# Assumptions and Trust Boundary

## Classification

This release is `NATIVE_ASSISTED`.

The public proof relies on:

- the Lean 4 kernel at `v4.30.0-rc2`;
- the mathlib revision pinned in `lake-manifest.json`;
- `propext`, `Quot.sound`, and `Classical.choice`; and
- Lean native-code evaluation for two explicitly identified Boolean checks.

There are no project-declared proof axioms, `unsafe` proof definitions,
`admit`, or unproved `sorry` placeholders in the proof library.

## Native Finite Checks

The public dependency cones contain exactly:

```text
k18Gamma901EncodedCertificate_check._native.native_decide.ax_1_1
k18AdaptiveForcedPotentialCertificate_check._native.native_decide.ax_1_1
```

The first checks all `129,140,163` exact level-18 LP rows. The second checks
all `215,233,605` adaptive-potential inequalities. Payload syntax and lengths
are also checked in Lean.

Independent Python and C++ implementations replay both complete payloads.
The adaptive C++ verifier deliberately changes one potential entry and rejects
the mutated certificate. These checks are corroborating audit evidence, not a
replacement for the native-decision dependencies.

## Explicit Nonassumptions

The package does not import `FormalConjectures`, assume the Collatz conjecture,
or depend on `CollatzConjecture.collatz_conjecture`.

## Statement/Proof Split

`Challenge.lean` defines the target vocabulary directly from Mathlib.
`ComparatorChallenge.lean` restates the targets over the finite-certificate
vocabulary required by comparator. `Solution.lean` imports the checked proof.