test(wide_math): property-based algebraic coverage for U256/I256 and spec 4.6/4.8 helpers - #123
Conversation
…spec 4.6/4.8 helpers wide_math.rs implements 256/512-bit arithmetic by hand, twice (kani u128-pair mode and BPF u64-limb mode), with no external big-int crate to cross-check against. The in-module tests pin known values; nothing pinned the algebra under randomized inputs on the host build. New tests/wide_math_props.rs (proptest, ~13k random cases per run): - Ring identities: add/sub roundtrips, commutativity, saturating boundaries, Ord vs limbwise comparison. - Differential multiplication: checked_mul and the private U512 path behind the mul_div family are compared limb-by-limb against an independent 4x4 u64-limb schoolbook reference (a different decomposition than the u128-half implementation under test), including the exact overflow boundary. - Euclidean division: div_rem_u256 satisfies q*d + r == n with r < d, verified with the reference multiplier rather than the engine's own checked_mul. - Spec 4.6 floor/ceil duality: ceil == floor + remainder indicator across the U256 and u128 variants; signed floors agree with native i128::div_euclid on the shared domain (the unreachable-in-production (i128::MIN, d=1) guard boundary of the i128 variant is documented and excluded; the U256 variant is exercised on the full domain). - Spec 4.8 K-pair settlement: wide_signed_mul_div_floor_from_k_pair and wide_signed_mul_div_floor match a native i128 model on ranges where the product provably fits. - Deterministic edge pins: i128::MIN fee debt, I256::MIN negation, division at ONE/self/MAX, 2^255 shift boundary, checked quotient overflow. Gated on fork-facade (wide_math is only pub when the wrapper opts in); registered as a [[test]] target next to v16_fuzzing. Run: cargo test --features fork-facade --test wide_math_props Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Why
src/wide_math.rshand-rolls 256/512-bit arithmetic twice (Kani[u128;2]mode, BPF[u64;4]mode) with no external big-int crate to cross-check. Every haircut ratio, funding accrual, and ADL settlement flows through it. The in-module tests pin known values; nothing pinned the algebra under randomized inputs on the host build.What
tests/wide_math_props.rs(proptest, ~13k random cases per run, 17 test functions):Ordvs limbwise comparison.checked_muland the private U512 path behind themul_div_*family compared limb-by-limb against an independent 4x4 u64-limb schoolbook reference (deliberately a different decomposition than the u128-half implementation under test), including the exact overflow boundary.div_rem_u256satisfiesq*d + r == n,r < d, verified with the reference multiplier rather than the engine's ownchecked_mul.i128::div_euclidon the shared domain.wide_signed_mul_div_floor_from_k_pairandwide_signed_mul_div_floormatch a native i128 model on ranges where the product provably fits.i128::MINfee debt,I256::MINnegation, division at ONE/self/MAX, 2^255 shift boundary, checked quotient overflow.One boundary finding, documented in the test rather than changed:
floor_div_signed_conservative_i128(i128::MIN, 1)hits its out-of-range guard even though the final result is representable. Unreachable in production (engine callers divide byFUNDING_DEN/POS_SCALE>= 10^6); the U256 variant handles the point exactly and is tested on the full domain.Gated on
fork-facade(wide_math is onlypubwhen the wrapper opts in); registered as a[[test]]target next tov16_fuzzing.Run
Full suite with fork-facade: 151 passed, 0 failed. Default-feature suite unchanged.
🤖 Generated with Claude Code