test: close block-path reject coverage gaps (PRED-04) (#194)

Closes #181.

- block.rs: add the missing Requant tampered-output reject test — with it,
  every one of the 12 BlockOp variants rejects a bumped claimed output with
  the exact typed error and op_id (Linear/BatchedLinear via Freivalds, the
  exact-recompute ops via BlockOpMismatch). The accept half pins the
  hand-computed requant outputs (incl. the ties-to-even case).
- lewm_predictor.rs: the small-dims predictor accept tests now pin the exact
  24-element integer output vector instead of just is_ok + float tolerance,
  locking the quantized semantics (kernels, tables, scheme derivation,
  synthetic weights) end-to-end. Depth 1 and depth 6 pin the same vector:
  the AdaLN-gated block contributions shift the float reference by less
  than one f_ln quantization step (documented in the test).
- soundness_campaign.rs: add the range_check.modp_predictor mutant — the
  mod-p accumulator-aliasing forgery (out[0] += p) on a BatchedLinear
  accumulator, killed only by the block-path Freivalds range guard
  (asserts the typed AccumulatorRange, not just any rejection) — so the
  predictor/block path is merge-gated like the flat demo path. Campaign
  floor raised to 7 mutants.

Full workspace suite green (200 tests); real-dims predictor release test
unaffected and green.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: adrienlacombe

CHANGELOG.md

@@ -90,6 +90,15 @@ entry.
 
 ### Fixed
 
+- Closed the remaining block-path test-coverage gaps (#181): `Requant` was the
+  one `BlockOp` variant without a tampered-output reject test (all 12 now
+  reject a bumped claimed output with the exact typed error and `op_id`); the
+  small-dims predictor accept tests now pin the exact integer output vector
+  (not just `is_ok` + float tolerance), locking the quantized semantics
+  end-to-end; and the soundness mutation campaign gained a
+  `range_check.modp_predictor` mutant — the mod-`p` accumulator-aliasing
+  forgery on a `BatchedLinear` accumulator — so the predictor/block path's
+  Freivalds range guard is merge-gated like the flat demo path's.
 - The soundness mutation campaign registered no mutant for the `tensor_memory`
   (op-to-op wiring) component, so its merge gate passed vacuously; it now exercises
   a `WiringMismatch` mutant. The committed `requantize` golden fixture is now run

crates/pwm-testkit/src/lewm_predictor.rs

@@ -888,7 +888,7 @@ mod tests {
         }
     }
 
-    fn run(d: Dims) {
+    fn run(d: Dims) -> Vec<i64> {
         let c = build_predictor(d);
         let artifact = prove(&c).expect("prove");
         let out = verify(&artifact).expect("verify");
@@ -899,23 +899,42 @@ mod tests {
             err <= c.tolerance.expect("tolerance"),
             "float-vs-int error {err} exceeds tolerance"
         );
+        out
     }
 
+    /// The pinned integer output of the small synthetic predictor (#181): locks
+    /// the exact quantized semantics end-to-end — kernels, tables, scheme
+    /// derivation, and the deterministic synthetic weights. Any change to the
+    /// integer pipeline shows up as a diff here, not just as a tolerance drift.
+    /// Verified against the float reference within `SYNTH_TOLERANCE` by `run`.
+    const SMALL_DIMS_OUTPUT: [i64; 24] = [
+        20, 18, 27, -66, 25, -17, 21, -31, -24, -18, 14, -21, 4, -48, 44, 49, 18, -32, -36, -18,
+        31, -18, -8, 63,
+    ];
+
     #[test]
     fn small_dims_one_block_verifies() {
-        run(small());
+        assert_eq!(run(small()), SMALL_DIMS_OUTPUT);
     }
 
     #[test]
     fn small_dims_six_blocks_verify_within_float_tolerance() {
-        run(Dims {
-            d: 8,
-            s: 3,
-            h: 2,
-            dh: 4,
-            mlp: 16,
-            depth: 6,
-        });
+        // Pins the same vector as the one-block test: the AdaLN-gated block
+        // contributions at these synthetic weights shift the float reference by
+        // less than one `f_ln` quantization step, so blocks 2..6 do not move the
+        // final per-position LayerNorm off the depth-1 grid points (the float
+        // references differ — ~3e-3 — and both stay within tolerance).
+        assert_eq!(
+            run(Dims {
+                d: 8,
+                s: 3,
+                h: 2,
+                dh: 4,
+                mlp: 16,
+                depth: 6,
+            }),
+            SMALL_DIMS_OUTPUT
+        );
     }
 
     #[test]

crates/pwm-testkit/src/soundness_campaign.rs

@@ -15,12 +15,15 @@
 //! CI — the gate the green skeleton never provided.
 
 use pwm_core::audit::output_tensor;
+use pwm_core::block::{Block, BlockOp};
 use pwm_core::commit::claimed_output_commitment;
 use pwm_core::field::FREIVALDS_P;
-use pwm_core::fixed_point::{requantize, Rounding};
+use pwm_core::fixed_point::{requantize, BoundedInt, Rounding};
 use pwm_core::planning::verify_argmin;
+use pwm_core::tensor::Tensor;
 use pwm_core::trace::OpRecord;
-use pwm_verifier::{verify, VerifyError};
+use pwm_prover::prove_block;
+use pwm_verifier::{verify, verify_block, VerifyError};
 
 use crate::demo::prove_demo;
 use crate::mutation::{Mutant, MutationCampaign, MutationOperator};
@@ -81,6 +84,47 @@ fn modp_accumulator_rejected() -> bool {
     verify(&art).is_err()
 }
 
