Machine-checked model-level foundations for cross-domain state preservation, regulatory action composition, authenticated message execution and evidence-qualified settlement, plus an independent protected-behavior obstruction companion and conditional models of the Oracle Interoperability Protocol prototype.

Proof scope | Artifacts | Architecture | Build | Mapping

Mechanized assurance. The repository registers seven artifact sessions and the OIP prototype namespace. CDSP, RAC, Cross-Chain Message Integrity, Preemptive Lock Correctness, Evidence Atomic Binding and Evidence Binding Composition form a dependency chain. Protected_Behavior_Obstructions is an independent HOL companion to an external Lean development: its rows are graded PARTIAL, never SAME (both grades are defined in Protected_Behavior_Obstructions/CROSS_PROVER_MAPPING.md). The seven sessions in the result table have sorry/oops-free theories and reproducibly check under Isabelle2025-2 with the declared AFP dependency. Claims are model-level and bounded by the assumptions recorded here. The Oraclizer product mapping remains in FORMAL_MODEL_MAPPING.md; the independent companion's exact boundary is folder-local. The OIP prototype namespace adds conditional HOL models, manual Rust source correspondence and bounded executable wire comparisons under its own stated scope. Its model artifacts are bound to the OIP v0.6.2 release.

Repository maintenance status

This is a production-maintained public research repository. The designation covers repository operations: reviewable changes, reproducible proof and document builds, session-scoped releases, integrity manifests, automated public-surface checks, security reporting, and change governance. It does not designate any artifact as a production implementation, deployment, audit, legal opinion, or model-to-code refinement.

Formal artifact catalog

This catalog lists the formal-verification artifacts in this repository. The seven established rows are independently buildable Isabelle sessions and separate review and release units. The OIP prototype row groups nine base sessions and the v0.6.1 and v0.6.2 extension sessions in one namespace. Source opens the authoritative session ROOT; PDF is the session-named reading copy; and Manifest records the source and PDF hashes together with the document-build identity. A Source manifest records the artifact's tracked source inputs; the OIP manifest covers ROOT and its theories.

Artifact	Role	Verification focus	Entry points
CDSP	Foundation	Preservation morphisms, priority and conditional progress, authenticated views, guarded convergence, and the synchronization-degree hierarchy	Source · PDF · Manifest
RAC	Extension	Regulatory outcomes, pair commutativity, provenance, transfer gates, traces, atomic queues, and finite normal forms	Source · PDF · Manifest
Cross-Chain Message Integrity	Extension	Authenticated source binding, destination-credit uniqueness, checked representations and regulatory consumers	Source · Scope and build · Claims · Source manifest
Preemptive Lock Correctness	Extension	Asset reservations, source/destination once, evidence-based release, rooted funding, timeout boundaries and journal recovery	Source · Scope and build · Claims · Source manifest
Evidence Atomic Binding	Extension	Source-qualified terminal records, guarded financial/regulatory effects, completed observations and checked recovery	Source · Scope and build · Claims · Source manifest
Evidence Binding Composition	Extension	Finite allocation characterization, actual source-to-call execution, historical projection and recovery of completed decisions	Source · Scope and build · Claims · Source manifest
Protected Behavior Obstructions	Partial companion	Set/profile consequences, explicit stochastic assumptions, set-level morphism laws, preorder facts, and bounded controls	Source · Scope · Cross-prover map · PDF/manifest not produced (document = false)
OIP prototype	Extension	Conditional HOL models, manually maintained Rust source correspondence and bounded typed-wire, sender/client and raw THRESHOLD packet comparisons	Source · Scope · Reproduction · Source manifest

Role taxonomy

• Foundation: introduces reusable formal definitions and base laws.
• Extension: imports a repository session to establish an additional checked result set.
• Bridge: proves a correspondence with an external model or formalization.
• Application: instantiates a formal model for a bounded domain case.

