Skip to content

feat(importer): apply modifiers in order and encode user structs - #2437

Merged
Th0rgal merged 12 commits into
mainfrom
feat/importer-modifiers-structs
Sep 21, 2026
Merged

Th0rgal merged 12 commits into
mainfrom
feat/importer-modifiers-structs

Conversation

@Th0rgal

@Th0rgal Th0rgal commented Sep 20, 2026

Copy link
Copy Markdown
Member

Summary

  • Inline argument-free Solidity function modifiers at parse time in declaration order (Stmt.seq prelude + Stmt.block postlude so an early return still runs nonReentrant).
  • Encode/decode two-member user structs (uint256 then address) as params, storage, and returns via Expr.pair / fst / snd.
  • Keep the VaultFromSolidity POC green. Add focused modifier/struct smokes that fail on origin/main (no modifier/struct AST nodes there) and pass on this branch.

Test Plan

  • lake build VaultFromSolidity SolidityImportSmokeModifiers SolidityImportSmokeStructs SolidityImportSmokeInheritance (pass)
  • python3 Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py (pass)
  • python3 Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py (pass)
  • python3 Contracts/VaultFromSolidity/Importer/scripts/solidity_importer_test.py (pass)
  • python3 scripts/check_spec_named_storage.py, check_contract_structure.py, check_proof_length.py, generate_verification_status.py --check, generate_print_axioms.py --check, check_verification_status_doc.py, update_doc_numbers.py --check (pass)

Follows docs/SOLIDITY_IMPORT_ROADMAP.md slice S2 (modifiers/structs). Does not import a Pareto contract. No merge.

Inline argument-free function modifiers at parse time in declaration
order (seq prelude + block postlude so early return still restores
nonReentrant status). Accept two-member uint256/address user structs as
params, storage, and returns via pair encode/decode. Keep the Vault POC
green and add focused modifier/struct smokes that fail on main.
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 20, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-20T17:28:07.460848Z b233462 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Sep 20, 2026 •

Copy link
Copy Markdown
Contributor
\n### CI Failure Hints\n\nFailed jobs: `checks`\n\nCopy-paste local triage:\n```bash\nmake check\nlake build\nFOUNDRY_PROFILE=difftest forge test -vv\n```

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ebd87afce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Keep artifacts/trust_surface_report.json in sync with the current
partial-def count so `python3 scripts/generate_trust_surface_report.py --check` passes.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5dba55c8c0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OpenCodeReview first-pass review

🟡 Scout triage + 0/2 paquet(s) reviewés sémantiquement. 2 finding(s) (2 medium); les hunks hors paquets restent à couvrir par un humain ou Codex.

Paquets non couverts par la review sémantique

  • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py — timeout (spawnSync ocr ETIMEDOUT)
  • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py — timeout (spawnSync ocr ETIMEDOUT)

Large Lean diff routed to bounded packet review: 11 Lean file(s), 1455 changed supported line(s). Multi-lens scout (1/4 lens(es): environment-determinism) surfaced 2/8 packet(s) for stronger review. Scout triage success; strong packet review required. Full-file OCR was not attempted.

✅ Posted 2 inline comment(s).

OCR pilot metrics & packet coverage

OCR pilot metrics

  • Routing: large-lean-hotspots (router-v10)
  • Changed files: 27 supported / 28 total; Lean 11, trust docs 3, workflow/scripts 9, contracts 2, docs 2
  • Changed lines: 1455 supported; thresholds large Lean >=3 files or >800 lines
  • OCR: status scout_triage; comments 2; files 2; tokens 0; tool calls 0; warnings 1; duration 1635s
  • Largest changed files: Contracts/VaultFromSolidity/Importer/Importer.lean (+485/-94), Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py (+242/-0), Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py (+229/-0), Contracts/SolidityImportSmoke/Modifiers/Modifiers.sol (+61/-0), Contracts/SolidityImportSmoke/Modifiers/Proofs.lean (+45/-0)

