Claim #31 — Verification of <byteorder_lite::BigEndian as byteorder_lite::ByteOrder>::read_u24 (with Aeneas be86ab0f1989d04944292b345b24c435be3ad10a)
<byteorder_lite::BigEndian as byteorder_lite::ByteOrder>::read_u24
Tool: Aeneas be86ab0f1989d04944292b345b24c435be3ad10a
Preconditions
Every input byte slice: length >= 3 returns the exact unsigned 24-bit endian decoding of the first three bytes, with result < 2^24; shorter input asserts. Original concrete default body and concrete callees; x86_64/default features.
Evidence
What is trusted
From the report
F32/F64 are explicit 32/64-bit logical patterns; two executable std to_bits models preserve those patterns as unsigned words, with checked Lean value-preservation lemmas. Guards require original writer bodies and allow no other float operation. Kani checks std bit identity for every pattern and actual released writers with 6/10-byte buffers. Connecting these Rust checks to the Lean representation is reviewed, not mechanized; Rust nightlies differ. Official translation/standard integer and slice models, Lean, and Kani/CBMC are trusted. The ten native conversion bodies make no external calls after official target-branch translation. Thirteen native-path declarations remain in the unchanged, unimported external template. The native provider imports the existing bit-pattern representation module and supplies zero new definitions or operation models; native bodies invoke no external operation. Existing to_bits models remain used by the earlier float writers only. Guards require exactly the original identity bodies and zero external use. Mapped audits permit only propext, Classical.choice and Quot.sound.
Technical limitations
From the report
This covers 36 selected writer methods, sixteen scoped integer readers, ten native-target identity conversions, and two handwritten Default methods, not all public APIs. Fixed-width 16/32/64/128-bit reads, other bulk and in-place conversions, I/O extensions, other targets and release extraction remain unproved. The float result establishes bit serialization only: floating arithmetic, comparisons, rounding, numeric accuracy, NaN arithmetic and signaling behavior are not modeled. Kani public-writer buffer lengths are fixed at 6 and 10; arbitrary valid slice lengths are quantified separately by the Lean theorems. The write_int documentation says nonrepresentable values panic, while original-body theorems establish truncation for all i64 inputs when count/space guards hold; 176 finite native observations corroborate selected boundaries. This is a documentation/behavior mismatch, not a memory-safety finding. write_i24 documents only short-buffer panic and is not classified as a documentation problem. Other signed reads remain unproved. Opposite-endian conversion methods and other target configurations are not covered by the identity results. Panic messages and unwinding side effects are not specified. Separately, write_int128 documentation also says a nonrepresentable value panics; the original-body Lean theorem establishes truncation for all i128 inputs under valid count/space guards. This additional documentation contrast follows from the proof and source text, with no new native observation claimed; the176 native observations remain specific to the prior signed64/24 investigation.
Tool limitations
Lean backend only, requiring cargo-proofs 0.4.0 or later. The version identifies the official Aeneas Git revision pinned in lake-manifest.json (backends/lean); this revision uses Lean 4.35.0. The recorder checks committed Lean theorem declarations and permits only propext, Classical.choice, and Quot.sound as transitive axioms. It rejects sorryAx and custom axioms, including axiomatized external models. Charon/Aeneas extraction is not rerun. The author must review that the committed functional model matches the recorded Rust source, that the named theorem corresponds to the public API, and that the reported precondition matches the theorem. A checked theorem alone does not establish those links or the adequacy of the specification. The current adapter records the default Cargo configuration, with ordinary Lean module paths and a pinned official Git dependency. Other backends, custom Lake source directories, and local-path Aeneas dependencies are unsupported. See https://proofs.rs/book/aeneas.html and https://github.com/AeneasVerif/aeneas/tree/be86ab0f1989d04944292b345b24c435be3ad10a.
Aeneas be86ab0f1989d04944292b345b24c435be3ad10a — version details