The role classifies an artifact's primary formal relationship, not its maturity, publication venue, or acceptance state. CDSP is the reusable foundation; RAC is an extension because it imports CDSP's Regulatory_Instance. RAC does not import or extend ADS_Functor. Cross-Chain Message Integrity extends RAC and consumes its transfer gate and CDSP completed regulatory synchronization. Its document is reproducible from source; no generated PDF is tracked for this session. Preemptive Lock Correctness extends that session with source control, reservations and financial settlement. Its technical companion is likewise reproducible from source. Evidence Atomic Binding extends reservation correctness with separate source and terminal authority, actual source/parent accounting, completed current and historical responses, and guarded recovery. Its technical guide is built from the session document sources; no generated PDF is tracked. Evidence Binding Composition extends that session with finite allocation through its actual consumers and preservation of modeled replies through historical projection and recovery. Its technical proof document also builds from source.

An earlier version of CDSP was submitted to the Archive of Formal Proofs on 2026-03-25 but was not accepted as an AFP entry. None of these sessions is an AFP entry. Repository publication, preprint publication, submission, review, and acceptance are separate states.

Verified model-level results

Session	Representative results	Essential boundary
CDSP: state preservation	regulatory_homomorphism, valid_state_preservation, sequential_preservation	Atomic finite-domain model
CDSP: priority and progress	unique maximum selection, starvation_bound, closed-count completion	Injective priorities and deterministic in-roster fairness assumptions
CDSP: composition and convergence	guarded safety and existential bounded run to validity	Recovery uses Hilbert choice and is not executable
CDSP: authenticated functor	identity/composition/associativity, merge and blinding soundness, Canton tree instance	Model-level authenticated views, not protocol traces
CDSP: degree hierarchy	natural transformations, capability-sensitive reconciliation, under-provisioning counterexample	Degree means coupling breadth, not operational S0-S3 semantics
RAC: action algebra	all 21 distinct-label pairs classified as 12 commuting and 9 noncommuting, with witnesses	Concrete five-state, seven-label machine
RAC: outcomes and traces	applied/rejected/operational-failure separation, trace and unrelated-asset frame properties	No authorization, replay, or concurrency model
RAC: atomic queues and normal forms	completed-step validity and consistency; exactly 60 reachable transformation vectors	Atomic completed steps, not partial propagation or rollback
Cross-chain message integrity	Full payload binding, source-key credit bound, exact local-marker criterion, normal/bypass equivalence, contextual summary iff and concrete consumers	External source/crypto/current-context assumptions; no full financial recovery or runtime refinement
Preemptive lock correctness	Complete-footprint ownership, stale-version protection, source/credit/return uniqueness, exclusive settlement, source-pool conservation and rooted continuation/recovery	Atomic local commits, stable-source/current-context assumptions; conditional cleanup bounds, no runtime refinement or distributed observational atomicity
Evidence atomic binding	Immutable terminal cores, source/credit/return exclusion and allocation, actual callback response provenance, fresh-call revision order, product words and current-source recovery	Conditional source, authority and durability contracts; no whole-runtime refinement, all-API linearizability or unconditional termination
Evidence binding composition	Finite allocation iff with supplied current contexts; actual source and fresh completed calls; historical projection over finite call words; recovery and financial/regulatory applications	Credited distinct roots and finite holders; current policy and durable-source obligations; no arbitrary fixed-policy realization, global minimal representation or implementation refinement
Protected behavior obstructions	nested profile algebra, assumption-transparent T2/T3/T4/T5 consequences, set-level morphism laws, preorder facts, and direct finite witnesses	PARTIAL; no kernel-derived first-hit law, scheduler correspondence, quantitative pushforward, or SAME credit

Every row is shorthand. The Oraclizer theorem-to-target map, assumptions, open obligations, and proposed implementation correspondences are in FORMAL_MODEL_MAPPING.md. The independent protected-obstruction companion has no product target; its detailed correspondence is in Protected_Behavior_Obstructions/CROSS_PROVER_MAPPING.md.

The composition source guide links the allocation, call and recovery theorems to their controls. Equal pooled balances can produce different fresh completed funding replies; a nonempty even-amount policy can block an arithmetically admissible target; and successful reorderings can remain distinguishable through raw journals. Its model boundary states the consumer classes and separates those results from deployed behavior.