Packet coverage

  • Packet review: enabled; selected 2/8 packet(s)
  • Scout: configured; status success; model builtin/assistant
  • Scout lenses: provenance, verification-independence, environment-determinism, proof-soundness (3 lens(es) failed; union of the rest used); rubric items checked 3
  • Strong review: required; status blocked_packet_input
  • Residual risk: Triaged top 2 scout-ranked packet(s); remaining changed hunks/files require Codex or human proof review, and selected packets still need strong reviewer analysis.
  • Strong packet-review blocker: OpenCodeReview 1.7.9 supports --from/--to full diff ranges, but this workflow does not have a safe packet/window input bridge for Lean hunks yet.
  • Covered packets:
    • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py:1 score 74 [lenses: environment-determinism] — public declaration/signature changed, changed imports; ask: Does this suite ever invoke PATH lake/solc (or other unpinned tools/env overrides) instead of the repo-pinned toolchain, and can that cause the structs importer proofs to pass in one environment and fail—or silently mean something different—in another?
    • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py:1 score 74 [lenses: environment-determinism] — public declaration/signature changed, changed imports; ask: Is lake_binary() (and any solc/python/env lookups below the excerpt) identical and pinned across modifiers vs structs vs lakefile.lean/CI, or can PATH/host toolchain layout change which modifier translation is accepted?

Pilot mode: advisory only. Codex Review remains the merge gate.

Comment thread Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py
Comment thread Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py
@Th0rgal

Th0rgal commented Sep 20, 2026

Copy link
Copy Markdown
Member Author

Grok self-review (5dba55c8c07705bdacdea7e091457bb01828400f)

Verdict vs current source: remaining issues (not CLEAN). Scope of this PR (modifiers applied in declaration order + two-member uint256/address user-struct encode/decode) is present and covered by smokes. I did not merge and did not request Fable.

CI on this exact head: Verify proofs run 35502826985 success. Required jobs: checks, build, build-audits, build-compiler-binaries, compiler-audits, compiler-regressions, foundry (0–3), foundry-patched, foundry-gas-calibration all SUCCESS. Docs build SUCCESS. OCR first-pass SUCCESS; OCR semantic review NEUTRAL. Skipped: closed-pr-cleanup, lean-profile, foundry-multi-seed, failure-hints.

What this head does deliver

  • wrapModifiers inlines argument-free modifiers in invocation order as Stmt.seq prelude + Stmt.block inner/postlude (Importer.lean ~1589–1613), so a function return still runs nonReentrant restoration (Semantics.lean .block).
  • Two-member structs are Expr.pair / fst / snd with pair encode/decode on params, flattened storage, constructors, and returns.
  • Tests exist: Contracts/SolidityImportSmoke/Modifiers/{Modifiers.sol,Proofs.lean,scripts/modifiers_test.py} (order + postlude mutations) and .../Structs/... (set/get/make). Modifier proofs #print axioms allow only propext/Quot.sound.

Open soundness gaps vs Solidity (still true on this SHA)

  1. Struct assignment double-evaluates the RHS (Importer.lean:1385). assignStructMembers writes .fst rhs then .snd rhs. Expr.meaning of .fst/.snd each re-runs the pair expression (Semantics.lean:133–136). A view helper Acc(data.amount + 1, data.who) at amount = max-1 succeeds in Solidity but can overflow on the second eval here. Bind the pair once (e.g. local_) before the two member writes.

  2. Contract-scoped struct type strings drop canonicalName (Importer.lean:912–920). pairTypeName / isPairTypeString use s.name (struct Acc), while solc reports struct C.Acc memory for a nested declaration. requireType then rejects otherwise-supported contract-scoped params/returns/ctors. StructInfo never stores the AST canonicalName. The structs smoke avoids this by declaring Acc at file scope.

  3. Named address / struct returns initialize from msg.sender (Importer.lean:1626–1630). Fall-through named address returns should be the zero address; named pair returns currently get who = msg.sender instead of a zeroed member. Imported meaning then depends on the caller for functions whose Solidity result is constant zero.

