[joshlf]

Add a shared algebra for uninitialized, initialized, and safe referent
contents at an explicit byte width. Safe contents must pass both physical
and mathematical decoding. This permits empty valid domains without an
inhabitedness premise or a preferred representation.

Prove the basic weakening, completeness, wrapper-domain, and initialized
subrange rules. Transfers are conditional on equal endpoint widths, so
composition also requires equal source and intermediate widths. Add a
counterexample protecting that premise, plus invalid-boolean and empty-type
tests. These are content facts; memory access and resource obligations
remain separate.

Authored by an AI agent acting on joshlf's behalf.

---

• 　  Compose referent content laws at explicit metadata pairs #3895
• 　  Prove the native slice IntoBytes implementation #3894
• 　  Retain indexed storage in Rust model providers #3893
• 　  Compose byte decoders at explicit element metadata #3892
• 　  Bound pointer projections even for empty referents #3891
• 　  Prove referent validity implications for native trait impls #3890
• 　  Expose wrapper validity impls for independent verification #3889
• 　  Retain every type argument in native trait laws #3888
• 👉 Model referent validity as byte-domain inclusion #3887
• 　  Prove a generic owned conversion against byte models #3884
• 　  Require realizable source representations for IntoBytes #3883
• 　  Require fresh ownership proofs before ignoring drops #3882
• 　  Prove conservative ownership checks for conditional drops #3881
• 　  Prove record construction against independent Rust references #3846
• 　  Prove selected cast plans preserve size without metadata overflow #3845
• 　  Prove CastPlan selection and unchecked metadata arithmetic #3844
• 　  Prove cast validation and exact-size metadata inference #3843
• 　  Prove allocation-size preparation and tail containment #3842
• 　  Prove CastUnsized's production layout acceptance gate #3841
• 　  Prove the numerical bounds used by split operations #3840
• 　  Prove advancement and padding-sequence decisions #3839
• 　  Prove DstLayout padding and field extension #3838
• 　  Prove unit and usize PointerMetadata operations #3837
• 　  Prove trailing sizes, padding and capacity including overflow #3836
• 　  Prove and consume the Unaligned alignment law #3862
• 　  Prove primitive DstLayout constructors #3835
• 　  Add an independent Rust reference for nested DST sizes #3834
• 　  Specify rounding encodings as alignment and phase #3833
• 　  Relate recursive record layout to normalized size formulas #3832
• 　  Prove normalized trailing-size and capacity formulas #3831
• 　  Reuse Aeneas rules for views and indexed loops #3830
• 　  Prove least padding and greatest aligned predecessors #3829
• 　  Test total and partial Aeneas contract semantics #3828
• 　  Verify Boolean and NonZeroUsize candidate predicates #3852
• 　  Verify the byte writers used by IntoBytes #3851
• 　  Prove FromZeros::new_zeroed through its enclosing trait law #3880
• 　  Prove FromBytes and FromZeros construction invariants #3879
• 　  Express Alignment::read's pointer guarantees as a tuple #3878
• 　  Prove wrapper and byteorder IntoBytes implementations #3872
• 　  Prove scalar and PhantomData IntoBytes implementations #3871
• 　  Prove concrete owned standard transmutation #3877
• 　  Prove array IntoBytes initialization from element laws #3863
• 　  Check trait invariants on exact Aeneas dictionaries #3861
• 　  Prove U16 and U32 byte-order reads, writes and updates #3827
• 　  Prove guarded Boolean conversion and byte copying #3849
• 　  Reject unsupported execution effects before Aeneas lowering #3848
• 　  Check Rust specs against golden and live Aeneas models #3826
• 　  Separate cast plans from pointer reconstruction #3825
• 　  Move cast_from into layout/cast_from.rs #3824
• 　  Share Rust layout, storage and pointer models in anneal/lean #3823
• 　  Check reconstructed layouts against compiler layout queries #3860
• 　  Preserve Lake declarations and traces when vendoring #3875

Latest Update: v4 — Compare vs v3

📚 Full Patch History

Links show the diff between the row version and the column version.

Version	v3	v2	v1	Base
v4	vs v3	vs v2	vs v1	vs Base
v3		vs v2	vs v1	vs Base
v2			vs v1	vs Base
v1				vs Base

⬇️ Download this PR

Branch

git fetch origin refs/heads/Gkc7ajwbs2rni7qu5gz3sdcm7457o6iuf && git checkout -b pr-Gkc7ajwbs2rni7qu5gz3sdcm7457o6iuf FETCH_HEAD

Checkout

git fetch origin refs/heads/Gkc7ajwbs2rni7qu5gz3sdcm7457o6iuf && git checkout FETCH_HEAD

Cherry Pick

git fetch origin refs/heads/Gkc7ajwbs2rni7qu5gz3sdcm7457o6iuf && git cherry-pick FETCH_HEAD

Pull

git pull origin refs/heads/Gkc7ajwbs2rni7qu5gz3sdcm7457o6iuf

Stacked PRs enabled by GHerrit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T19:05:39.242607Z	f6bb2df	PR opened
🔒 Security Review	✅ Completed 2026-10-15T19:09:21.118733Z	f6bb2df	PR opened

Security findings

Finding details are still loading. Check the individual review comments.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.89%. Comparing base (394b6d6) to head (04257d4).

Additional details and impacted files

@@                        Coverage Diff                         @@
##           Gmhd5pbk4jan7lwabm442fdhchwui6nnr    #3887   +/-   ##
==================================================================
  Coverage                              48.89%   48.89%           
==================================================================
  Files                                     34       34           
  Lines                                   4733     4733           
==================================================================
  Hits                                    2314     2314           
  Misses                                  2419     2419           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f6bb2dfad2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add Referent to the axiom-audit roster

When Rust is audited, RustTests.lean:66 selects declarations strictly by their defining module, but its libraryModules roster omits Rust.Referent. Consequently, every library declaration introduced by this import is skipped, so a later sorryAx or other forbidden assumption in Referent.lean could pass the required full-library audit; add the new module to that roster.

AGENTS.md reference: anneal/AGENTS.md:L11-L13

Useful? React with 👍 / 👎.

[gemini-code-assist]

Code Review

This pull request introduces a new module Rust.Referent and its corresponding tests in Rust.ReferentTests. The new module defines referent states (uninit, initialized, and safe) along with the Transfer relation describing directional inclusion of domains when widths agree. It also includes several theorems proving properties about these states, transfers, and initialization preservation under slicing and splicing. I have no feedback to provide as there are no review comments.