The OIP prototype has a separate model and source boundary. Its consumers compare the selected typed-wire, sender/client and raw THRESHOLD packet cases; these comparisons do not establish a verified compiler, universal Rust/Go refinement or a production Witness/storage deployment.

Theory architecture

Registered session dependencies

Each line runs from a session to the sessions that import it. The chart in the same figure draws one square per OIP extension session, grouped by purpose. All of them build on the core OIP sessions except four negotiation-model sessions in the wire group, which import Isabelle/HOL only and join the product model through a bridge session; they are drawn as outlines. For exact dependencies, see the full Mermaid graph and the OIP session declarations. The independent companion has no dependency on the six-session chain. The auxiliary composition audit is a separate verification session.

CDSP and RAC foundation imports

The CDSP session depends on HOL-Library, HOL-Eisbach, and the AFP session ADS_Functor. RAC extends the built CDSP session and imports its regulatory instance explicitly. Protected_Behavior_Obstructions extends HOL independently and imports neither CDSP nor RAC. The diagram displays the CDSP/RAC foundation. Cross-Chain Message Integrity adds a child of RAC: typed source certificates and a local-once kernel feed execution, transport, checked summaries, concrete consumers and semantic boundary tests. Preemptive Lock Correctness adds a further child: reservations and worker leases feed source control, evidence-based settlement, rooted funding and complete-journal recovery. Evidence Atomic Binding adds controlled source outcomes, terminal records and guarded consumers, then connects actual callback executions to completed responses and independent financial/regulatory observations. Evidence Binding Composition adds finite allocation, historical-state projection and actual call/recovery applications without changing those parent operations.

The foundation view shows direct imports, with AFP theories grouped under their session and standard Isabelle library imports omitted. Wide windows show them as a layered graph; narrower windows show the same imports as arcs between theories listed in import order. Regenerate the Mermaid sources with python scripts/render-architecture.py; node scripts/verify-repository-health.mjs checks that the Mermaid sources and every version of both diagrams draw exactly the imports in the actual ROOTS, ROOT, and theory headers, and that the session chart has one square per remaining registered session.

Assurance boundary

Established within the models

• the seven sessions represented in the result table and their registered theories build;
• the theory sources contain no sorry or oops;
• named results follow from the definitions, locales, and assumptions stated in the theories;
• RAC's pair inventory, witnesses, and 60 normal forms are checked in the Isabelle kernel rather than asserted from an external enumeration.

Not established

• model-to-code refinement (Isabelle to Rust, Solidity, or EVM);
• distributed-runtime correctness: locks, timeouts, rollback, finality, concurrent interleaving, network liveness, or adversarial BFT execution;
• external facts and operations: authorization and identity policy, replay protection in deployed code, cryptographic implementation correctness, legal truth, live deployment, operational security, or audit status.

These are open or external obligations, not implied consequences of a green proof build.

Reproduce the proofs

For the independent protected-obstruction companion only, Isabelle2025-2 is enough; it extends HOL and does not require AFP:

isabelle build -c -D Protected_Behavior_Obstructions Protected_Behavior_Obstructions

Read its scope and cross-prover map before comparing it with the canonical Lean development, published separately as observer-patch-holography.

Prerequisites

• Isabelle 2025-2
• an AFP checkout compatible with that Isabelle release
• the AFP ADS_Functor session available through registration or -d

Register the AFP once:

isabelle components -u /path/to/afp/thys

Check the seven sessions in the result table from the repository root:

isabelle build \
  -d . \
  -d /path/to/afp/thys \
  Cross_Domain_State_Preservation Regulatory_Action_Composition \
  Cross_Chain_Message_Integrity Preemptive_Lock_Correctness \
  Evidence_Atomic_Binding Evidence_Binding_Composition \
  Protected_Behavior_Obstructions

Expected completion includes:

Finished Cross_Domain_State_Preservation
Finished Regulatory_Action_Composition
Finished Cross_Chain_Message_Integrity
Finished Preemptive_Lock_Correctness
Finished Evidence_Atomic_Binding
Finished Evidence_Binding_Composition
Finished Protected_Behavior_Obstructions

Generate a session document in a chosen output directory:

isabelle build \
  -d . \
  -d /path/to/afp/thys \
  -o document=pdf \
  -o document_output=/path/to/output \
  Regulatory_Action_Composition

Isabelle's build output may be named document.pdf. That is a transient build artifact. A tracked public reading copy is accepted only under <Session>/release/<Session>.pdf, with the exact case-sensitive session name. Generic document.pdf files are not public release artifacts.