  4. Modifier prelude return; does not skip the body (Importer.lean:1611–1613). Prelude is parsed as a void stmt (r = []), so return; becomes .done, and .seq preS (.block inner postS) always runs the function body. Solidity exits that modifier before _. Accepted modifier skip() { return; _; } can certify state changes the contract never performs.

  5. super in an inherited modifier is resolved from the applying function, not the modifier’s defining contract (Importer.lean:1120, wrapModifiers ~1611). collectCallIds frontend f mbody and parseStmts ctx … use ctx.current (the function receiving the modifier). superTarget exists but is not fed the modifier’s defining contract id, so B’s modifier applied in C is B can select B.f instead of the next base after B.

  6. Distinct structs collapse to the same .pair signature (Importer.lean:550, familyOf ~987–988). Every supported struct is Sol.Ty.pair, so internal overloads f(A) / f(B) with the same member shape are equal to familyOf/mostDerived. A call whose AST references f(B) can route to source-first f(A). Keep a struct id on the imported type, or reject such overloads before erasure.

Weaker / slice-boundary (not merge-blocking for this smoke, still wrong vs full Solidity)

  1. Public struct fields drop the generated getter (Importer.lean:804–813). vis is discarded and flattened members get getter := none, so Acc public data imports data_amount/data_who and omits Solidity’s data(). Register one product-valued getter per public struct, or reject public struct fields until that exists.

  2. Smoke lake_binary() prefers PATH lake over lean-toolchain (modifiers_test.py:15–27, structs_test.py:15–27), with a host-specific /var/lib/opencode/.elan/toolchains fallback. Duplicate resolvers can typecheck the slice with a different lake than lakefile.lean/CI. Prefer the pinned elan toolchain first. OCR scout already asked this; it is environment-determinism, not a Lean soundness bug.

Unresolved review threads (9): Codex P1s 1–6 above, Codex P2 #7, OCR scout on both *_test.py lake pins. No human review threads.

Not CLEAN until at least 1–6 are fixed or the importer hard-rejects those shapes (prelude return, contract-scoped names, named address/struct returns, dual .pair overloads, effectful struct RHS). Item 1 is the highest-priority accepted-path mismatch.

No merge. No @codex. No Fable.

@chatgpt-codex-connector

Copy link
Copy Markdown

To use Codex here, create an environment for this repo.

Bind struct assignment RHS once, keep solc struct ids in Ty.pair so
same-shape overloads stay distinct, use canonicalName, zero-init named
address/struct returns, reject modifier prelude return, resolve super
from the modifier definer, register one public struct getter, and pin
smoke lake to lean-toolchain before PATH.
Unbound `id` in Expr.pair/fst/snd was parsed as Lean.Identity, so
Ty.pair id failed to typecheck and ToExpr derivation fell back to sorry.
Bind {id : Nat} on those constructors, unindent the storage-struct field
loop so it is not an application of 0, and add missing do on getter lambdas.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 21dcc3869c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Comment thread Contracts/VaultFromSolidity/Importer/Importer.lean Outdated
Keep identifier calls to private/non-virtual helpers bound to the
declaring contract, and thread modifier prelude uint locals through
the inlined body and postlude.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

Th0rgal and others added 3 commits September 20, 2026 17:23
Keep extract/check in sync after tagged_uses_base_helper and
snapshot_restores_status, excluding them like the other importer smokes.
Layer 1 SolidityImportSmoke is 18 (354 total, 99 proof-only exclusions)
after the two new modifier/struct theorems; keep VERIFICATION_STATUS.md
and llms.txt aligned with generate_verification_status.py --check.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OpenCodeReview first-pass review

🟡 Scout triage + 0/3 paquet(s) reviewés sémantiquement. 3 finding(s) (1 high / 2 medium); les hunks hors paquets restent à couvrir par un humain ou Codex.

