autodiff: AD-OPERATOR-1 — operator tangents + the H3 well-posedness certificate - #597

AD-OPERATOR-1 — operator tangents + the H3 well-posedness certificate

The next AUTODIFF_NEXTGEN slice (§7, ~2w item, independent of the jet lane). One commit, three pieces:

OperatorTangent (autodiff/operator.py)

implicit.py's local matvec pattern promoted to a type (plan §3.5): a matrix-free linear map with composition as the operator product, .T as an involution, and solve-consumption — instances are callable, so cg_solve/gmres_solve take an operator anywhere they took a bare closure. A forward-only operator refuses .T rather than silently finite-differencing an adjoint. The Decision #31 relationship to the materialized @f__bwd ABI (one production lowering, one declared unmaterialized twin) is recorded in the module docstring, next to the type.

implicit.py refactored, behavior-identical

ihvp (declared-self-adjoint Hessian operator into CG), root_vjp (the (−Bᵀ)∘A⁻ᵀ chain through the type's own transpose), root_jvp, adjoint_state_grad, and the dense oracle via operator.materialize(). All 54 pre-existing implicit/solver-IFT tests pass unchanged — they are the regression net the plan names.

H3: the strict-complementarity / well-posedness certificate

CORE_SUBSTRATE_VIEW.md S8's previously unowned "one fix, three consumers" item (game theory, Riemannian-OT, S-series). certify_root measures the IFT hypothesis at a claimed root instead of assuming it: the point is actually a root (scaled residual tolerance) and ∂ₓF is non-degenerate (σ_min > tol·σ_max — for KKT-form residuals, exactly what strict complementarity guarantees). custom_root gates differentiation on it by default, in both the convenience methods and the tape path:

• a degenerate root rejects with the measured numbers (σ_min/σ_max/condition) instead of returning an ill-posed gradient;
• a non-root rejects on the residual;
• an unevaluable check fails closed (non-finite residual/Jacobian is an error, never a pass);
• certify=False is an explicit opt-out, and solver.certificate(x*, params) exposes the record itself (S4: numbers, not booleans).

Acceptance (tests/unit/test_operator_tangent.py, 13 tests)

Operator-level adjoint law ⟨Av,u⟩=⟨v,Aᵀu⟩ through the type's own transpose including a falsifiability control (an operator with a wrong declared adjoint fails the pairing); involution + (AB)ᵀ = BᵀAᵀ; fail-closed edges; solve consumption; certificate positive/negative fixtures (clean √θ root with measured σ_min = 2√2; degenerate x²−θ at θ=0; singular 2×2 system); tape-backward rejection at a degenerate root.

Gauss–Newton / Newton–Krylov compositions are the named future consumers — no such op exists in-tree yet, and inventing one would be Decision #29 in reverse.

Verification (Strix Halo box)

27 implicit+operator tests, 571-test autodiff regression net, ruff + mypy clean, generated docs in sync. Full CI-equivalent suite: 16,161 pass; the failing set is file-for-file the known pre-existing environmental baseline (Apple-lane tests vs this box's non-Apple tessera-opt, which CI skips + the pre-existing gfx1151 provenance assert), with the two known xdist-flaky dashboard tests re-verified green in isolation.

🤖 Generated with Claude Code