The message-integrity build instructions provide the dated AFP archive and digest used in Continuous Integration.

To check the composition session and its source inputs directly:

node Evidence_Binding_Composition/verify-source.mjs
isabelle build -b -j 1 -o threads=1 -o parallel_proofs=0 \
  -d /path/to/ADS_Functor -d . Evidence_Binding_Composition

Here /path/to/ADS_Functor is the extracted entry directory containing ROOT. The composition session sets document = false; its separate technical document uses pdflatex and bibtex:

node Evidence_Binding_Composition/build-document.mjs output/Evidence_Binding_Composition

For the OIP prototype sessions, exact source-manifest bytes, logical-session exports and the bounded wire consumers, use OIP reproduction.

An independent assurance claim should identify the exact commit, Isabelle and AFP revisions, command, and resulting session log.

Repository map

Each established artifact has its own directory. The OIP prototype groups its base and extension sessions beneath one namespace:

Path	Purpose
ROOTS	Registers the seven artifact session directories and the OIP prototype namespace; auxiliary audit sessions are invoked separately
<Session>/	One directory per catalog artifact: the authoritative *.thy theories and the session ROOT. Sessions that produce a reading copy add document/ (LaTeX source) and release/ (session-named PDF and manifest); session-scoped docs such as a scope README or a cross-prover mapping live inside the same directory
Oracle_Interoperability_Protocol/	Base and extension prototype sessions declared with source subdirectories in ROOT, their exact compiler-input manifest, the typed transport, Full response and THRESHOLD model artifacts with their content locks, scope and reproduction instructions
docs/assets/	README banners for phone, medium and desktop widths, the grouped session overview and the foundation import views, with Mermaid sources (the session source holds the full graph) and narrow-screen variants
FORMAL_MODEL_MAPPING.md	Oraclizer theorem-to-target mapping, assumptions, gaps, and proposed tests
CONTRIBUTING.md, SECURITY.md, CITATION.cff	Review channels and proof reproduction, sensitive-report routing, and citation metadata

Generated Isabelle heaps, transient document.pdf files, local output, editor state, and machine-specific paths are excluded from the public tree.

Independent review and contributions

The highest-value contributions are counterexamples, overly strong assumption reports, model-scope challenges, reproduction results, and clarity fixes. Theory changes are issue-first so that each session remains a coherent, auditable artifact.

Read CONTRIBUTING.md before opening a Pull Request. Use the issue forms for public proof or documentation questions. Report sensitive vulnerabilities through SECURITY.md, never in a public issue. Support and project decision boundaries are in SUPPORT.md and GOVERNANCE.md.

Publications and related work

• Jinwook Kim, The Cross-Domain State Preservation Functor: A Mechanized Theory of Regulatory State Synchronization in Isabelle/HOL, arXiv:2604.03844.
• Jinwook Kim and Jonghun Hong, A Regulatory Compliance Protocol for Asset Interoperability Between Traditional and Decentralized Finance in Tokenized Capital Markets, arXiv:2603.29278.
• Andreas Lochbihler and Ognjen Marić, Authenticated Data Structures as Functors in Isabelle/HOL, AFP: ADS_Functor.

Use CITATION.cff, name the session used, and cite the exact commit when referring to a mechanized artifact.

License and disclaimer

The repository is licensed under the BSD 3-Clause License. The license includes warranty and liability limitations. DISCLAIMER.md summarizes the model, academic, implementation, and deployment boundaries without replacing the license.

Maintainer: Jinwook Kim (Jay), jay@oraclizer.io.