Paquets non couverts par la review sémantique

  • TRUST_ASSUMPTIONS.md — timeout (spawnSync ocr ETIMEDOUT)
  • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py — timeout (spawnSync ocr ETIMEDOUT)
  • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py — timeout (spawnSync ocr ETIMEDOUT)

Large Lean diff routed to bounded packet review: 11 Lean file(s), 1788 changed supported line(s). Multi-lens scout (2/4 lens(es): provenance, verification-independence) surfaced 3/8 packet(s) for stronger review. Scout triage success; strong packet review required. Full-file OCR was not attempted.

✅ Posted 3 inline comment(s).

OCR pilot metrics & packet coverage

OCR pilot metrics

  • Routing: large-lean-hotspots (router-v10)
  • Changed files: 27 supported / 28 total; Lean 11, trust docs 3, workflow/scripts 9, contracts 2, docs 2
  • Changed lines: 1788 supported; thresholds large Lean >=3 files or >800 lines
  • OCR: status scout_triage; comments 3; files 3; tokens 0; tool calls 0; warnings 1; duration 2434s
  • Largest changed files: Contracts/VaultFromSolidity/Importer/Importer.lean (+594/-118), Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py (+269/-0), Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py (+242/-0), Contracts/SolidityImportSmoke/Modifiers/Modifiers.sol (+93/-0), Contracts/VaultFromSolidity/Importer/Syntax.lean (+78/-2)

Packet coverage

  • Packet review: enabled; selected 3/8 packet(s)
  • Scout: configured; status success; model builtin/assistant
  • Scout lenses: provenance, verification-independence, environment-determinism, proof-soundness (2 lens(es) failed; union of the rest used); rubric items checked 3
  • Strong review: required; status blocked_packet_input
  • Residual risk: Triaged top 3 scout-ranked packet(s); remaining changed hunks/files require Codex or human proof review, and selected packets still need strong reviewer analysis.
  • Strong packet-review blocker: OpenCodeReview 1.7.9 supports --from/--to full diff ranges, but this workflow does not have a safe packet/window input bridge for Lean hunks yet.
  • Covered packets:
    • TRUST_ASSUMPTIONS.md:62 score 94 [lenses: provenance, verification-independence] — trust-boundary docs drift, changed imports; ask: Does the registeredSources manifest (and any checksum it backs) pin every artifact the Solidity importer and kernel actually consume after this fragment expansion—including Modifiers.sol/Structs.sol, inherited bases, lakefile inputs, and opaque-field metadata—or can an unlisted file be added/swapped without changing the manifest hash while still affecting Storage/view/step?
    • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py:1 score 74 [lenses: provenance, verification-independence] — public declaration/signature changed, changed imports; ask: What exact byte-strings does modifiers_test.py hash, and does that set equal every file the importer/proofs/registeredSources path depends on—or does a content-preserving rename, extra include, lakefile target, or PATH lake binary change semantics without invalidating the checksum?
    • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py:1 score 74 [lenses: provenance, verification-independence] — public declaration/signature changed, changed imports; ask: Does structs_test.py pin contents of Structs.sol plus every imported/base file, generated Lean module, and lake/toolchain input used in the structs slice, or only a subset such that an extra struct member/file can be introduced without breaking the hash while still changing Store/view?

Pilot mode: advisory only. Codex Review remains the merge gate.

Comment thread TRUST_ASSUMPTIONS.md
in signatures; a public struct field registers one product getter; a storage
struct assignment binds the RHS pair once). Unknown executable constructs are
rejected; this is not general Solidity support. Multi-file units, packed
fields, events, and external calls remain out of the fragment.

This comment was marked as outdated.



if __name__ == "__main__":
main()

This comment was marked as outdated.



if __name__ == "__main__":
main()

This comment was marked as outdated.

Keep artifacts/trust_surface_report.json in sync with the current
partial-def count so `python3 scripts/generate_trust_surface_report.py --check` passes.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OpenCodeReview first-pass review

🟡 Scout triage + 0/3 paquet(s) reviewés sémantiquement. 3 finding(s) (1 high / 2 medium); les hunks hors paquets restent à couvrir par un humain ou Codex.

