Read the rust-tops law catalog — Bend s06

Walk one clause from name to law to proof. Say what PROOF does not cover.

<!-- hal:authoritative:yaml -->

Walk one harvested clause from name → law → proof obligation. Say what the proof does not cover.

§I. Frame

Asr session 06 for Bend. Topic T8 Verification & AI ops. Sixth live fire; first row that opens the rust-tops encode block (Topics #6 to #8). Home: . Corpus: ~/projects/rust-tops/laws/ (NAMES, LAWS.bend, PROOF.bend). Protocol prose: Sketch map:

Sessions 01–05 shipped fail-closed install, ownership, Gap Walk, Friction Log, and Parallelism Boundary. Today you read the catalog that already exists in the kit. You do not invent tourism demos. You do not reseat primary stack.

Host reminder: Bend CLI work stays on tower or Bot-VM only. Catalog reading is vault + repo paths and does not require a GPU story.

Done-criteria: you can walk how one harvested rust-tops clause becomes a named law and its proof obligation, and say what the proof does not cover.

§II. Catalog Triad (named technique)

Catalog Triad: three files, three jobs.

Yagyu: the triad is the harvest surface. NAMES is the index. LAWS.bend is the fail-closed body. PROOF.bend is the obligation runner that Bend checks when the host gate runs with Bend on PATH (names-only mode exists for Nix sandbox without Bend; that is session 07 territory).

Musashi: a green proof covers stated laws only. Unstated gaps stay gaps (session 03). Parallel marketing stays Claim Surface (session 05).

§III. Clause Harvest Walk (named technique)

Clause Harvest Walk: pick one catalog entry and trace protocol intent → Bend types → law → proof line.

Worked example: **evidence_not_self_served** (first name in NAMES).

Protocol intent (RUST_TOPS / Bend2 sketch). Evidence must not be self-served from the implementation under test. Axiom A4: do not generate tests from the implementation. BEND2-INTEGRATION maps related intent to refuse shapes that treat impl-derived “evidence” as acceptance.

Bend types (from the head of LAWS.bend):

type Verdict is Data:
  Refuse{}
  Ack{}
  Allow{}

type Evidence is Data:
  FromImpl{}
  FromContract{}

def evidence_verdict(x: Evidence) -> Verdict:
  match x:
    case FromImpl{}:
      Refuse{}
    case FromContract{}:
      Allow{}

law evidence_not_self_served:
  {evidence_verdict(FromImpl{}) == Refuse{} : Verdict}

Proof obligation (opening conjunct in PROOF.bend):

import ./LAWS.bend as Laws
# main requires, among others:
# Laws.evidence_verdict(Laws.FromImpl{}) == Laws.Refuse{}

If-then-thus: if evidence is tagged FromImpl, then evidence_verdict returns Refuse, thus the law fails closed for self-served evidence and PROOF.bend demands that Refuse.

Second pin (same walk, shorter): **library_public_oracle** in NAMES pairs with oracle_verdict / CliOnlyOracle → Refuse in LAWS.bend. That is the catalog’s shape for “public library surface needs a real oracle, not CLI-only theater,” aligned with A4’s oracle-before-impl intent in the integration sketch. Read the match arms in the file; do not invent new constructors in a lesson note.

§IV. Proof Cover Bound (named technique)

Proof Cover Bound: name what a green PROOF.bend does and does not mean.

Does:

• Assert the conjunction of stated law obligations imported from LAWS.bend.
• Fail closed when a stated bad shape (for example FromImpl) would be allowed.
• Give Host Work Surface a binary pass/fail for the harvested pack when Bend runs.

Does not:

• Cover rust-tops axioms that were never encoded as laws.
• Replace Halo cargo gates (nextest, mutants, coverage). Bend refuses agent progress that skips evidence; Halos still run tools.
• Prove vendor parallel/CUDA claims (session 05 Boundary).
• Expand Cover Bound to unstated host/IO/@unsafe/renderer gaps (session 03 checklist).

Template sentence for spike notes:

COVER: PROOF.bend green ⇒ stated LAWS.bend obligations held on this host run.
NOT COVER: unstated axioms, Halo apply loops, Claim Surface marketing.

§V. What this lane is for

Bend2 at Asr exists so agents encode rust-tops as fail-closed laws. Reading the catalog is the first encode skill: navigate NAMES, open the matching law, find the PROOF conjunct, state Cover Bound.

Refuse:

• “We have 53 laws so A4 is done for every crate.”
• “PROOF green means mutants are unnecessary.”
• “Parallel Bend runtime densifies the catalog (A6/A7 abuse).”

§VI. Worked catalog drill

Perform once on tower notes (read-only against the repo):

1. Open laws/NAMES. Copy line 1: evidence_not_self_served.
2. Search LAWS.bend for that name. Quote the law block.
3. Confirm PROOF.bend mentions evidence_verdict(FromImpl{}) == Refuse{}.
4. Write one sentence: what Refuse blocks; what it does not prove about unstated gaps.

Stop after one clause. Density over golf (A6).

§VII. Common mistakes

1. Treating NAMES count as coverage percentage of RUST_TOPS.md.
2. Editing LAWS.bend in this lesson (row #8 is later; no push).
3. Skipping Parallelism Boundary and scoring laws by CUDA copy.
4. Confusing names-only Nix law-catalog check with a full Bend proof run (row #7).
5. Closing with factory adoption or primary-stack reseat.

§VIII. Boundaries

• Not install / Gate Walk re-teach (session 01).
• Not regenerate via gen-laws.rs (session 07).
• Not authoring a new clause into the repo (session 08).
• Not spike bank review (session 09).
• Not Halo mutants/CRAP grind (apply track).
• Not Maghrib quiz×4.
• Not mesh PATH Bend.

§IX. Close

Session 05 named Claim vs Host. Session 06 reads the Host catalog: Catalog Triad, Clause Harvest Walk, Proof Cover Bound. Next unmarked: session 07, regenerate the laws from the catalog.

Related: ·

Walk evidence_not_self_served once. Write the COVER template. Stop.