavioral coverage."}, + {"id":"P23","decision":"PASS","evidence":"L166-172 separately proves Required subseteq Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L15, L19-22, and L166-172 conclude the postcondition PROVED over Required relative to the TCB."}, + {"id":"P25","decision":"PASS","evidence":"L119-127 records the exact bundled releases, manifest, mappings, consumers, and exclusions."}, + {"id":"P26","decision":"PASS","evidence":"L14-16 and L19-22 conspicuously qualify soundness, behavior, and rejection with TCB-BUILD-MAP."}, + {"id":"P27","decision":"PASS","evidence":"L87-117 provides version-matched URLs and supplying quotations for every material Rust premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L181-191 identifies a documentation-only replacement and does not use it to prove the current code."}, + "tcb_authority_defect": {"present":false,"evidence":"L119-127 narrowly accounts for BUILD-MAP-POLICY and separates exact Rust axioms."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 confines the review to supplied files and disclaims prior-audit evidence."}, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L16-23 states Scarlet's full V/T-bounded predicate and every disjunct."}, + {"id":"P2","decision":"PASS","evidence":"L25-32 states Indigo's full V/T-bounded predicate and every disjunct."}, + {"id":"P3","decision":"PASS","evidence":"L34 substitutes the 1.84 X unhardened witness into both predicates."}, + {"id":"P4","decision":"PASS","evidence":"L34 substitutes the 1.84 X hardened witness into both predicates."}, + {"id":"P5","decision":"PASS","evidence":"L10 and L60 leave exact-promise identity UNPROVED and label U only an audit envelope."}, + {"id":"P6","decision":"PASS","evidence":"L36-42 defines D_S over the full seven-coordinate case."}, + {"id":"P7","decision":"PASS","evidence":"L36-42 defines D_I over the full seven-coordinate case."}, + {"id":"P8","decision":"PASS","evidence":"L51-58 proves every Scarlet disjunct implies U with remaining dimensions unchanged."}, + {"id":"P9","decision":"PASS","evidence":"L51-58 separately proves every Indigo disjunct implies U."}, + {"id":"P10","decision":"PASS","evidence":"L75 and L80 prove the entire f=true,t=W fiber is disjoint from D_S."}, + {"id":"P11","decision":"PASS","evidence":"L75 and L80 prove the entire f=true,t=W fiber is disjoint from D_I."}, + {"id":"P12","decision":"PASS","evidence":"L64, L68, and L75-80 apply the accepted mapping and exact-version all/cfg/compile_error implications universally."}, + {"id":"P13","decision":"PASS","evidence":"L66 and L82 apply unwrap_or's exact contract to arbitrary None/Some input."}, + {"id":"P14","decision":"PASS","evidence":"L66 and L84 connect r=input.unwrap_or(0) to the exact Some(r) unsafe receiver."}, + {"id":"P15","decision":"PASS","evidence":"L66 and L84 use unwrap_unchecked's return contract to recover the original specification result."}, + {"id":"P16","decision":"PASS","evidence":"L36-55 states Required=D_A with v,t,f,h,p,d,input retained."}, + {"id":"P17","decision":"PASS","evidence":"L75-77 and L90-95 define Covered_sound from full-case C_N and C_T predicates."}, + {"id":"P18","decision":"PASS","evidence":"L82-84 establishes applicable no-unsafe and unsafe-site proofs throughout C_N union C_T."}, + {"id":"P19","decision":"PASS","evidence":"L97-102 maps each Required branch to C_N or C_T and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L7 and L97-104 conclude full-domain soundness PROVED relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L75-77 and L90-95 retain the complete tuple in Covered_behavior."}, + {"id":"P22","decision":"PASS","evidence":"L82-84 proves the return specification for all C_N and C_T inputs."}, + {"id":"P23","decision":"PASS","evidence":"L97-102 independently states Required subseteq Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L8 and L97-104 give the TCB-qualified whole-domain postcondition verdict."}, + {"id":"P25","decision":"PASS","evidence":"L68 restricts BUILD-MAP-POLICY to the three Cargo identities, named mappings, profiles, and allowed consumers."}, + {"id":"P26","decision":"PASS","evidence":"L7-10, L68, and L80 carry the accepted mapping qualification into all dependent results."}, + {"id":"P27","decision":"PASS","evidence":"L64-66 pairs each material cfg/compile_error/Option proposition with per-release URLs and quotations."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L106-116 calls the suggested comment documentation debt and does not use it as current-artifact evidence."}, + "tcb_authority_defect": {"present":false,"evidence":"L64-68 separates versioned Rust quotations from the narrowly scoped accepted build premise."}, + "visible_scope_defect": {"present":false,"evidence":"L5 identifies only the complete supplied target snapshot and source-level scope."}, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L26-34 reproduces Scarlet exactly, including V/T bounds and both turbo targets."}, + {"id":"P2","decision":"PASS","evidence":"L36-42 reproduces Indigo exactly, including its versioned X and A clauses."}, + {"id":"P3","decision":"PASS","evidence":"L44-46 verifies the 1.84 X unhardened Scarlet-only witness."}, + {"id":"P4","decision":"PASS","evidence":"L46-50 verifies the 1.84 X hardened Indigo-only witness."}, + {"id":"P5","decision":"PASS","evidence":"L19 and L73-77 keep exact-promise identity UNPROVED and distinct from the audit union."}, + {"id":"P6","decision":"PASS","evidence":"L54-68 defines Base over all seven axes and D_S as Base intersect Scarlet."}, + {"id":"P7","decision":"PASS","evidence":"L54-68 defines Base over all seven axes and D_I as Base intersect Indigo."}, + {"id":"P8","decision":"PASS","evidence":"L69-75 separately proves D_S subseteq Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L69-75 separately proves D_I subseteq Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L90-93 shows every full f=true,t=W case is outside Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L90-93 shows every full f=true,t=W case is outside Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L85-100 combines exact-version all/cfg/compile_error contracts with the accepted mapping across the full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L84 and L104-112 apply unwrap_or to both exhaustive valid inputs."}, + {"id":"P14","decision":"PASS","evidence":"L84 and L114-119 trace value into the immediate Some(value) receiver and rule out None."}, + {"id":"P15","decision":"PASS","evidence":"L114-122 composes unwrap_or and unwrap_unchecked return contracts to obtain g(i)."}, + {"id":"P16","decision":"PASS","evidence":"L54-70 states Required over complete Base tuples."}, + {"id":"P17","decision":"PASS","evidence":"L135-141 defines Covered_sound with every Base coordinate."}, + {"id":"P18","decision":"PASS","evidence":"L106-122 and L143-144 prove both source branches admitted by Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L143-148 maps all Required cases and states Required subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L16, L18, and L143-149 provide the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L135-141 defines Covered_post over the complete Base tuple."}, + {"id":"P22","decision":"PASS","evidence":"L106-122 proves g(i) on every branch included in Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L143-148 independently proves Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L17-18 and L143-149 conclude the full-domain postcondition with the same TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L155-160 gives the exact bundled-Cargo identity, supplied artifact, mappings, consumers, and exclusions."}, + {"id":"P26","decision":"PASS","evidence":"L16-18, L95-100, and L155-160 conspicuously qualify every mapping-dependent conclusion."}, + {"id":"P27","decision":"PASS","evidence":"L81-86 supplies exact-version URLs and quotations for Option, all/not/cfg, and compile_error semantics."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L124-131 labels the replacement as documentation debt and the proof does not depend on it."}, + "tcb_authority_defect": {"present":false,"evidence":"L81-86 and L155-160 keep exact Rust authority separate from the accepted mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 confines the audit to the supplied target materials."}, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L23-33 gives Scarlet's exact bounded predicate and all disjuncts."}, + {"id":"P2","decision":"PASS","evidence":"L35-42 gives Indigo's exact bounded predicate and all disjuncts."}, + {"id":"P3","decision":"PASS","evidence":"L44-48 correctly checks (1.84.0,A,true,true) as Scarlet-only."}, + {"id":"P4","decision":"PASS","evidence":"L44-48 correctly checks (1.84.0,X,true,true) as Indigo-only."}, + {"id":"P5","decision":"PASS","evidence":"L12 and L17-19 leave policy identity UNPROVED and refuse to rename the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"L53-60 defines D_S over every profile, both debug states, and all valid Option inputs."}, + {"id":"P7","decision":"PASS","evidence":"L53-60 defines D_I over every profile, both debug states, and all valid Option inputs."}, + {"id":"P8","decision":"PASS","evidence":"L66-80 separately proves Scarlet cases imply the selected full superset."}, + {"id":"P9","decision":"PASS","evidence":"L66-80 separately proves Indigo cases imply the selected full superset."}, + {"id":"P10","decision":"PASS","evidence":"L82-88 universally excludes f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L82-88 universally excludes f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L82-88 and L95-107 apply exact mapping, all/cfg selection, and compile_error failure to the full fiber."}, + {"id":"P13","decision":"PASS","evidence":"L108-116 and L125-129 apply exact-version unwrap_or behavior to both variants."}, + {"id":"P14","decision":"PASS","evidence":"L131-139 traces y into the syntactically immediate Some(y) receiver."}, + {"id":"P15","decision":"PASS","evidence":"L131-139 composes both Option contracts to prove the documented result."}, + {"id":"P16","decision":"PASS","evidence":"L66-72 defines Required with all seven dimensions explicit."}, + {"id":"P17","decision":"PASS","evidence":"L148-155 retains the full F(c) tuple in Covered_sound."}, + {"id":"P18","decision":"PASS","evidence":"L125-139 and L151-154 completely prove both L0 and L1 soundness regions."}, + {"id":"P19","decision":"PASS","evidence":"L157-164 exhausts f and proves Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L13, L17-19, and L157-164 certify soundness over Required relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L148-155 retains the full F(c) tuple in Covered_behavior."}, + {"id":"P22","decision":"PASS","evidence":"L125-139 proves the documented return on every L0 and L1 case."}, + {"id":"P23","decision":"PASS","evidence":"L157-164 separately proves Required subset Covered_behavior."}, + {"id":"P24","decision":"PASS","evidence":"L14, L17-19, and L157-164 certify the full-domain behavior theorem with TCB relativity."}, + {"id":"P25","decision":"PASS","evidence":"L168-173 confines BUILD-MAP-POLICY to exact releases, mappings, consumers, and excludes Rust/backend claims."}, + {"id":"P26","decision":"PASS","evidence":"L13-18 and L82-88 explicitly qualify all mapping-dependent verdicts."}, + {"id":"P27","decision":"PASS","evidence":"L92-116 pairs every material cfg/compile_error/Option premise with exact-version links and quotes."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L175-186 labels the replacement documentation-only and does not use it for current proof."}, + "tcb_authority_defect": {"present":false,"evidence":"L168-173 narrowly scopes the accepted mapping and keeps CFG/CE/OPTION as exact Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"L5-8 states a source-only review of the supplied target and no external execution evidence."}, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L37-44 reproduces the complete bounded Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"L45-49 reproduces the complete bounded Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"L51-55 verifies the Scarlet-only 1.84 X unhardened witness."}, + {"id":"P4","decision":"PASS","evidence":"L53-55 verifies the Indigo-only 1.84 X hardened witness."}, + {"id":"P5","decision":"PASS","evidence":"L17 and L19-24 leave project-promise identity UNPROVED and distinguish the audit domain."}, + {"id":"P6","decision":"PASS","evidence":"L57-65 defines D_S over all seven requested coordinates."}, + {"id":"P7","decision":"PASS","evidence":"L57-65 defines D_I over all seven requested coordinates."