Paquets non couverts par la review sémantique

  • TRUST_ASSUMPTIONS.md — timeout (spawnSync ocr ETIMEDOUT)
  • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py — timeout (spawnSync ocr ETIMEDOUT)
  • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py — timeout (spawnSync ocr ETIMEDOUT)

Large Lean diff routed to bounded packet review: 11 Lean file(s), 1788 changed supported line(s). Multi-lens scout (3/4 lens(es): provenance, verification-independence, environment-determinism) surfaced 3/8 packet(s) for stronger review. Scout triage success; strong packet review required. Full-file OCR was not attempted.

✅ Posted 3 inline comment(s).

OCR pilot metrics & packet coverage

OCR pilot metrics

  • Routing: large-lean-hotspots (router-v10)
  • Changed files: 27 supported / 28 total; Lean 11, trust docs 3, workflow/scripts 9, contracts 2, docs 2
  • Changed lines: 1788 supported; thresholds large Lean >=3 files or >800 lines
  • OCR: status scout_triage; comments 3; files 3; tokens 0; tool calls 0; warnings 1; duration 2483s
  • Largest changed files: Contracts/VaultFromSolidity/Importer/Importer.lean (+594/-118), Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py (+269/-0), Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py (+242/-0), Contracts/SolidityImportSmoke/Modifiers/Modifiers.sol (+93/-0), Contracts/VaultFromSolidity/Importer/Syntax.lean (+78/-2)

Packet coverage

  • Packet review: enabled; selected 3/8 packet(s)
  • Scout: configured; status success; model builtin/assistant
  • Scout lenses: provenance, verification-independence, environment-determinism, proof-soundness (1 lens(es) failed; union of the rest used); rubric items checked 3
  • Strong review: required; status blocked_packet_input
  • Residual risk: Triaged top 3 scout-ranked packet(s); remaining changed hunks/files require Codex or human proof review, and selected packets still need strong reviewer analysis.
  • Strong packet-review blocker: OpenCodeReview 1.7.9 supports --from/--to full diff ranges, but this workflow does not have a safe packet/window input bridge for Lean hunks yet.
  • Covered packets:
    • TRUST_ASSUMPTIONS.md:62 score 94 [lenses: provenance, verification-independence, environment-determinism] — trust-boundary docs drift, changed imports; ask: Does registeredSources (as implemented, not as described) content-hash every artifact the kernel/proofs depend on—entry .sol, inherited bases, includes, and lakefile-wired smoke sources—or can an unlisted/swapped file be parsed without changing the manifest?
    • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py:1 score 74 [lenses: provenance, verification-independence, environment-determinism] — public declaration/signature changed, changed imports; ask: Exactly which bytes are hashed (file contents vs names/listings), and does failing to pin Importer.lean, lakefile wiring, inherited Solidity, and registeredSources allow a swapped or extra artifact to still pass?
    • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py:1 score 74 [lenses: provenance, verification-independence, environment-determinism] — public declaration/signature changed, changed imports; ask: Does this script’s checksum/manifest cover every input the structs proofs import, or only a subset such that an unlisted .sol or importer change would not invalidate the hash?

Pilot mode: advisory only. Codex Review remains the merge gate.

Comment thread TRUST_ASSUMPTIONS.md
in signatures; a public struct field registers one product getter; a storage
struct assignment binds the RHS pair once). Unknown executable constructs are
rejected; this is not general Solidity support. Multi-file units, packed
fields, events, and external calls remain out of the fragment.

This comment was marked as outdated.



if __name__ == "__main__":
main()

This comment was marked as outdated.



if __name__ == "__main__":
main()

This comment was marked as outdated.