+/// True iff the mod-`p` accumulator-aliasing forgery on the **predictor/block
+/// path** (add `p` to a `BatchedLinear` accumulator) is rejected by the live
+/// block verifier with the typed range-guard error (#181). Freivalds checks
+/// congruence mod `p`, so without the operand range guard this forgery passes
+/// every challenge with probability 1 — the named-buffer analog of
+/// `range_check.modp_accumulator`. Requiring `AccumulatorRange` (not just any
+/// error) pins the rejection to the guard itself.
+fn modp_predictor_batched_rejected() -> bool {
+    // Identity 2x2 weight, two-row batched projection of [3,4],[5,6].
+    let data = [1i64, 0, 0, 1]
+        .iter()
+        .map(|&v| BoundedInt::new(v, -128, 127).expect("i8 weight"))
+        .collect();
+    let weights = vec![Tensor::new(10, vec![2, 2], 0, data).expect("2x2 tensor")];
+    let block = Block {
+        input_bufs: vec![0],
+        ops: vec![BlockOp::BatchedLinear {
+            op_id: 1,
+            weight_id: 10,
+            bias_id: None,
+            in_buf: 0,
+            out_buf: 1,
+            out: Vec::new(),
+            seq: 2,
+        }],
+        output_buf: 1,
+    };
+    let inputs = vec![(0u32, vec![3, 4, 5, 6])];
+    let Ok(mut proven) = prove_block(&block, &weights, &[], &inputs) else {
+        return false;
+    };
+    match &mut proven.ops[0] {
+        BlockOp::BatchedLinear { out, .. } => out[0] += FREIVALDS_P as i64,
+        _ => return false,
+    }
+    matches!(
+        verify_block(&proven, &weights, &[], &inputs),
+        Err(VerifyError::AccumulatorRange { op_id: 1 })
+    )
+}
+
 /// True iff breaking the op-to-op wiring is rejected (the `tensor_memory`
 /// component): bump a mid-trace record's first input cell while leaving the prior
 /// record's output intact, so the threaded running activation no longer matches.
@@ -130,6 +174,12 @@ impl MutationCampaign for SoundnessCampaign {
                 MutationOperator::DropConstraint,
                 "drop the Freivalds accumulator range guard: add p to an accumulator (mod-p aliasing)",
             ),
+            mutant(
+                "range_check.modp_predictor",
+                "range_check",
+                MutationOperator::DropConstraint,
+                "drop the block-path Freivalds range guard: add p to a BatchedLinear accumulator (mod-p aliasing on the predictor path)",
+            ),
             mutant(
                 "tensor_memory.break_wiring",
                 "tensor_memory",
@@ -166,6 +216,7 @@ impl MutationCampaign for SoundnessCampaign {
     fn is_killed(&self, mutant: &Mutant) -> bool {
         match mutant.id.as_str() {
             "range_check.modp_accumulator" => modp_accumulator_rejected(),
+            "range_check.modp_predictor" => modp_predictor_batched_rejected(),
             "tensor_memory.break_wiring" => wiring_tamper_rejected(),
             "requant.tamper_output" => tampered_op_rejected(|r| matches!(r, OpRecord::Requant(_))),
             "activation_lookup.tamper_output" => {
@@ -190,8 +241,8 @@ mod tests {
     fn soundness_campaign_kills_every_mutant() {
         let report = run_campaign(&SoundnessCampaign, &[]);
         assert!(
-            report.total >= 5,
-            "campaign must cover the soundness checks"
+            report.total >= 7,
+            "campaign must cover the soundness checks (incl. the predictor path)"
         );
         assert!(
             report.soundness_critical_survivors().is_empty(),

crates/pwm-verifier/tests/block.rs

@@ -884,3 +884,42 @@ fn reject_layernorm_out_of_range_shift() {
         Err(VerifyError::InvalidShift { op_id: 4 })
     ));
 }
+
+#[test]
+fn accept_and_reject_tampered_requant_output() {
+    // Requant was the one BlockOp variant without a tampered-output reject test
+    // (#181); with it, all 12 variants reject a bumped claimed output:
+    // Linear (reject_tampered_block_linear), BatchedLinear
+    // (reject_tampered_encoder_projection), MatMul/Softmax
+    // (reject_tampered_attention_scores, reject_tampered_elementwise_op_outputs),
+    // Activation/LayerNorm/Modulate/Gate (reject_tampered_elementwise_op_outputs),
+    // Add (reject_tampered_block_residual), Slice/Concat
+    // (reject_tampered_slice_and_concat), and Requant here.
+    let block = Block {
+        input_bufs: vec![0],
+        ops: vec![BlockOp::Requant {
+            op_id: 1,
+            in_buf: 0,
+            out_buf: 1,
+            out: vec![],
+            shift: 1,
+            zero_point: 0,
+            clamp_lo: -100,
+            clamp_hi: 100,
+            rounding: RND,
+        }],
+        output_buf: 1,
+    };
+    let inputs = vec![(0u32, vec![10, -7])];
+    // Hand-computed: 10 >> 1 = 5 exactly; -7/2 = -3.5, floor q = -4 with rem 1
+    // (= half), and the tie bumps to even: q + (q & 1) = -4.
+    let proven = prove_block(&block, &[], &[], &inputs).unwrap();
+    assert_eq!(
+        verify_block(&proven, &[], &[], &inputs).unwrap(),
+        vec![5, -4]
+    );
+    assert!(matches!(
+        tamper_op(&block, &[], &[], &inputs, 1),
+        Err(VerifyError::BlockOpMismatch { op_id: 1 })
+    ));
+}