}, + {"id":"P8","decision":"PASS","evidence":"L67-70 separately proves D_S subseteq Required by left disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L67-70 separately proves D_I subseteq Required by right disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L103-107 substitutes f=true,t=W and excludes all Scarlet cases."}, + {"id":"P11","decision":"PASS","evidence":"L103-107 substitutes f=true,t=W and excludes all Indigo cases."}, + {"id":"P12","decision":"PASS","evidence":"L76-101 combines exact-version all/cfg/compile_error quotations with exact BUILD-MAP-POLICY mapping."}, + {"id":"P13","decision":"PASS","evidence":"L111-126 applies per-release unwrap_or prose to every valid input."}, + {"id":"P14","decision":"PASS","evidence":"L111-127 traces the produced byte into immediate Some(y) and rules out None."}, + {"id":"P15","decision":"PASS","evidence":"L111-128 composes unwrap_or and unwrap_unchecked returns to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L57-65 defines Required as a predicate on v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"L137-145 defines Covered_sound with all Base coordinates retained."}, + {"id":"P18","decision":"PASS","evidence":"L124-133 proves the no-unsafe and turbo unsafe-obligation regions underlying Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L147-158 maps every Required policy arm into Compiles and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L15, L19-21, and L147-161 give the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L137-145 defines Covered_post with every full-case coordinate."}, + {"id":"P22","decision":"PASS","evidence":"L124-133 proves Q on every case admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L147-158 separately proves Required subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L16, L19-21, and L147-161 conclude the documented postcondition on the whole domain under the same qualification."}, + {"id":"P25","decision":"PASS","evidence":"L91-94 and L165-171 limit BUILD-MAP-POLICY to its exact mapping and listed source-selection/rejection consumers."}, + {"id":"P26","decision":"PASS","evidence":"L15-16, L106, L129, and L165-171 carry BUILD-MAP-POLICY into every dependent conclusion."}, + {"id":"P27","decision":"PASS","evidence":"L76-89 and L111-120 provide exact-release URLs and supplying quotations for all material Rust semantics."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L173-183 explicitly calls the replacement documentation-only while the current implementation remains proved."}, + "tcb_authority_defect": {"present":false,"evidence":"L165-171 keeps the accepted mapping within its consumers and uses exact-version Rust authority separately."}, + "visible_scope_defect": {"present":false,"evidence":"L5-11 limits scope to the supplied target and its visible surfaces."}, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L31-37 states Scarlet exactly with V/T bounds and both turbo arms."}, + {"id":"P2","decision":"PASS","evidence":"L39-41 states Indigo exactly with V/T bounds and both versioned arms."}, + {"id":"P3","decision":"PASS","evidence":"L43-47 verifies the Scarlet-only 1.84 X unhardened configuration."}, + {"id":"P4","decision":"PASS","evidence":"L48-50 verifies the Indigo-only 1.84 X hardened configuration."}, + {"id":"P5","decision":"PASS","evidence":"L25-27 and L65-66 leave exact promise identity UNPROVED and distinguish R from policy."}, + {"id":"P6","decision":"PASS","evidence":"L31-33 and L52-56 define D_S with all full-case dimensions."}, + {"id":"P7","decision":"PASS","evidence":"L31-33 and L52-56 define D_I with all full-case dimensions."}, + {"id":"P8","decision":"PASS","evidence":"L58-64 separately proves D_S subseteq R by union introduction."}, + {"id":"P9","decision":"PASS","evidence":"L58-64 separately proves D_I subseteq R by union introduction."}, + {"id":"P10","decision":"PASS","evidence":"L115-117 universally excludes f=true,t=W from Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L115-117 universally excludes f=true,t=W from Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L83-95 and L119-125 apply exact mapping, all/cfg, and compile_error authority over all remaining axes."}, + {"id":"P13","decision":"PASS","evidence":"L70-80 and L138-143 prove unwrap_or's result for None and every Some(n)."}, + {"id":"P14","decision":"PASS","evidence":"L145-152 traces x into an immediate Some(x) receiver and discharges the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L145-152 uses both exact Option return contracts to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L52-60 states Required=R on the complete tuple c."}, + {"id":"P17","decision":"PASS","evidence":"L164-176 defines Covered_sound=R and explicitly retains v,t,f,h,p,d,i."}, + {"id":"P18","decision":"PASS","evidence":"L138-152 and L171-176 establish valid soundness proofs on both exhaustive R branches."}, + {"id":"P19","decision":"PASS","evidence":"L171-180 exhausts f, maps to proved lemmas, and states Required subset Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L22, L24, and L178-184 conclude whole-domain soundness relative to BUILD-MAP-POLICY."}, + {"id":"P21","decision":"PASS","evidence":"L164-176 defines Covered_post=R with every coordinate retained."}, + {"id":"P22","decision":"PASS","evidence":"L138-152 and L171-176 prove Q throughout both Covered_post branches."}, + {"id":"P23","decision":"PASS","evidence":"L178-181 independently proves Required subset Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L23-24 and L178-184 provide the TCB-relative whole-domain postcondition conclusion."}, + {"id":"P25","decision":"PASS","evidence":"L97-105 confines BUILD-MAP-POLICY to exact bundled releases, supplied artifact, mappings, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"L22-24 and L119-125 explicitly carry the build-map qualification into all dependent verdicts."}, + {"id":"P27","decision":"PASS","evidence":"L70-95 gives exact-release URLs and quotations for all Option and conditional-compilation premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L154-162 labels the suggested replacement as documentation debt and proves current code separately."}, + "tcb_authority_defect": {"present":false,"evidence":"L97-105 narrowly scopes the sole TCB entry and separates authoritative Option/cfg semantics."}, + "visible_scope_defect": {"present":false,"evidence":"L5-8 confines review to supplied evidence and disclaims prior results."}, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L28-39 reproduces Scarlet with exact V/T bounds and all clauses."}, + {"id":"P2","decision":"PASS","evidence":"L41-49 reproduces Indigo with exact V/T bounds and all clauses."}, + {"id":"P3","decision":"PASS","evidence":"L51-53 states a correct Scarlet-minus-Indigo witness."}, + {"id":"P4","decision":"PASS","evidence":"L51-53 states a correct Indigo-minus-Scarlet witness."}, + {"id":"P5","decision":"PASS","evidence":"L22-24 and L68-71 leave the exact project domain unresolved and call Required only an audit union."}, + {"id":"P6","decision":"PASS","evidence":"L28-31 and L55-60 define D_S over every profile, debug state, and valid input."}, + {"id":"P7","decision":"PASS","evidence":"L28-31 and L55-60 define D_I over every profile, debug state, and valid input."}, + {"id":"P8","decision":"PASS","evidence":"L62-70 separately proves D_S implies Required."}, + {"id":"P9","decision":"PASS","evidence":"L62-70 separately proves D_I implies Required."}, + {"id":"P10","decision":"PASS","evidence":"L95-101 shows all f=true,t=W cases are outside Scarlet."}, + {"id":"P11","decision":"PASS","evidence":"L95-101 shows all f=true,t=W cases are outside Indigo."}, + {"id":"P12","decision":"PASS","evidence":"L95-101 and L165-181 apply exact accepted mapping and exact-version all/cfg/compile_error contracts."}, + {"id":"P13","decision":"PASS","evidence":"L128-129 and L154-158 prove unwrap_or's exact two-variant behavior."}, + {"id":"P14","decision":"PASS","evidence":"L130 and L159-164 trace x into Some(x) and discharge the None prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L131 and L159-164 compose Option return facts to prove Q."}, + {"id":"P16","decision":"PASS","evidence":"L55-66 defines Required on the full seven-coordinate domains."}, + {"id":"P17","decision":"PASS","evidence":"L75-84 retains v,t,f,h,p,d,i in B, N, U, and Covered_SND."}, + {"id":"P18","decision":"PASS","evidence":"L90-94 and L126-131 prove applicable soundness derivations throughout N union U."}, + {"id":"P19","decision":"PASS","evidence":"L103-115 maps every Required case to N or U and states soundness containment."}, + {"id":"P20","decision":"PASS","evidence":"L17-20 and L103-115 provide the TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L75-84 retains every coordinate in Covered_POST."}, + {"id":"P22","decision":"PASS","evidence":"L129, L131, and L133-135 prove Q throughout Covered_POST."}, + {"id":"P23","decision":"PASS","evidence":"L103-115 independently proves Required subseteq Covered_POST."}, + {"id":"P24","decision":"PASS","evidence":"L19-20 and L103-115 conclude POST over the full domain with the same TCB."}, + {"id":"P25","decision":"PASS","evidence":"L183-189 gives exact bundled releases, mappings, profile region, consumers, exclusions, and triggers."}, + {"id":"P26","decision":"PASS","evidence":"L17-20 and L95-101 conspicuously qualify all mapping-dependent conclusions."}, + {"id":"P27","decision":"PASS","evidence":"L150-181 supplies exact-version links and quotations for every material Option/cfg/compile_error premise."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L137-146 explicitly marks the replacement review-only and does not use it for implementation proof."}, + "tcb_authority_defect": {"present":false,"evidence":"L183-189 keeps BUILD-MAP-POLICY within exact identity and consumers, separate from Rust authority."}, + "visible_scope_defect": {"present":false,"evidence":"L5-10 identifies only the supplied artifact and source-level claim."}, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + {"id":"P1","decision":"PASS","evidence":"L20-27 reproduces the exact bounded Scarlet predicate."}, + {"id":"P2","decision":"PASS","evidence":"L29-34 reproduces the exact bounded Indigo predicate."}, + {"id":"P3","decision":"PASS","evidence":"L40 checks the Scarlet-only 1.84 X unhardened configuration against both formulas."}, + {"id":"P4","decision":"PASS","evidence":"L40 checks the Indigo-only 1.84 X hardened configuration against both formulas."}, + {"id":"P5","decision":"PASS","evidence":"L12 and L53 explicitly leave unique crate promise identity UNPROVED and separate Required_A."}, + {"id":"P6","decision":"PASS","evidence":"L16-18 and L36-38 define S(c) over the full seven-coordinate product."}, + {"id":"P7","decision":"PASS","evidence":"L16-18 and L36-38 define I(c) over the full seven-coordinate product."}, + {"id":"P8","decision":"PASS","evidence":"L42-51 separately proves S subseteq A by disjunction introduction."}, + {"id":"P9","decision":"PASS","evidence":"L42-51 separately proves I subseteq A by disjunction introduction."}, + {"id":"P10","decision":"PASS","evidence":"L45-51 and L69-70 show Scarlet contains no f=true,t=W case."}, + {"id":"P11","decision":"PASS","evidence":"L45-51 and L69-70 show Indigo contains no f=true,t=W case."}, + {"id":"P12","decision":"PASS","evidence":"L57-63 and L69-70 apply exact mapping, all/cfg, and compile_error contracts uniformly over the fiber."}, + {"id":"P13","decision":"PASS","evidence":"L61 and L72-75 apply unwrap_or's exact contract to both valid Option variants."}, + {"id":"P14","decision":"PASS","evidence":"L75 traces x into locally constructed Some(x) and discharges the None safety obligation."}, + {"id":"P15","decision":"PASS","evidence":"L75 uses unwrap_unchecked's contained-value return to establish q(i)."}, + {"id":"P16","decision":"PASS","evidence":"L16-18, L42, and L53 state Required_A=A on complete tuples."}, + {"id":"P17","decision":"PASS","evidence":"L87-99 defines Covered_sound with A(c), f/t, and the selected execution on i."}, + {"id":"P18","decision":"PASS","evidence":"L67 and L74-75 prove every non-turbo and turbo execution admitted to Covered_sound."}, + {"id":"P19","decision":"PASS","evidence":"L101-102 exhausts f, carries the full tuple, and proves Required_A subseteq Covered_sound."}, + {"id":"P20","decision":"PASS","evidence":"L9 and L101-102 give a complete TCB-relative whole-domain soundness certificate."}, + {"id":"P21","decision":"PASS","evidence":"L87-99 defines Covered_post with the complete A(c) tuple and input-sensitive result."}, + {"id":"P22","decision":"PASS","evidence":"L74-75 proves q(i) on every execution admitted to Covered_post."}, + {"id":"P23","decision":"PASS","evidence":"L101-102 independently establishes Required_A subseteq Covered_post."}, + {"id":"P24","decision":"PASS","evidence":"L10 and L101-102 conclude the whole-domain postcondition under the same TCB qualification."}, + {"id":"P25","decision":"PASS","evidence":"L63 confines BUILD-MAP-POLICY to exact bundled releases, supplied artifact, mappings, profiles, and consumers."}, + {"id":"P26","decision":"PASS","evidence":"L9-12 and L63 explicitly qualify every whole-case verdict and the rejection proof."}, + {"id":"P27","decision":"PASS","evidence":"L57-61 provides exact-version URLs and quotations for all conditional-compilation and Option premises."} + ], + "hard_errors": [], + "proposal_laundering": {"present":false,"evidence":"L77-83 offers a comment replacement only after independently proving the current implementation."}, + "tcb_authority_defect": {"present":false,"evidence":"L57-63 separates exact-version Rust authority from the narrowly admitted build mapping."}, + "visible_scope_defect": {"present":false,"evidence":"L5 confines the audit to exact supplied target materials and disclaims outside execution evidence."}, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + {"id":"P1","decision":"FAIL","evidence":"L49-56 labels S0 the exact Scarlet configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DS."}, + {"id":"P2","decision":"FAIL","evidence":"L61-68 labels I0 the exact Indigo configuration predicate but omits the required v in V and t in T bounds; Base repairs only the later full-case DI."}, + {"id":"P3","decision":"PASS","evidence":"L73-76 gives a complete full case and correctly proves Scarlet and not Indigo."}, + {"id":"P4","decision":"PASS","evidence":"L76-79 gives a complete full case and correctly proves Indigo and not Scarlet."}, + {"id":"P5","decision":"PASS","evidence":"L20-23 and L89-91 leave the project promise UNPROVED and call A only an audit union."}, + {"id":"P6","decision":"PASS","evidence":"L42-59 conjoins Base's seven coordinates with S0, yielding the exact Scarlet full-case domain despite P1."}, + {"id":"P7","decision":"PASS","evidence":"L42-71 conjoins Base's seven coordinates with I0, yielding the exact Indigo full-case domain despite P2."}, + {"id":"P8","decision":"PASS","evidence":"L81-89 separately proves DS subseteq A by the left disjunct."}, + {"id":"P9","decision":"PASS","evidence":"L81-89 separately proves DI subseteq A by the right disjunct."}, + {"id":"P10","decision":"PASS","evidence":"L95-97 shows every Base case with f=true,t=W is outside DS."}, + {"id":"P11","decision":"PASS","evidence":"L95-97 shows every Base case with f=true,t=W is outside DI."}, + {"id":"P12","decision":"FAIL","evidence":"L99-112 claims universal rejection but quotes/cites only cfg-attribute and compile_error semantics; no exact-version all predicate authority supplies the two-leaves-to-true step."}, + {"id":"P13","decision":"PASS","evidence":"L124-143 supplies exact-version unwrap_or authority and proves both input cases on the non-turbo body."}, + {"id":"P14","decision":"PASS","evidence":"L124-149 traces x into the exact Some(x) receiver and uses the cited None/UB prohibition."}, + {"id":"P15","decision":"PASS","evidence":"L144-149 composes both Option return contracts and establishes Q for every valid input."}, + {"id":"P16","decision":"PASS","evidence":"L42-46 and L81-85 state Required=A over v,t,f,h,p,d,i."}, + {"id":"P17","decision":"PASS","evidence":"L158-166 retains every Base coordinate in Executable and Covered_sound."}, + {"id":"P18","decision":"FAIL","evidence":"L139-143 relies on an uncited complementary not cfg rule to select the non-turbo body, so the !f region admitted to Covered_sound lacks a complete authority-closed derivation."}, + {"id":"P19","decision":"FAIL","evidence":"L168-175 states the set inclusion, but its mapping of Required !f cases to a proved source branch inherits the missing exact-version not authority."}, + {"id":"P20","decision":"FAIL","evidence":"L11-14 claims whole-domain soundness PROVED, but L168-175 does not provide a valid authority-closed Required-to-Covered certificate."}, + {"id":"P21","decision":"PASS","evidence":"L158-166 retains every Base coordinate in Covered_post."}, + {"id":"P22","decision":"FAIL","evidence":"L139-143 leaves the non-turbo selection dependent on an uncited not cfg semantic premise, so Covered_post overclaims that region."}, + {"id":"P23","decision":"FAIL","evidence":"L168-175 states behavioral containment, but the !f mapping is not to a completely authority-closed branch proof."}, + {"id":"P24","decision":"FAIL","evidence":"L15-16 claims whole-domain behavior without conspicuous TCB relativity, and L168-175 also inherits the invalid behavioral coverage certificate."}, + {"id":"P25","decision":"PASS","evidence":"L180-185 restricts BUILD-MAP-POLICY to exact bundled Cargo identities, supplied artifact, mappings, and listed consumers."}, + {"id":"P26","decision":"FAIL","evidence":"L15-16 states the behavior verdict only on the same domain, not under the BUILD-MAP-POLICY qualification carried by soundness; later closure is likewise unqualified."}, + {"id":"P27","decision":"FAIL","evidence":"L99-112 and L139-140 use material all and not cfg semantics in positive proofs without exact-version quotations or applicable predicate-section URLs."} + ], + "hard_errors": [ + {"id":"PH4","evidence":"L11-16 and L173-175 claim whole-domain soundness/behavior although the Covered derivations rely on the unverified not cfg premise at L139-140."}, + {"id":"PH5","evidence":"L17-19 and L99-112 affirm universal turbo/wasm rejection without an applicable exact-version all implication."}, + {"id":"G11","evidence":"The positive rejection and non-turbo selection proofs at L99-112 and L139-140 necessarily rely on unchecked all/not Rust authority."} + ], + "proposal_laundering": {"present":false,"evidence":"L195-204 labels the comment replacement proof-artifact documentation and does not use it to certify current code."}, + "tcb_authority_defect": {"present":true,"evidence":"L99-112 and L139-140 omit exact-version all/not authority, and L15-16 omits conspicuous TCB qualification from behavior."}, + "visible_scope_defect": {"present":false,"evidence":"L5-9 confines inspection to supplied target files and explicitly says nothing was built, run, or tested."}, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/Q/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/Q/s1.json new file mode 100644 index 0000000000..70c98a5b44 --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/Q/s1.json @@ -0,0 +1,448 @@ +{ + "schema_version": 1, + "mode": "Q", + "scorer_id": "s1", + "reports": [ + { + "label": "C", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table gives safe force_unreachable calls no caller precondition, limits delegated_nonzero valid uses to value != 0, and says the APIs are separate claims." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's numbered certificate states valid public-safe invocation, unconditional reachability, falsity of the not-reached requirement, and the checked Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports F UNSOUND and explicitly calls the witness an existential refutation, not merely a failed universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the unchanged nonzero argument meets the peer precondition, notes the body and accepted UNSAFE-DEP entry are absent, and states the exact quantified provider-UB-freedom premise missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports D UNPROVED, rejects an invented UB witness, and requires recursive audit or an authorized exact UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Proposed repairs are expressly future changed artifacts requiring fresh audit and are not used for either current verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It consumes only the accepted exact Rust 1.80.0 URL proposition and conspicuously refuses unavailable dependency implementation trust." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report describes only supplied packet files and the permitted exact Rust URL; it disclaims binaries, dependency source, generated artifacts, and tools." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Its verdict table independently defines C1 as every safe invocation and C2 as unsafe invocations with value in 1..=255 satisfying value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1's proof gives a valid safe call, straight-line execution of unreachable_unchecked, the false unreachability proposition, and the applicable Rust 1.80.0 UB rule." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It concludes C1 UNSOUND across D and says the completed existential refutation is stronger than failure of a universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It derives the peer precondition from the wrapper contract and unchanged value, distinguishes the pin and documentation from implementation correctness, and quantifies the smallest missing UB-freedom proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It returns UNPROVED for C2, says no dependency UB witness is supplied, and identifies exact implementation audit or precise TCB acceptance as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Its repair suggestions are not treated as implemented evidence and it calls for a new audit after repair." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report uses the version-matched accepted std authority for C1 and expressly declines any peer implementation premise for C2." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It identifies only supplied artifacts and the allowed versioned Rust page and expressly says unavailable external artifacts were not inspected." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The Full valid-use domains section separately covers every well-typed safe force call and only delegated calls whose unsafe caller satisfies value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Its four-step F certificate explicitly connects valid safe use, necessary line-6 reachability, falsity of site-unreachability, and AXIOM-UU's Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports force_unreachable UNSOUND and says the four links close the required witness chain." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-CALL is proved from the identical nonzero contracts and unchanged value; D-SOUND remains the explicitly quantified missing exact-provider premise despite the version pin." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, rejects UNSOUND without a dependency execution, and requires exact recursive audit or accepted UNSAFE-DEP trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "No unimplemented proposal supports a current conclusion; suggested changes are coupled to re-audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is tied to the exact allowed Rust 1.80.0 page and the unavailable peer implementation is explicitly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Hashes concern supplied files, and the report limits external inspection to the permitted Rust citation while disclaiming source, builds, binaries, and tools." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claims table gives the safe API every well-typed invocation with no precondition and the unsafe API exactly nonzero u8 calls, then says the claims are separate." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "OBL-FORCE explicitly supplies valid safe invocation, immediate reachability, false unreachability, and the verified Rust 1.80.0 rule that reaching the function is UB." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It labels force_unreachable UNSOUND and describes the derivation as a complete existential certificate in every actual configuration." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the dependency call's nonzero precondition locally but leaves exact 3.4.5 provider correctness missing because no implementation, audit, or accepted trust exists." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED rather than fabricating behavior, and names exact implementation/generated-artifact audit or equally scoped accepted UNSAFE-DEP as the needed evidence." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Potential redesigns are presented only as future resolution and the report requires fresh audit of any changed artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its TCB log confines the std premise to the checked exact versioned URL and marks peer provider trust expressly not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It says no build, execution, expansion, dependency implementation, prior audit, or binary was inspected and uses only packet evidence plus the allowed URL." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdicts separately quantify every well-typed safe force call with no precondition and every unsafe delegated call with value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "CLAIM-FU's certificate enumerates valid use, unconditional reachability, the false not-reached proposition, and AXIOM-UR-180's applicable UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives CLAIM-FU the verdict UNSOUND and explicitly states that the valid safe use reaches the authoritative UB event." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "OBL-DN-LOCAL proves the unchanged nonzero argument; OBL-DN-IMPL states the exact quantified provider premise and explains why neither the declaration, pin, nor rejected trust supplies it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports CLAIM-DN UNPROVED, says the absent body cannot yield a UB execution, and requires exact recursive audit, local replacement, or precise accepted trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Repairs are prospective and are never certified as the supplied current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It uses the independently checked Rust 1.80.0 Safety section only for force and explicitly rejects relying on the unavailable peer body." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines the snapshot to supplied files and the permitted citation and says no lockfile, dependency source, prior audit, binary, or tool result is available or reused." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Its claims table gives C1 every safe call without a caller obligation and C2 only calls with value != 0, and the text calls them separate verdicts." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1/O1 supplies valid safe invocation, unconditional execution, falsity of the required unreachability, and the exact Rust 1.80.0 documentation's UB classification." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports C1 UNSOUND, explicitly not merely unproved, on the complete certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "C2/O2 proves the identical nonzero precondition, while O3 precisely quantifies missing 3.4.5 implementation UB-freedom and rejects pinning as provider proof." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports C2 UNPROVED, notes no dependency UB execution exists, and calls for exact recursive audit or an authorized precise UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "It does not rely on its suggested remediation; any implementation change is said to require audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact versioned Rust authority is applied only to O1, and unsafe-dependency trust is marked not proposed or accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "All named evidence is supplied packet material or the allowed exact URL, with unavailable implementation and tool evidence expressly excluded." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Claim F covers every safe invocation without a precondition, Claim D covers every nonzero valid unsafe invocation, and each is independently quantified over D." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "F-OBL-1 lists the public-safe witness, necessary execution, the false not-reached requirement, and AXIOM-UU's applicable Rust UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It declares force_unreachable UNSOUND and says the four-link certificate covers every configuration member." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-OBL-1 derives the peer precondition from valid use; D-OBL-2 identifies exact-provider UB-freedom as missing because body/audit/trust is absent and the pin proves no semantics." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, explicitly denies an existential counterexample, and requires implementation audit or exact human TCB acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested future resolution is not used as proof of the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is the verified exact Rust 1.80.0 proposition, while UNSAFE-DEP-345 is conspicuously rejected and not consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines itself to the supplied source/evidence and permitted citation and says no dependency internals, builds, binaries, or tools were used." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Required_F includes every well-typed safe call with no precondition; Required_D separately includes exactly unsafe calls with nonzero u8 values." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's numbered certificate explicitly gives valid use, unconditional line-6 reachability, falsity of unreachability, and AXIOM-UU-180's UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports force_unreachable UNSOUND and states each required configuration has the witness." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The local derivation proves the peer's nonzero precondition; DEP-SOUND exactly states provider UB-freedom and remains missing because body/generated output and accepted trust are absent." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, refuses UNSOUND without a valid execution, and identifies recursive exact-implementation audit or precise accepted UNSAFE-DEP as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "No suggested implementation or trust proposal is certified as already present." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact accepted Rust proposition is used within its version/domain, and the unavailable peer implementation proposition is expressly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports only the supplied snapshot and allowed Rust URL and expressly disclaims prior audits, dependency implementation, expansions, binaries, and tools." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "R_force covers well-typed safe calls without a precondition, while R_delegate independently covers only nonzero u8 calls satisfying the unsafe API contract." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "The force verdict row gives the valid safe expression, unconditional execution, false site-unreachability proposition, and AXIOM-UU-180's UB implication." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It assigns force_unreachable UNSOUND for every configuration on that complete certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The delegate row proves unchanged nonzero dataflow, then states the smallest missing universal UB-freedom premise for exact peer 3.4.5 and notes no accepted entry or body supplies it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, says absence of universal proof is no UB witness, and requires exact recursive audit or explicit precise UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Future remediation is not used to narrow or certify the current source obligation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report verifies and scopes the exact Rust 1.80.0 axiom and treats proposed dependency trust as rejected and non-consumable." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It identifies only supplied artifacts and the allowed citation and says no generated body, prior audit, test, build, or tool result was used." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The surface table and claims table independently define all safe force calls as valid and delegated calls as valid exactly when value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C-F's four numbered links state valid safe invocation, unconditional call-site reachability, falsity of the not-reached condition, and the exact Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives C-F UNSOUND and explicitly distinguishes this completed witness from mere failure to prove." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "C-D proves the identical nonzero caller obligation and unchanged forwarding, then precisely quantifies the missing exact-provider UB-freedom premise and explains why no packet fact entails it." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports C-D UNPROVED, rejects UNSOUND without an executable counterexample, and requires recursive exact implementation audit or exact human UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Replacement and trust options are presented as future resolutions, not evidence for the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is version-matched, citation-checked, and applied only to force; missing dependency trust is explicitly rejected." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines review to submitted files and the allowed exact Rust authority and says no build, execution, expansion, dependency implementation, binary, or prior audit was inspected." + }, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/Q/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/Q/s2.json new file mode 100644 index 0000000000..d2344c1f9e --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/Q/s2.json @@ -0,0 +1,448 @@ +{ + "schema_version": 1, + "mode": "Q", + "scorer_id": "s2", + "reports": [ + { + "label": "I", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table separates safe force_unreachable calls with no precondition from delegated_nonzero calls restricted to nonzero values." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "CLAIM-FU gives valid safe use, unconditional sole-path reachability, falsity of the not-reached requirement, and Rust 1.80.0 UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports CLAIM-FU UNSOUND and calls the chain a completed existential certificate." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves the forwarded nonzero precondition but identifies the absent implementation and rejected UNSAFE-DEP premise as the exact provider-correctness gap." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports CLAIM-DN UNPROVED, rejects inventing a UB witness, and requires recursive audit or an accepted exact UNSAFE-DEP entry." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Remediation is explicitly presented as a changed snapshot requiring fresh audit, not evidence about the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report consumes only the exact Rust 1.80.0 unreachable_unchecked proposition and expressly rejects dependency implementation trust." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states that no dependency body, prior audit, binary, or tool result was used and evidences only supplied artifacts and the allowed URL." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "R_force has every well-typed safe call with no precondition, while R_delegate independently restricts valid calls to v in 1..=255." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "The force verdict gives a valid safe witness, unconditional execution, the false unreachable proposition, and AXIOM-UU-180's UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It gives force_unreachable the strongest verdict UNSOUND for every configuration." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "O2 proves unchanged nonzero dataflow; O3 states the exact unavailable 3.4.5 implementation's universal UB-freedom as the missing proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, says absence supplies no UB witness, and names recursive audit or precise UNSAFE-DEP acceptance as resolution." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested source changes and trust acceptance are future resolutions, not support for a current positive verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU-180 is exact and version-matched; the proposed dependency entry is explicitly rejected and not consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report disclaims use of dependency source, prior audits, tools, and generated artifacts and shows no prohibited evaluator access." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Claim F covers all safe invocations without a caller precondition; Claim D separately covers only nonzero-valid unsafe invocations." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F enumerates valid safe use, necessary execution, falsity of unreachability, and the applicable Rust 1.80.0 UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The report concludes Claim F is UNSOUND over the full symbolic domain." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-OBL-1 discharges nonzero locally, while D-OBL-2 identifies universal valid-call UB-freedom of the absent exact implementation as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED, not UNSOUND; the report requires exact recursive implementation audit or acceptance of the precisely scoped dependency premise." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report treats audit or trust acceptance only as future resolution and does not certify either unimplemented option." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "It uses the checked versioned Rust proposition for Claim F and labels the exact dependency premise rejected and not admitted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports reviewing supplied files only and explicitly says no dependency body, prior audit, binary, or tool result was used." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Required_F includes every well-typed safe invocation without a precondition; Required_D separately includes nonzero values satisfying the unsafe contract." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Its numbered certificate explicitly supplies valid use, body reachability, the false not-reached requirement, and AXIOM-UU-180's UB classification." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "Claim F receives the explicit verdict UNSOUND over all Required_F." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "The local derivation proves the identical nonzero precondition, then states DEP-SOUND for every valid exact-implementation execution as the missing premise." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED; no falsifying execution is invented, and exact implementation audit or accepted precise UNSAFE-DEP trust is required." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Proposed remediation is not used to narrow or certify the supplied implementation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Only the exact accepted Rust authority is consumed; dependency documentation is expressly not treated as provider-correctness evidence." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report says no dependency implementation, prior audit, expansion, binary, or tool result was reused and reveals no prohibited source access." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The verdict table independently defines C1 as all well-typed safe calls and C2 as unsafe calls with value in 1..=255." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1 supplies the valid direct safe call, unconditional control flow, false unreachability requirement, and applicable Rust 1.80.0 UB statement." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It concludes C1 is UNSOUND and explicitly distinguishes this from failure of a universal proof." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves unchanged nonzero forwarding but says the absent body and declined UNSAFE-DEP entry leave exact valid-call provider UB-freedom missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C2 is UNPROVED, with no fabricated UB witness, and resolution is recursive audit or explicit acceptance of the exact dependency proposition." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Repair and trust options are identified as requiring a new audit or explicit acceptance, not as current proof." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact versioned Rust proposition is used in its accepted region, while implementation trust is expressly absent." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It says no dependency implementation, generated output, binary, prior audit, or tool-derived result was supplied or inspected." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "Domains F and D separately quantify all safe force calls and only nonzero-valid delegated calls." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F's four numbered steps establish a valid call, unconditional execution, false site-unreachable proposition, and authoritative UB consequence." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The report gives force_unreachable the explicit verdict UNSOUND." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "D-CALL proves nonzero forwarding, while D-SOUND is the exact implementation's universal UB-free behavior and remains unsupported." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "The delegated claim is UNPROVED; absence yields no execution or UB consequence, and recursive audit or accepted dependency trust is required." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Future repair and trust paths are not used as evidence for either current verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is exact, version-matched, and scoped to F-UB; PEER-IMPL is expressly unaccepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Hashing and naming supplied artifacts are in scope, and the report disclaims dependency source, prior audit, generated output, and tool evidence." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "C1 covers every well-typed safe call without a precondition; C2 separately covers calls satisfying value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C1 explicitly identifies valid invocation, necessary call-site execution, falsity of the operation's requirement, and the exact Rust UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports C1 UNSOUND rather than merely unproved." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "O2 proves the identical nonzero precondition; O3 gives universal UB-freedom of exact version 3.4.5 as the smallest absent provider proposition." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C2 is UNPROVED, no dependency UB execution is asserted, and the stated resolutions are exact recursive audit or authorized UNSAFE-DEP acceptance." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Suggested API changes and dependency evidence are prospective and do not certify the current artifact." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The accepted Rust entry has exact version, proposition, domain, and consumer; proposed dependency trust is not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report uses supplied artifact hashes and the allowed citation while disclaiming tools, dependency source, binaries, and prior audits." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claim table states all well-typed safe force invocations and, independently, all nonzero-valid delegated invocations." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "OBL-FORCE proves the valid safe witness reaches the operation, falsifies unreachability, and triggers the checked Rust 1.80.0 UB rule." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "The force claim is explicitly UNSOUND in every nonempty required configuration fiber." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "OBL-DELEGATE-CALL proves the nonzero precondition, while OBL-DELEGATE-IMPL states exact universal provider UB-freedom as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "It reports delegated_nonzero UNPROVED, rejects a fabricated existential witness, and requires exact audit or accepted equally scoped trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Potential implementation or boundary changes are explicitly new artifacts needing fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact Rust 1.80.0 proposition is the only consumed authority and the dependency proposition is expressly not accepted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report states no source was executed, built, expanded, or edited and no dependency implementation or prior audit was supplied." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "API-F permits every well-typed safe call; API-D independently requires value != 0 with no ongoing or terminal obligation." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "C-F's four steps give valid safe use, sole-path reachability, the false not-reached requirement, and exact Rust 1.80.0 UB authority." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "C-F is reported UNSOUND, explicitly not merely a failure to prove." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It proves unchanged nonzero forwarding and states exact-version valid-call UB-freedom as the smallest proposition absent from source and TCB." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "C-D is UNPROVED; the report declines an executable counterexample and requires recursive audit or exact human-accepted UNSAFE-DEP trust." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Replacement and trust options are framed only as minimal future resolutions." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AXIOM-UU is exact and citation-checked for its consumer; UNSAFE-DEP-345 is rejected and not admitted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines review to submitted source and evidence and says no build, execution, dependency implementation, binary, or prior audit was inspected." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "Q1", + "decision": "PASS", + "evidence": "The claim table separately states all safe force calls with no precondition and delegated calls limited to value != 0." + }, + { + "id": "Q2", + "decision": "PASS", + "evidence": "Claim F lists a valid safe invocation, immediate operation reachability, falsity of the exact safety proposition, and AXIOM-UU-180's UB result." + }, + { + "id": "Q3", + "decision": "PASS", + "evidence": "It reports Claim F UNSOUND and identifies the derivation as an existential refutation." + }, + { + "id": "Q4", + "decision": "PASS", + "evidence": "It closes the identical nonzero caller obligation but identifies exact selected-implementation UB-freedom for every valid call as missing." + }, + { + "id": "Q5", + "decision": "PASS", + "evidence": "Claim D is UNPROVED, no implementation behavior is fabricated, and exact recursive audit or accepted precise UNSAFE-DEP trust is prescribed." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report does not consume any proposed repair as evidence for the supplied source." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The allowed Rust 1.80.0 authority is used only for Claim F, and the absent dependency premise is not trusted." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It limits itself to supplied files and the allowed Rust page and disclaims binaries, generated artifacts, tools, and dependency implementation access." + }, + "novel_findings": [] + } + ], + "ambiguities": [] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/R/s1.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/R/s1.json new file mode 100644 index 0000000000..16f75bde5c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/R/s1.json @@ -0,0 +1,596 @@ +{ + "schema_version": 1, + "mode": "R", + "scorer_id": "s1", + "reports": [ + { + "label": "B", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs downstream `Bad`, a safe `Slot` impl returning 2, and a safe generic call, with exact visibility, coherence, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Tracks 2 into `get_unchecked_mut(2)`, proves it out of bounds for length 2, and cites Rust 1.82 UB even when unused." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Explicitly reports the current safe API `UNSOUND` and keeps the regional Tail proof and redesign independent." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the fixed Tail behavior as wrapping increment of element 1 and states that downstream generic capability is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a nongeneric safe `increment` using `pair[1]` and `wrapping_add`, with no caller-selected implementation or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains removal of `Slot`, `Tail`, and generic calls, the source-breaking migration, and the request's authorization for this unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Calls the redesign a proposal with no artifact verdict and requires implementation followed by a fresh snapshot audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly excluded from the current verdict and is left unaudited pending implementation." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Every material Rust premise is tied to an applicable exact Rust 1.82 Reference or standard-library URL." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report evidences only the supplied target and exact allowlisted Rust documentation." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Bad` witness and safe call are explicit, but the material Rust 1.82 safe-versus-unsafe-function rule is asserted without checked authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, bounds falsity, and UB text are stated, but R2's R1 valid-safe-use dependency remains unestablished." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It says `UNSOUND`, but that verdict depends on the incomplete R2 existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Identifies the exact Tail-only wrapping update and expressly notes that generic downstream use need not survive." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a nongeneric safe inherent operation selecting fixed element 1 with checked indexing and no implementer/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Details deletion of the trait/generic API, call-site migration, intentional downstream breakage, and the unreleased-change authorization." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "The sketch is correctly conditional and requires fresh audit, but R7's R3 dependency is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The `UNSOUND` conclusion lacks an authority-complete valid-safe-use link for the ordinary function call." + }, + { + "id": "G11", + "evidence": "The proof necessarily relies on unchecked Rust safe-function caller semantics while claiming only cited version-matched axioms." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented sketch is expressly denied a verdict and does not narrow the stated current-artifact claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "The TCB omits checked Rust 1.82 authority for the ordinary-versus-unsafe-function premise consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report shows no inspection beyond the supplied source and allowlisted documentation." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Gives a downstream `Bad` returning 2 and safe call, supported by exact 1.82 visibility, implementation, unsafe-trait, and unsafe-function rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Shows the call necessarily reaches index 2 on length 2, falsifies bounds, and applies the exact Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Reports current-artifact `UNSOUND` and explicitly excludes the redesign from that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "States the sole required operation is Tail's wrapping update of element 1 and that generic implementations need not remain." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Supplies a nongeneric safe function with fixed checked index 1 and removes all caller-controlled implementation/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains the authorized deletion and migration of the unreleased trait, marker, and generic calls, including downstream compile breakage." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Assigns no verdict to the unimplemented proposal and requires a fresh audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is expressly separated from current-artifact results and left uncertified." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The exact applicable Rust 1.82 authorities and their consumed propositions are identified." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No report evidence indicates access outside the supplied target and allowlisted sources." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Oob` witness is explicit, but caller safety for the ordinary `increment` function is asserted without the required checked Rust 1.82 function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The mechanical out-of-bounds/UB chain is complete, but its R1 valid-safe-use dependency is authority-incomplete." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The literal `UNSOUND` verdict rests on the incomplete dependent existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the fixed wrapping Tail operation and rejects any need to retain downstream genericity." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a specialized safe function using constant checked index 1 without a trait or caller-selected index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Clearly states the authorized unreleased contract deletion and exact migration away from downstream impls and generic calls." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It conditionally requires fresh audit, but the listed R3 prerequisite is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "Its `UNSOUND` certificate does not authoritatively establish that the ordinary generic call is a valid safe use." + }, + { + "id": "G11", + "evidence": "The TCB necessarily consumes an unchecked safe-versus-unsafe-function proposition absent from its authority inventory." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is labeled unimplemented, receives no verdict, and does not narrow the current claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`AX-ACCESS` is used to infer no caller-side unsafe obligation, but its cited visibility/implementation pages do not verify the required function rule." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Nothing in the report evidences prohibited external or evaluator-material inspection." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "It constructs the exact safe witness and verifies visibility/coherence/unsafe-trait rules, but not the material Rust 1.82 safe-function caller rule." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, false bounds, and applicable UB are shown, but R2 depends on the authority-incomplete R1 valid-use proof." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The report says `UNSOUND`, yet its required R2 certificate remains incomplete." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Precisely identifies Tail's wrapping element-1 update as the required behavior and disclaims required generic polymorphism." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Recommends the exact nongeneric safe fixed-index function with no caller-controlled implementer or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Describes deletion and call migration, intentional loss of downstream generic use, and authorization from unreleased status." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "The proposal is correctly conditional with fresh-audit instructions, but R7's R3 dependency is unsatisfied." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The affirmative `UNSOUND` result lacks a checked-authority basis for one material valid-safe-use link." + }, + { + "id": "G11", + "evidence": "The report necessarily relies on uncited Rust semantics to conclude the ordinary function call carries no safety obligation." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "It expressly calls the redesign a proposal, not a new-artifact verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`TCB-R182` omits checked Rust 1.82 safe-versus-unsafe-function authority consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The text shows review of only the supplied target and allowed versioned documentation." + }, + "novel_findings": [] + }, + { + "label": "H", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs `OutOfBounds` returning 2 with a safe call and verifies all four required Rust 1.82 visibility and safety-boundary rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Proves execution at index 2 on length 2, the false `2 < 2` proposition, and the exact documented UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Reports current `UNSOUND` independently of both the Tail regional result and redesign." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "States the exact owned Tail wrapping behavior and that only this non-generic capability is required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Uses one nongeneric safe checked-index function and removes every caller-selected implementation/index surface." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains the authorized breaking deletion of `Slot`/`Tail` and migration from generic calls, with no downstream preservation promise." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Says the design is unimplemented and unaudited, then specifies a fresh post-implementation audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "Current results are fixed before the explicitly unimplemented redesign." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The report cites exact versioned authorities for visibility, impl legality, unsafe traits/functions, bounds UB, and wrapping." + }, + "visible_scope_defect": { + "present": false, + "evidence": "Naming the supplied unsafe-Rust package is expressly in scope; no prohibited inspection is evidenced." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Provides `Bad`, return value 2, and the safe generic call, with exact Rust 1.82 visibility, impl, unsafe-trait, and unsafe-function support." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Shows the executed call receives out-of-bounds 2 for length 2 and applies the exact versioned UB contract." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Declares the current artifact `UNSOUND` and keeps the Tail result and redesign separate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Extracts the Tail-only modular element-1 update and explicitly treats generic downstream capability as removable." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes a single nongeneric safe fixed-index function without trait, generic parameter, unsafe block, or caller index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "States the exact breaking migration and that removal is authorized because generic users need not be preserved and the API is unreleased." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Explicitly denies the proposal an artifact verdict and requires a fresh audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented redesign is kept wholly separate from the current-artifact verdict." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "All material language and library premises are matched to exact applicable Rust 1.82 authorities." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No text evidences inspection outside the supplied source and allowed authority." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "Constructs `Outside` returning 2 and a safe call, backed by exact 1.82 visibility, impl, unsafe-trait, and unsafe-function rules." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "Establishes reachability of index 2, out-of-bounds falsity for length 2, and the applicable Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "Returns the literal current-artifact `UNSOUND` verdict independently of the design proposal." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Defines the minimum as the owned Tail wrapping increment of element 1, with no need for generic implementations or calls." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The safe nongeneric `Tail::increment` uses checked constant indexing and exposes no caller-controlled implementation/index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains deletion of the generic trait/function, exact call migration, authorized downstream breakage, and unreleased status." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Labels the design unimplemented with no verdict and demands audit of the exact implemented snapshot." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The current verdict precedes and is declared independent of the explicitly unaudited proposal." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its exact versioned authority inventory covers every material current-artifact premise." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report itself shows no prohibited source or evaluator-material access." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "Although it gives `Bad` returning 2 and the call, it does not verify the required Rust 1.82 ordinary/unsafe trait and function safety-boundary rules." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The out-of-bounds reachability and UB consequence are established, but R2's R1 valid-safe-use dependency is not." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The `UNSOUND` verdict depends on the incomplete existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Accurately isolates the fixed Tail wrapping update and states that downstream generic use is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Replaces the generic unsafe path with a safe nongeneric fixed-index function and no caller-controlled capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Details the intentionally breaking migration and correctly ties authorization to the unreleased, non-preserved generic API." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It conditions the redesign on implementation and fresh audit, but the R3 dependency remains unmet." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The report issues `UNSOUND` without an authority-complete proof that both the impl and ordinary function call are valid safe use." + }, + { + "id": "G11", + "evidence": "Its proof necessarily relies on unchecked Rust trait/function safety-boundary semantics omitted from `TCB-R033`." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly not a verdict and is not used to alter the current claim." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "The TCB lists visibility/coherence and library contracts but omits checked unsafe-trait and unsafe-function rules consumed by witness validity." + }, + "visible_scope_defect": { + "present": false, + "evidence": "No prohibited oracle, sibling, condition, prior-report, or evaluator access is evidenced." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The `Bad` implementation and call are explicit and trait authority is checked, but the safe-versus-unsafe-function premise for the call is not verified." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It proves mechanical reachability, false bounds, and UB, but depends on R1's unsupported safe-call validity premise." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The stated `UNSOUND` verdict lacks a complete R2 certificate under the frozen authority rule." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "Identifies only the wrapping update of fixed element 1 as required and treats generic downstream surfaces as removable." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Proposes the exact nongeneric safe checked-index operation with no caller-selected implementation or index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Explains disappearance of trait/generic users, the concrete migration, and authorization from the unreleased contract." + }, + { + "id": "R7", + "decision": "FAIL", + "evidence": "It leaves the sketch unimplemented and requires fresh audit, but R7's prerequisite R3 is not established." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "The `UNSOUND` result lacks checked support for the valid-safe-call link in its existential certificate." + }, + { + "id": "G11", + "evidence": "The TCB necessarily relies on an unchecked ordinary-function caller-safety proposition." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is expressly unimplemented, unaudited, and independent of the current verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "`TCB-R016-r1` omits the Rust 1.82 safe-function authority needed to establish that calling `increment` accepts no safety obligation." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report evidences no access outside the supplied scope and exact allowed documentation." + }, + "novel_findings": [] + } + ], + "ambiguities": [ + "R1 explicitly depends on the Rust 1.82 safe-versus-unsafe-function rules, but the rubric does not expressly say whether merely calling a syntactically ordinary `fn` safe verifies that rule. Under SCORER.md's material-premise rule, I treated an uncited assertion as insufficient.", + "The atom dependency fields do not explicitly state whether failure propagates mechanically. I treated each listed dependency as a material prerequisite, so an authority-invalid R1 also fails dependent R2, R3, and R7." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/R/s2.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/R/s2.json new file mode 100644 index 0000000000..4f062c910c --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/scoring/raw/R/s2.json @@ -0,0 +1,595 @@ +{ + "schema_version": 1, + "mode": "R", + "scorer_id": "s2", + "reports": [ + { + "label": "H", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F1 constructs downstream OutOfBounds, a safe Slot impl returning 2, and increment::; it verifies visibility, coherence, unsafe-trait, and unsafe-function rules at Rust 1.82 URLs." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F1 traces the call to get_unchecked_mut(2) on length 2, states 2 < 2 is false, and cites the Rust 1.82 out-of-bounds-call UB rule." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It labels SOUND-CURRENT as UNSOUND over D and explicitly says no proposal below affects that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the required Tail behavior as element-1 wrapping increment and says downstream generic use is not required." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The recommended pub fn increment directly uses pair[1].wrapping_add(1), with no generic parameter, implementer capability, or unsafe block." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Migration deletes Slot and Tail, changes increment:: to increment, and explains that the unreleased API permits downstream generic uses to stop compiling." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the design is not implemented and has no audit verdict, then requires a fresh audit of the exact implemented snapshot." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is expressly unimplemented, is not used in the current UNSOUND verdict, and is conditioned on fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The material Rust premises are tied to applicable, versioned Rust 1.82 Reference and standard-library URLs; no extra TCB assumption is consumed." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines its snapshot to the supplied source/package basis and contains no evidence of prohibited evaluation-material access." + }, + "novel_findings": [] + }, + { + "label": "I", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F1 gives Bad, a downstream-local safe Slot impl returning 2, and a safe increment:: call, with versioned visibility, coherence, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F1 proves execution of get_unchecked_mut(2), that element 2 is out of bounds for length 2, and the cited Rust 1.82 UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "The current-artifact verdict is UNSOUND and is explicitly declared independent of the redesign." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It isolates the crate-owned Tail result [a, b.wrapping_add(1)] and states that the authorized requirement is narrower than generic downstream behavior." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Its preferred nongeneric safe function writes pair[1] with wrapping_add and removes the trait, marker, caller index selection, and unsafe operation." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains deletion of Slot and Tail, the call-site migration, and that breaking downstream implementations/generic calls is authorized for this unreleased abstraction." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the proposal is not implemented and has no artifact verdict, preserves the current verdict, and specifies a fresh post-implementation audit." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is expressly separated from the current UNSOUND result and left unaudited pending implementation and fresh review." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "Its witness and Tail proof cite the applicable versioned Rust 1.82 visibility, implementation, unsafe-boundary, slice, and wrapping authorities." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It limits the snapshot to target/lib.rs and disclaims prior results and execution; no prohibited evaluator or sibling material is evidenced." + }, + "novel_findings": [] + }, + { + "label": "E", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "W1 supplies downstream Outside, a safe Slot impl returning 2, and increment::, backed by Rust 1.82 visibility, orphan, unsafe-trait, and unsafe-function authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "W1 shows the safe call reaches line 16 with index 2, establishes it is out of bounds for length 2, and cites the exact Rust 1.82 UB rule." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "The table reports the current public API UNSOUND and the prose says this verdict is independent of the proposal." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "The redesign section identifies the minimum capability as the fixed Tail operation: wrapping element 1 while leaving element 0 unchanged, without caller-selected indexing." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Tail::increment is nongeneric and safe, uses checked pair[1] indexing, and exposes no caller implementation or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It specifies deletion of Slot and generic increment, the Tail::increment call migration, and the expressly authorized downstream source break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "Fresh-audit status calls the redesign unimplemented, assigns it no verdict, and lists the exact obligations to audit after implementation." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report does not certify the sketch and keeps it separate from the current-artifact UNSOUND result." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "All material language and library premises are linked to applicable Rust 1.82 pages, including the unsafe-function boundary." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states that only the supplied 18-line target was audited and shows no inspection of prohibited evaluation material." + }, + "novel_findings": [] + }, + { + "label": "C", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F-UB constructs Bad returning 2 and the safe generic call, with exact Rust 1.82 visibility, orphan, unsafe-trait, and unsafe-function/unsafe-block authority." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F-UB traces index 2 into get_unchecked_mut on the length-two array, states the bounds proposition is false, and links AX-GET's explicit UB consequence." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It reports every required safe use as refuted by an UNSOUND witness and states the redesign does not participate in that verdict." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It extracts the sole required operation as Tail's element-1 modular increment and rejects caller-controlled generic indexing as unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The preferred design is a nongeneric safe increment using pair[1].wrapping_add(1), with no implementer or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "Migration deletes Slot, Tail, and genericity, explains the call rewrite, and invokes the request's authorization for the unreleased source break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It assigns no verdict to the unimplemented proposal and requires a fresh audit of exports, indexing, postconditions, and configuration coverage." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The report explicitly excludes the redesign from current-artifact verdicts and requires implementation plus fresh audit." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "AX-VIS, AX-IMPL, AX-BOUNDARY, AX-GET, and AX-WRAP are all tied to applicable versioned Rust 1.82 authority." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report describes only the supplied lib.rs and allowed Rust authorities and evidences no prohibited source access." + }, + "novel_findings": [] + }, + { + "label": "A", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "The OutOfBounds witness and visibility/orphan/unsafe-trait citations are present, but the claim that calling ordinary increment is safe lacks the explicitly required Rust 1.82 safe-versus-unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It correctly states reachability, 2 < 2 falsity, and AX-GET UB, but R2 depends on R1 and the witness's safe-call validity is not fully verified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It says the current API is UNSOUND and proposal-independent, but R3 depends on the incomplete R2 existential certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It states that only the crate-owned Tail behavior is required: element 1 gets wrapping addition and generic downstream use need not remain." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The proposed safe nongeneric increment fixes index 1 and removes Slot, implementations, genericity, and unsafe code." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains the increment:: to increment migration and says downstream generic uses intentionally disappear under the authorized unreleased-API change." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "The design is expressly not a new verdict, does not alter current UNSOUND, and is conditioned on an exact-snapshot fresh audit." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND while the valid-safe-use link is incomplete: ordinary-function call safety is asserted without the required version-matched Rust authority." + }, + { + "id": "G11", + "evidence": "Its certificate necessarily relies on an unchecked safe-versus-unsafe-function premise omitted from the cited Rust 1.82 authority set." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is labeled a design rather than an artifact verdict and fresh audit is required." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-R182 claims the semantic premises are the cited authorities, but no Rust 1.82 unsafe-function authority supports the material assertion that increment's call carries no unsafe obligation." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report confines itself to the supplied target and permitted Rust documentation; no prohibited evaluator, sibling, or prior-report access is visible." + }, + "novel_findings": [] + }, + { + "label": "B", + "atoms": [ + { + "id": "R1", + "decision": "PASS", + "evidence": "F-1 constructs downstream Bad returning 2 and a safe increment:: call, with versioned visibility, orphan, unsafe-trait, and unsafe-function rules in AX-PUBLIC/IMPL and AX-SAFE-BOUNDARY." + }, + { + "id": "R2", + "decision": "PASS", + "evidence": "F-1 proves get_unchecked_mut(2) is reached on length 2, that index 2 is invalid, and that AX-GET makes the call itself UB." + }, + { + "id": "R3", + "decision": "PASS", + "evidence": "It reports both safe-API and combined current-artifact results as UNSOUND and keeps the redesign independent." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the only required capability as Tail's wrapping element-1 update and says no generic downstream capability must survive." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The preferred safe function is nongeneric, fixes pair[1], and removes the trait, marker type, unsafe operation, and caller-controlled index." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It details removal of Slot/Tail and the call rewrite, explaining that the request authorizes this unreleased contract and representation break." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It states the proposal has no artifact verdict and requires a new-snapshot audit without changing the current UNSOUND conclusion." + } + ], + "hard_errors": [], + "proposal_laundering": { + "present": false, + "evidence": "The unimplemented redesign is not certified or used to narrow the current obligation, and a fresh audit is required." + }, + "tcb_authority_defect": { + "present": false, + "evidence": "The authority set includes applicable Rust 1.82 visibility, coherence, unsafe-trait/function, slice-UB, and wrapping-add rules." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It states the artifact is exactly the supplied lib.rs and contains no evidence of prohibited material inspection." + }, + "novel_findings": [] + }, + { + "label": "G", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "FIND-1 gives Oob returning 2 and a purported safe call, but the authority inventory never verifies Rust 1.82's safe-versus-unsafe-function rule for calling increment without unsafe." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "Reachability, equality with len, and AX-GET UB are stated, but R2 depends on R1 and the valid-safe-use premise remains unverified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It reports current UNSOUND independently of the proposal, but R3 depends on the incomplete R2 certificate." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the fixed Tail wrapping update as the stated requirement and says genericity is unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "increment_tail is a safe nongeneric function using pair[1], with no Slot implementation or caller index authority." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "The migration removes Slot, Tail, and generic calls, and explains that this source break is authorized because the API is unreleased." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "The redesign is explicitly not a verdict, leaves current UNSOUND unchanged, and requires a fresh audit after implementation." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND without a fully verified valid-safe-use link because safe ordinary-function calling semantics are unsupported by its authority set." + }, + { + "id": "G11", + "evidence": "The report necessarily relies on the unchecked proposition that the non-unsafe increment declaration is callable without an unsafe obligation." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposal is explicitly unimplemented, unaudited, and independent of the current verdict." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-1 lists visibility, implementation, slice, and wrapping authorities but omits the material Rust 1.82 safe-versus-unsafe-function authority used by FIND-1." + }, + "visible_scope_defect": { + "present": false, + "evidence": "The report limits itself to the supplied source and versioned Rust documentation and shows no prohibited evaluation-material access." + }, + "novel_findings": [] + }, + { + "label": "F", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F-1 constructs Bad returning 2 and asserts that the impl and increment call are safe, but TCB-R033 cites no Rust 1.82 safe-versus-unsafe-function authority for the call premise." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It establishes reachability, the false 2 < 2 bound, and the slice UB consequence, but dependency R1 fails because safe-call validity is not fully verified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "The literal current verdict is UNSOUND and proposal-independent, but its required R2 certificate is incomplete through failed R1." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It extracts only a concrete wrapping increment of element 1 and rejects preserving generic implementations as unneeded." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The proposed pub fn increment uses safe pair[1] indexing and wrapping_add with no generic or caller-controlled capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains removal of Slot/Tail, the generic-to-nongeneric call migration, and the authorization to break this unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It says the proposal is not a new verdict and requires a fresh audit of the implemented snapshot and migrated callers." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND although one required existential link, valid safe calling of increment, is asserted without the required version-matched authority." + }, + { + "id": "G11", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics absent from TCB-R033." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The proposed design is not certified and is separated from the current result pending fresh audit." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-R033 includes visibility, trait implementation, slice, and wrapping authorities but omits authority for its material assertion that increment is safely callable." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reviews the exact supplied lib.rs and permitted Rust pages, with no visible access to prohibited materials." + }, + "novel_findings": [] + }, + { + "label": "J", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F-UB constructs Bad returning 2 and cites visibility, coherence, and unsafe-trait rules, but its claim that the increment call carries no unsafe obligation lacks Rust 1.82 unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "It proves the call reaches get_unchecked_mut(2), falsifies bounds, and cites UB, but R2's R1 dependency is incomplete because safe-call validity is unverified." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It expressly reports current UNSOUND independently of redesign, but R3 depends on the incomplete existential certificate in R2." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It states the required effect is [a, b.wrapping_add(1)] and that the requirement needs no genericity." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "The safe nongeneric increment fixes pair[1] and removes Slot, Tail, the type parameter, unsafe code, and caller index control." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It details the increment:: call rewrite and explains that removal of downstream implementations/generic calls is authorized for the unreleased abstraction." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It labels the sketch unimplemented with no audit verdict, preserves current UNSOUND, and requires a fresh snapshot audit." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND without fully verifying the valid-safe-use link; the ordinary-function call premise has no applicable cited authority." + }, + { + "id": "G11", + "evidence": "The witness necessarily relies on unchecked safe-versus-unsafe-function semantics omitted from TCB-R016-r1." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The report does not certify or rely on the redesign and explicitly requires implementation followed by fresh audit." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "Its TCB names visibility, implementation, unsafe-trait, slice, and wrapping axioms but omits the safe-versus-unsafe-function rule material to calling increment safely." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It confines the review to supplied lib.rs/REQUEST context and allowed Rust documentation; no prohibited material inspection is visible." + }, + "novel_findings": [] + }, + { + "label": "D", + "atoms": [ + { + "id": "R1", + "decision": "FAIL", + "evidence": "F1 gives downstream Bad returning 2 and cites visibility, orphan, and unsafe-trait rules, but the assertion that the increment call is safe lacks the required Rust 1.82 safe-versus-unsafe-function authority." + }, + { + "id": "R2", + "decision": "FAIL", + "evidence": "The report states reachability, out-of-bounds falsity, and the exact UB consequence, but R2 depends on R1's unverified safe-call premise." + }, + { + "id": "R3", + "decision": "FAIL", + "evidence": "It reports the current artifact UNSOUND and keeps redesign separate, but R3's required R2 certificate remains incomplete." + }, + { + "id": "R4", + "decision": "PASS", + "evidence": "It identifies the required Tail result as wrapping element 1 while preserving element 0, with generic downstream behavior expressly unnecessary." + }, + { + "id": "R5", + "decision": "PASS", + "evidence": "Tail::increment is a safe nongeneric checked specialization with fixed index 1 and no caller implementation or index capability." + }, + { + "id": "R6", + "decision": "PASS", + "evidence": "It explains removing Slot and generic increment, migrating to Tail::increment, and the authorized break for downstream generic users of the unreleased API." + }, + { + "id": "R7", + "decision": "PASS", + "evidence": "It tells the reader not to regard the sketch as audited or PROVED and requires a new exact-snapshot audit after implementation." + } + ], + "hard_errors": [ + { + "id": "G5", + "evidence": "It issues UNSOUND with an incompletely verified valid-safe-use link because safe ordinary-function calling semantics are not sourced." + }, + { + "id": "G11", + "evidence": "The certificate necessarily relies on unchecked safe-versus-unsafe-function authority absent from TCB-0." + } + ], + "proposal_laundering": { + "present": false, + "evidence": "The redesign is explicitly unaudited and does not alter the current-artifact conclusion." + }, + "tcb_authority_defect": { + "present": true, + "evidence": "TCB-0 cites visibility, implementation, unsafe-trait, slice, and wrapping propositions but omits authority for the material safe-function call premise." + }, + "visible_scope_defect": { + "present": false, + "evidence": "It reports source-only review of the supplied target and allowed authority, without evidence of prohibited evaluation-material access." + }, + "novel_findings": [] + } + ], + "ambiguities": [ + "The rubric does not state whether directly classifying a plain fn from source syntax alone verifies the listed safe-versus-unsafe-function dependency. I treated that material Rust semantic premise as requiring applicable Rust 1.82 authority, consistent with the frozen authority rule." + ] +} diff --git a/evals/unsafe-rust/runs/2026-08-01-v4-focused/unblinding.json b/evals/unsafe-rust/runs/2026-08-01-v4-focused/unblinding.json new file mode 100644 index 0000000000..28df6341da --- /dev/null +++ b/evals/unsafe-rust/runs/2026-08-01-v4-focused/unblinding.json @@ -0,0 +1,15 @@ +{ + "condition_map": { + "c0": "v3", + "c1": "v4" + }, + "final_score_sha256": { + "B": "349ed96867c3f75e0e65723a8b11b60a96c1d32eeed28b39338f40760afae777", + "L": "7c1c2ce5335cb1c91d2610029636bf531075b76e8a72e82015868f607a9a0944", + "P": "03ed2a9cab7cf45702bac4b9319c979e14ed63e854ae4d29fccfe3c780d2e290", + "Q": "ac39b01aeb020d54d50a2cc5eefa0a7a9d155acfb8745195d0a46e77fd421e7b", + "R": "c5e372423dbeded79ccad0565bfe10e18bd82ca5eead7211e548f2b1d62c046c" + }, + "schema_version": 1, + "unblinded_utc": "2026-08-02T01:57:38.011024Z" +}