Expr.pair evaluates amount then who, while pinned solc 0.8.33
evaluates named Acc({...}) args in source order. Fail closed on
reorder instead of binding by member order; keep positional Acc(a,b).
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

Pinned solc 0.8.33 evaluates Acc({who, amount}) args in call-site
order then packs uint256 × address. Expr.pairRev does that permute;
positional Acc(a, b) and Acc({amount, who}) stay Expr.pair.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OpenCodeReview first-pass review

🟡 Scout triage + 0/3 paquet(s) reviewés sémantiquement. 3 finding(s) (1 high / 2 medium); les hunks hors paquets restent à couvrir par un humain ou Codex.

Paquets non couverts par la review sémantique

  • TRUST_ASSUMPTIONS.md — timeout (spawnSync ocr ETIMEDOUT)
  • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py — timeout (spawnSync ocr ETIMEDOUT)
  • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py — timeout (spawnSync ocr ETIMEDOUT)

Large Lean diff routed to bounded packet review: 11 Lean file(s), 1860 changed supported line(s). Multi-lens scout (1/4 lens(es): environment-determinism) surfaced 3/8 packet(s) for stronger review. Scout triage success; strong packet review required. Full-file OCR was not attempted.

✅ Posted 3 inline comment(s).

OCR pilot metrics & packet coverage

OCR pilot metrics

  • Routing: large-lean-hotspots (router-v10)
  • Changed files: 27 supported / 28 total; Lean 11, trust docs 3, workflow/scripts 9, contracts 2, docs 2
  • Changed lines: 1860 supported; thresholds large Lean >=3 files or >800 lines
  • OCR: status scout_triage; comments 3; files 3; tokens 0; tool calls 0; warnings 1; duration 2483s
  • Largest changed files: Contracts/VaultFromSolidity/Importer/Importer.lean (+600/-118), Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py (+281/-0), Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py (+269/-0), Contracts/SolidityImportSmoke/Modifiers/Modifiers.sol (+93/-0), Contracts/VaultFromSolidity/Importer/Syntax.lean (+84/-2)

Packet coverage

  • Packet review: enabled; selected 3/8 packet(s)
  • Scout: configured; status success; model builtin/assistant
  • Scout lenses: provenance, verification-independence, environment-determinism, proof-soundness (3 lens(es) failed; union of the rest used); rubric items checked 3
  • Strong review: required; status blocked_packet_input
  • Residual risk: Triaged top 3 scout-ranked packet(s); remaining changed hunks/files require Codex or human proof review, and selected packets still need strong reviewer analysis.
  • Strong packet-review blocker: OpenCodeReview 1.7.9 supports --from/--to full diff ranges, but this workflow does not have a safe packet/window input bridge for Lean hunks yet.
  • Covered packets:
    • TRUST_ASSUMPTIONS.md:62 score 94 [lenses: environment-determinism] — trust-boundary docs drift, changed imports; ask: Does this determinism/no-cache trust claim still hold when lake is chosen via host Elan paths or PATH, and are solc version, LEAN_*/LAKE_* env, and .lake caches listed as changing what is kernel-checked?
    • Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py:1 score 74 [lenses: environment-determinism] — public declaration/signature changed, changed imports; ask: If the pinned Elan lake is missing, does this script still pass using an arbitrary PATH lake (and shared .lake/env), and what solc/Python/env overrides can make the structs importer check certify a different artifact than CI?
    • Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py:1 score 74 [lenses: environment-determinism] — public declaration/signature changed, changed imports; ask: Are modifiers_test.py and structs_test.py guaranteed to invoke the identical pinned lake/solc, or can env, PATH order, or leftover build cache make one slice verify while the other (or Vault import) is a different toolchain?

Pilot mode: advisory only. Codex Review remains the merge gate.

Comment thread TRUST_ASSUMPTIONS.md
member order, `Expr.pairRev` when they are `{who, amount}`; positional
`Acc(a, b)` stays AST/member order). Unknown executable constructs are
rejected; this is not general Solidity support. Multi-file units, packed
fields, events, and external calls remain out of the fragment.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 OCR scout — question de triage (non-review) [high]

Question de couverture pour le reviewer humain/Codex — pas une review sémantique finale ni une approbation.

Finding: TRUST_ASSUMPTIONS now asserts cache-free, environment-independent import (no generated Lean, no serialized AST cache, deterministic step / registeredSources). That claim is only as strong as the toolchain/runtime that elaborates the importer; it does not pin lake/solc/Python or forbid env-specific lake resolution used by the new smoke scripts.
Ask the reviewer: Does this determinism/no-cache trust claim still hold when lake is chosen via host Elan paths or PATH, and are solc version, LEAN_*/LAKE_* env, and .lake caches listed as changing what is kernel-checked?
Why flagged: trust-boundary docs drift, changed imports; 48 changed line(s) near TRUST_ASSUMPTIONS.md:62. Signals: trust-boundary docs drift, changed imports.
Added-line sample:

  • L62: The accepted fragment covers the existing Vault, the S1 inheritance slice, and
  • L63: the S2 modifiers/structs slice: full-width ′uint256′ scalars, ′address′ scalars,
  • L64: address-to-uint256 mappings and public getters, straight-line reads/writes,
  • L65: locals, checked addition/subtraction, comparison/custom-error guards (including
  • L66: ′address !=′ for ′onlyOwner′), same-file ′is′ bases with solc's C3



if __name__ == "__main__":
main()

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 OCR scout — question de triage (non-review) [medium]

Question de couverture pour le reviewer humain/Codex — pas une review sémantique finale ni une approbation.

Finding: Acceptance script resolves lake from machine-specific Elan paths (~/.elan/..., /var/lib/opencode/.elan/...) then falls back to shutil.which("lake"), so the kernel/toolchain that actually typechecks the structs slice is PATH- and host-dependent rather than strictly the repo lean-toolchain pin. Combined with os, tempfile, and subprocess, this can change which binary, LEAN_PATH, and .lake cache participate in the advertised check across local vs CI images.
Ask the reviewer: If the pinned Elan lake is missing, does this script still pass using an arbitrary PATH lake (and shared .lake/env), and what solc/Python/env overrides can make the structs importer check certify a different artifact than CI?
Why flagged: public declaration/signature changed, changed imports; 281 changed line(s) near Contracts/SolidityImportSmoke/Structs/scripts/structs_test.py:1. Signals: public declaration/signature changed, changed imports.
Added-line sample:

  • L1: #!/usr/bin/env python3
  • L2: """Acceptance checks for the Solidity importer structs slice."""
  • L3: (empty)
  • L4: import hashlib
  • L5: import os



if __name__ == "__main__":
main()

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 OCR scout — question de triage (non-review) [medium]

Question de couverture pour le reviewer humain/Codex — pas une review sémantique finale ni une approbation.

Finding: Duplicate lake_binary() override for the modifiers slice: same unpinned PATH fallback and CI-hardcoded toolchain directory. Two smoke gates can therefore bind to different lakes on the same machine, so “modifiers imported and proved” is not a deterministic function of the commit.
Ask the reviewer: Are modifiers_test.py and structs_test.py guaranteed to invoke the identical pinned lake/solc, or can env, PATH order, or leftover build cache make one slice verify while the other (or Vault import) is a different toolchain?
Why flagged: public declaration/signature changed, changed imports; 269 changed line(s) near Contracts/SolidityImportSmoke/Modifiers/scripts/modifiers_test.py:1. Signals: public declaration/signature changed, changed imports.
Added-line sample:

  • L1: #!/usr/bin/env python3
  • L2: """Acceptance checks for the Solidity importer modifiers slice."""
  • L3: (empty)
  • L4: import hashlib
  • L5: import os

set_spec now requires data_who, so dropping the address write fails
set_then_get. guarded_reverts_not_owner_before_pause pins NotOwner()
before EnforcedPause() when both guards would fire.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

@Th0rgal
Th0rgal merged commit 87aa890 into main Sep 21, 2026
19 of 21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant