[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-paradigm-verifiable-compiler":3,"mdc--sil5s4-key":34,"related-org-paradigm-verifiable-compiler":2336,"related-repo-paradigm-verifiable-compiler":2344},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"verifiable-compiler","build formally verified compilers in Lean","Use when the user wants Codex to build or make sustained progress on an end-to-end formally verified compiler in Lean.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"paradigm","Paradigm","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fparadigm.png","paradigmxyz",[13,17,20],{"name":14,"slug":15,"type":16},"Mathematics","mathematics","tag",{"name":18,"slug":19,"type":16},"Codex","codex",{"name":21,"slug":22,"type":16},"Engineering","engineering",22,"https:\u002F\u002Fgithub.com\u002Fparadigmxyz\u002Fsolidus","2026-07-26T06:08:53.04782",null,11,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Beat a formally verified Yul → EVM compiler on total gas — while its machine-checked correctness theorem still proves.","https:\u002F\u002Fgithub.com\u002Fparadigmxyz\u002Fsolidus\u002Ftree\u002FHEAD\u002Fskills\u002Fverifiable-compiler","---\nname: verifiable-compiler\ndescription: \"Use when the user wants Codex to build or make sustained progress on an end-to-end formally verified compiler in Lean.\"\n---\n\n# Verifiable Compiler\n\nUse this skill for Lean-first verified compiler work. The primary artifacts are\nLean definitions, compiler functions, semantics, relations, and checked\ntheorems. Tests, fixtures, docs, and external tools are support\nevidence only.\n\nThe default shape is: start near\nthe target, add one semantic abstraction layer at a time, prove the adjacent\nlowering completely for the source language in scope, then move up.\n\n## Start Or Resume\n\n1. Inspect local state before planning:\n   - `git status --short` (if this is not a git repo, initialize with a commit);\n   - `lakefile.lean`, `lean-toolchain`, root modules, theorem files, tests, and\n     recent build scripts;\n   - `ROADMAP.md` and `PROGRESS_LOG.md`, if present.\n2. Call `get_goal`. If no active goal exists, create one whose objective\n   matches the user's concrete request in this turn. For sustained build\n   requests, include the requested compiler scope and the end-to-end theorem\n   standard. For narrower work, keep the objective scoped to that audit,\n   proof-debugging, refactor, architecture review, skill edit, or pass-specific\n   task.\n3. When starting or resuming sustained verified-compiler work, say explicitly\n   that this workflow is using `$verifiable-compiler`, and remind the user\n   that future continuation requests should mention `$verifiable-compiler`.\n   Do this at start\u002Fresume or handoff, not in every status update.\n4. Use exactly two project docs by default:\n   - `ROADMAP.md`: sparse checklist and current public spine.\n   - `PROGRESS_LOG.md`: flat timestamped log of proofs, tests, bottlenecks,\n     architecture risks, deletions, and status.\n5. Every time the agent restarts from conversation compaction, append a short\n   timestamped `PROGRESS_LOG.md` entry before continuing, including for narrow\n   follow-up tasks. Name it as a compaction resume, summarize the current\n   objective\u002Fcheckpoint in one sentence, and keep it concise.\n6. Do not create feature matrices, trust ledgers, design histories, or incident\n   reports unless the user asks. If legacy docs exist, read them as context but\n   do not keep adding synchronized truth there.\n\n## Git Checkpoints\n\n- Commit verified checkpoints as you go. After a meaningful theorem, boundary\n  cleanup, refactor, or audit passes its relevant build\u002Faxiom checks, create a\n  focused git commit before starting the next substantial proof thread.\n- Keep commits honest: include only project files that belong to the verified\n  checkpoint, and mention the Lean build or axiom audit that passed. Do not\n  commit huge build logs, scratch outputs, or unrelated generated clutter.\n- If the user says all current work belongs to the agent, treat the dirty tree\n  as owned work for staging purposes, while still keeping commits coherent and\n  avoiding accidental inclusion of temporary logs or secrets.\n\nFor a broad build request, the goal is not complete until concrete Lean theorem\nstatements connect every source-language feature in scope to the declared target\ninterpreter. Do not silently reinterpret a request for a source language as a\nrequest for a convenient accepted fragment.\n\nFor any active goal that asks to complete a layer or compiler pass, do not stop\nwhile the public theorem still takes compiler-generated evidence as an\nunproved input. Treat these as blockers, not residual assumptions: generated\nlayout records, compilation certificates, replay certificates, whole-program\ncall or callee-preservation obligations, return-layout obligations, generated\nlabel\u002Ftoken uniqueness tables, and proof-carrying emitted-code segments. It is\nacceptable to expose fundamental semantic or resource premises such as source\nacceptedness, input run\u002Fevaluation, initial-state relation, fuel\u002Fgas bounds, or\nexplicit code-size\u002Fno-overflow bounds, but any compiler artifact that can be\ncomputed from the source program must either be constructed by a checked Lean\ntheorem or remain an explicitly unfinished goal.\n\n## Theorem-Truth Checks\n\nBefore major proof grinding, check whether the theorem is true as quantified.\nTry to find small counterexamples involving arbitrary target PC, fuel-zero\nstates, stack height, static-context restrictions, gas observations, external\ncalls, revert\u002Ferror outcomes, and unsupported source constructs.\n\nIf a target fact is only true for traces produced by accepted source programs,\nstate it over those actual traces or derive it from source-facing premises. Do\nnot keep a globally quantified target premise just because it is convenient for\nthe proof.\n\nWhen a theorem is false or overbroad, fix the statement before adding wrappers,\ncompatibility lemmas, or local heartbeats. Record the correction in\n`PROGRESS_LOG.md` as `theorem-boundary`, `deletion`, or `architecture-risk`.\n\nOnce the project freezes its public specification — hash-pinned theorem\nstatements, a frozen-closure checker, or a challenge\u002Fscoring regime that\nmeasures rewrites against a fixed theorem — this workflow changes mode. A\nfrozen statement is an immutable interface: do not restate, weaken, or\n\"improve\" it, even when the boundary looks fixable; rewrites and\noptimizations must reprove the exact frozen statement. If a frozen statement\nturns out to be false or overbroad, that is a project-level incident — report\nit and get an explicit unfreeze decision from the user instead of editing\naround it. Run the project's freeze gates (hash and closure checks) alongside\nthe usual build and axiom audits before calling any change complete.\n\n## No Unproven Compiler Paths\n\nDo not introduce, wire in, or commit an unproven path that emits compiler output\nor deployable bytecode. This includes paths named `unchecked`, `unsafe`,\n`artifact-only`, benchmark-only, fallback, fast path, or executable shortcut.\nIf such a path is used by the compiler, bytecode\u002Fartifact generation, bridge\nrunner, benchmark harness, or user-facing validation, it must either be the\nchecked theorem path or have a Lean theorem proving equality\u002Frefinement to the\nchecked theorem path, with an axiom audit showing only standard Lean axioms.\n\nExecutable variants are allowed only when a checked equality\u002Frefinement\ntheorem connects them to the proof-facing definition, and all\ncallers that emit bytecode can be transported back to the public preservation\ntheorem through checked lemmas. Existing unproven output paths are blockers to\nremove, prove equivalent\u002Frefining, or quarantine as non-compiler diagnostics;\ndo not commit new work that relies on them.\n\n## Core Strategy\n\nBuild a target-up semantic tower, one complete layer at a time:\n\n1. Choose or define the declared target interpreter and observation model.\n2. Define the lowest useful layer above that target.\n3. Add exactly one real semantic abstraction in the next higher layer.\n4. Give that layer syntax, semantics, wellformedness\u002Facceptance, a relation to\n   the lower layer, compiler\u002Flowering, and preservation theorem. You can add slices\n   to that layer one at a time, but the layer needs to be feature-complete,\n   not a toy version of the language, before moving on. Its feature set should\n   cover the whole abstraction that belongs at that layer and, as far as possible\n   before higher abstractions exist, match how that feature works in the source\n   language being targeted.\n   The semantics must be an independent interpreter or evaluation relation over\n   that layer's own syntax. Defining the layer's run\u002Feval as \"lower\u002Fcompile this\n   program, then run the lower layer\" is not a valid source semantics, except for\n   an explicitly named transparent adapter boundary with no new source constructs\n   and a recorded audit note.\n   The semantics must also abstract the feature this layer introduces. Do not\n   define a new source construct by exposing the lower representation it is meant\n   to hide. For example, a locals\u002Fframe layer should have a named-environment\n   source semantics; stack slots, layout depths, swaps, pops, or frame encodings\n   belong in that layer's compiler\u002Flowering relation and proof, not in the\n   source interpreter used by higher layers.\n5. Compose the new theorem into the public spine.\n6. Run a brief theorem-boundary checkpoint before moving on.\n7. Only then add the next layer.\n\nExample of good abstraction steps include labels over byte offsets, structured control over\njumps, locals\u002Fframes over stack slots, expressions over primitive stack code,\nfunctions over entry labels, or objects\u002Fmodules over flat functions.\n\nBad layers are story-shaped features (`let-if-assign-return`), parser fixtures,\none-off combinations (`if` inside `for`), or helper representations with no\nindependent semantic contract.\n\nBefore implementing a broad layer, run this checklist. This is a thinking\ncheckpoint, not a request to create new documents:\n\n- Grammar frozen: every construct in scope is named, and every tempting\n  construct out of scope is explicitly excluded.\n- Prior art checked: inspect the existing lower layer, adjacent completed\n  layers, and any sibling worktree or earlier implementation the user points to\n  before inventing a new proof route. Reuse proven theorem shapes when they\n  fit; record why they do not if you diverge.\n- Semantics frozen: outcomes, errors, effects, divergence\u002Ffuel behavior, and\n  observable state are clear for the accepted subset.\n- Theorem-truth checked: known counterexample shapes such as arbitrary PC,\n  fuel-zero target states, stack\u002Fresource exhaustion, static context, gas\n  observability, and external effects have been ruled out or reflected in the\n  theorem boundary.\n- Interpreter independence checked: `run`\u002F`Eval` is not merely lower-layer\n  execution after compiling\u002Felaborating the source; any exception is an explicit\n  transparent adapter boundary, not a completed compiler layer.\n- Abstraction boundary checked: the layer's source semantics hides the lower\n  representation that its new feature abstracts. Any proof terms, layouts,\n  slots, continuations, frame encodings, return tokens, cleanup code, or other\n  lower-level machinery needed to implement the feature live in the compiler\n  and preservation proof, not in the source interpreter or the interface used by\n  higher layers.\n- Lower capabilities pass through: the layer does not silently shrink the\n  already-verified lower language surface.\n- Accepted restrictions classified: every nontrivial `Accepted`\u002F`WF` predicate\n  is checked against the requested scope. An explicit predicate name is not by\n  itself a justification; if it excludes lower-layer behavior because the proof\n  route or representation is unfinished, keep the layer incomplete unless the\n  user explicitly narrowed the language.\n- Public theorem sketched: adjacent theorem and composed theorem have the right\n  shape before helper proofs begin.\n- Proof interface sketched: layout, freshness, state relation, continuation,\n  resource, or environment assumptions are bundled when they are conceptually\n  one invariant.\n- External\u002Fresource boundary classified: gas, fuel, code size, stack depth,\n  static-context restrictions, storage\u002Faccount state, and external responses\n  are either modeled by source semantics, rejected by acceptance, or exposed as\n  explicit source-facing premises.\n- Temporary scaffolds named: replay\u002Fcertificate\u002Fhelper routes have a planned\n  replacement theorem or are kept private.\n- Public certificate boundary checked: if a theorem still takes a compiler\n  certificate, layout witness, replay witness, proof-carrying emitted-code\n  segment, or generated-label table as an input, do not call the pass complete\n  unless that certificate is itself generated by a checked compiler theorem or\n  the user explicitly accepted it as a trusted input format.\n- No public call oracle: for recursive source features, the public theorem must\n  not take an all-callees-preserve, all-functions-preserve, replay, or call\n  obligation premise. Discharge those obligations by source-fuel, evaluation,\n  or well-founded induction, leaving only explicit resource bounds or source\n  acceptedness assumptions at the public boundary.\n- Public theorem grep: before declaring success, search the public spine for\n  names like `Certificate`, `CompilationCertificate`, `Replay`, `Obligation`,\n  `ProcPreserves`, `Layout`, `Evidence`, `CallPreserves`, and project-specific\n  certificate names. Any remaining public occurrence must be either generated by\n  a checked constructor theorem or justified as a fundamental resource\u002Finput\n  premise in the audit entry.\n\n## Source-Language Completeness\n\nWhen the user asks for a verified compiler for a named source language or layer,\nthe default obligation is the complete semantics of that source language layer.\n`Accepted`\u002F`WF` may reject malformed, ill-scoped, ill-typed, or otherwise\nsemantically invalid programs, but it must not reject implemented source\nconstructs merely because they are proof-inconvenient unless the user explicitly\napproved a fragment.\n\nBefore marking such a goal complete:\n\n1. Inventory the source grammar against the source semantics and compiler.\n2. For every construct, record one status: supported and covered by the theorem;\n   semantically invalid and rejected by WF\u002FAccepted; or explicitly out of scope\n   by user-approved fragment boundary. Apply the same classification to every\n   `Accepted`\u002F`WF` field, not only to syntax constructors.\n3. If the source is a named external or imported language, name the exact\n   reference semantics being targeted and require a checked theorem from that\n   semantics to the compiler source semantics; elaboration through the compiler\n   is not enough by itself.\n4. Confirm the source semantics is an independent interpreter or evaluation\n   relation over the source syntax. If `run`\u002F`Eval` delegates through `compile`,\n   `lower`, `elaborate`, `toLower?`, or similar, the layer is incomplete until\n   it has its own semantics and a checked equivalence\u002Fpreservation theorem, or\n   the user explicitly accepts it as a transparent adapter boundary.\n5. Check that supported constructs include all outcomes their source semantics\n   admits, including errors, halts, resource failures, divergence\u002Ffuel behavior,\n   traces, and external observations claimed by the theorem.\n6. Confirm theorem statements quantify over the real source semantics, not only\n   over a compiler-success witness or replay certificate.\n7. If any source construct is missing semantics or theorem coverage, keep\n   working or report a blocker; do not call the compiler fully verified.\n\nAdd this source-language audit as its own `audit` entry in `PROGRESS_LOG.md` at\nmajor layer boundaries and before declaring an end-to-end theorem complete.\n\nShare source and target components where this reduces real proof burden:\nvalues, arithmetic, memory\u002Fstorage models, errors, traces, environments, and\nexternal state. Do not share away the compiler obligation. Source and target\ncontrol semantics, layout, resource assumptions, and observations must remain\nexplicit.\n\nIt is valid for shared primitive operations to pass through the same semantics\nacross many layers when they are not the abstraction being introduced by that\nlayer. For example, arithmetic, hashing, memory\u002Fstorage operations, and\nexplicitly shared external effects may reuse the same primitive meaning all the\nway up to the source language. That exception does not apply to a feature whose\npurpose is to hide a lower representation: locals should hide stack slots,\nstructured control should hide jump encodings, functions should hide\nreturn-token\u002Fframe conventions, and so on.\n\n## Boundary Checkpoints\n\nAt major semantic pass boundaries, pause briefly before moving upward:\n\n1. Name the adjacent preservation theorem and the composed public spine theorem.\n2. Confirm syntax, semantics, acceptance\u002FWF, lowering, relation, and\n   observation\u002Foutcome model exist for the accepted feature set.\n3. Check for silent narrowing: `Accepted`\u002F`WF` predicates must not exclude\n   supported behavior only because the proof route is unfinished.\n4. Check for theorem-boundary leaks: public theorem statements should not expose\n   lower representation details, generated certificates, replay witnesses, or\n   stale compatibility routes unless those are explicitly trusted inputs.\n5. Run the narrowest meaningful build, and `#print axioms` or the local\n   equivalent for public theorem(s) when practical.\n6. Record one concise `audit` entry in `PROGRESS_LOG.md` with theorem names,\n   command run, axiom result, and any remaining assumptions or unsupported\n   behavior.\n\nIf the checkpoint finds a shortcut, stale public route, or accepted feature\noutside theorem coverage, fix it, explicitly narrow the layer with the user, or\nreport the blocker.\n\n## External Effects And Resources\n\nFor external effects such as calls, chain state, storage, balances, precompiles,\nor environment responses, default to an open request\u002Fresponse protocol at the\ncompiler theorem boundary. Concrete world simulation is useful only when the\ntheorem is explicitly about that world model.\n\nFor resource-sensitive behavior such as gas, fuel, stack limits, code-size\nlimits, static context, memory growth, or no-overflow obligations, prefer\nsource-facing premises and actual-trace lemmas. A target-side runtime fact is\nacceptable only when it is derived from the accepted source run, the checked\ncompiler output, and explicitly named resource bounds.\n\nIf a source primitive observes target resource state directly, either include\nthat observation in the source semantics and prove it end to end, or reject the\nprimitive in the accepted language. Do not patch it with future-answer or replay\noracles in the main public theorem.\n\n## Preservation Shape\n\nThe main public theorem for an adjacent pass is a same-observation theorem.\nReplay certificates, traces, and local simulations are proof machinery; they\nshould not be the public theorem boundary once the layer is stable.\n\nUse this shape, adapted to local names:\n\n```lean\ntheorem compile_sound\n    (hWF : Hi.WF program)\n    (hCompile : Hi.compile program = lower)\n    (hEval : Hi.Eval program initial obs)\n    (hRel : StateRel initial lowerInitial) :\n    Exists fun lowerObs =>\n      And (Lo.Eval lower lowerInitial lowerObs) (ObsRel obs lowerObs) := by\n  ...\n```\n\nWhen both semantics are executable and deterministic, this may be an equality\ntheorem over `run`; when the layer erases representation details, use `ObsRel`.\nThe important claim is that the lower semantics has the same observable program\nresult, not merely that some hand-written replay witness exists.\n\nPrefer strengthened, compositional theorem statements from the beginning.\n\nLean theorem boundaries matter. If witness data is derived from a `Prop`\nrelation such as a source run, evaluation derivation, or preservation theorem,\nthe public result should usually expose `∃` or `Nonempty` evidence. Do not make\nthe public route depend on returning an arbitrary structure in `Type` unless\nthat structure is produced by computation or is passed in as explicit data.\n\nFor expression-like code generation, use an arbitrary continuation\u002Fsuffix:\n\n```lean\ntheorem compile_correct_aux (e : Expr) (k : Code) (s : Stack) :\n    run (compile e ++ k) s = run k (eval e :: s) := by\n  induction e generalizing k s with\n  | ... => ...\n```\n\nFor statement\u002Fcontrol layers, generalize this idea. Use whichever local shape\nmatches the layer:\n\n- arbitrary code suffix;\n- continuation or defunctionalized continuation;\n- evaluation\u002Fcontrol context;\n- entry\u002Fdestination labels;\n- layout and no-wrap assumptions;\n- state relation at an exact target PC, such as `RelAt`;\n- outcome relation for normal return, halt, revert, throw, break\u002Fcontinue, or\n  other abrupt exits.\n\nThe public proof route should be structural: sequence, context, branch, loop,\ncall, frame\u002Flayout, and outcome lemmas compose into the same-observation theorem.\nIf theorem names start encoding whole programs or feature combinations, stop and\nreplace them with generic recursive\u002Fcompositional theorems.\n\nIf a proof is becoming a long run of nearly identical constructors or opcodes,\npause before continuing. Look for a semantic-family classifier, pass-through\nlemma, source syntax traversal, or relation-preservation theorem that proves the\ncommon case once and leaves only genuinely distinct cases as wrappers.\n\nIf several consecutive changes add wrappers, adapters, callbacks, bridge\naliases, or compatibility routes without shrinking the public assumptions, stop\nand inspect the theorem boundary. Usually the right next patch is deletion or\nrestatement, not another adapter.\n\nAfter a few helper lemmas for a new construct, inspect the next theorem\nstatement. If it needs many independent PC, label, freshness, layout, resource,\nor environment premises, introduce a small structure or relation that names that\ninterface. Long premise lists are usually missing abstraction, not proof\nprogress.\n\nWherever feasible, derive full preservation proofs from accepted source runs;\ntreat assumed replay\u002Fcertificate witnesses as temporary scaffolding, not the\npublic theorem boundary.\n\nCompiler-generated evidence is not a fundamental assumption. Before declaring a\nlayer done, try to prove a checked constructor for every public certificate:\nlayout, freshness, label resolution, call-site table inclusion, PC-fit, typed\ncontinuation boundary, and compiler-output equality. If construction is not yet\nproved, the layer is not complete; log the missing constructor and keep working\nor explicitly report the blocker.\n\nDo not hide unfinished compiler evidence inside source acceptance. `Accepted`\nmay bundle source wellformedness, source semantic safety, checked resource\nlimits, or user-approved trusted-input contracts, but it must not contain a\ncompiler-generated layout, replay witness, call-site table, label-resolution\nproof, procedure-body preservation proof, or semantic call oracle unless the\nskill user explicitly chose proof-carrying source input as the trusted source\nformat. If a preservation theorem needs such evidence, either generate it with\na checked compiler theorem or keep the layer incomplete.\n\nFor recursive source features such as procedure calls, function calls,\nrecursive loops expressed through fuel, or mutually recursive declarations, the\ndefault discharge route is induction on source fuel or on the relational\nevaluation derivation. Do not replace this with an assumed \"all callees\npreserve\" oracle. If a temporary all-callee\u002Fcall obligation is introduced, keep\nit private, give it a fuel-bounded replacement plan immediately, and do not\nreport the layer complete until the public theorem derives it.\n\nAvoid brittle fusion lemmas. A lemma about `if` inside `loop`, `switch` inside\n`for`, or assignment plus branch plus return is not a milestone unless it is a\nprivate stepping stone being replaced immediately by generic `seq`\u002F`if`\u002F`switch`\n`loop`\u002F`outcome` composition. If a fused lemma remains useful, log it as a\n`shortcut` or `architecture-risk` and keep it out of the public spine.\n\nCPS is a tool, not a mandate. Raw higher-order continuations can make Lean\nterms huge. Prefer a small continuation\u002Fcontext interface that keeps compiled\nprograms folded and lets induction hypotheses apply under arbitrary suffixes.\n\n## Accepted Subsets\n\nFull preservation means full semantics for the accepted subset, but an accepted\nsubset is allowed only when the user requested a fragment or when the source\nlanguage definition itself is intentionally smaller than its parser or host AST.\nIf the user asks for a compiler for the whole source language, the accepted\nsubset must be source-complete except for malformed or semantically invalid\nprograms.\n\nDo prove all relevant outcomes of accepted programs: success, errors, halts,\nresource failures, traces, divergence\u002Ffuel behavior, and external observations\nthat the theorem claims to model.\n\nDo not prove only the terminating happy path unless the theorem name and\naccepted checker explicitly say that is the claim. Unsupported behavior should\nbe rejected by `Accepted`\u002F`WF`, guarded by explicit theorem assumptions, or\ncalled executable-only.\n\nKeep these notions separate:\n\n- parser\u002Fdecoder success;\n- semantic acceptance or wellformedness;\n- compiler success;\n- certificate checking;\n- target execution success.\n\nAccepted input must not mean \"the compiler returned `some`.\" Compiler-success\ntheorems are useful, but they are weaker than accepted-input theorems.\n\n## Lean Blowup Rules\n\nTreat timeouts and heartbeat explosions as architecture feedback, not merely\ntactic problems.\n\nDo not let Lean normalize whole compiled programs as a proof strategy.\n\n## Context Hygiene\n\nPreserve context for theorem state, not logs or repo tours:\n\n- Before every read, search, or build, name the narrow question it should\n  answer; avoid fresh \"getting bearings\" sweeps after a handoff identifies the\n  next target.\n- Keep build output out of context: redirect noisy `lake build` logs to `\u002Ftmp`\n  and inspect only `error:` lines plus the smallest needed neighborhood.\n- Scope searches tightly. Prefer module-specific `rg`, `rg -n -m`,\n  `rg --files`, `git diff --stat`, and short line windows; broad repo-wide\n  `rg`, full diffs, generated-file searches, and wide `sed` ranges are last\n  resorts.\n- On resume, trust the latest handoff\u002Fprogress log unless a specific line must\n  be checked.\n- After any large tool output, retain only theorem names, file\u002Fline pointers,\n  failing goals, and the concrete next patch.\n\nPrefer:\n\n- structural lemmas over syntax\u002Fcontrol contexts;\n- one-step semantic interface lemmas;\n- semantic classifiers for large opcode\u002Foperator families;\n- small public wrapper theorems around imported or recursive definitions;\n- explicit state\u002Flayout relations instead of massive record equalities;\n- named intermediate definitions to share structure;\n- `simp only [...]` with local simp sets;\n- controlled unfolding of one definition at a time;\n- narrow module builds: `lake build Module.Name` or `lake env lean path\u002FFile.lean`.\n- recursive theorem families whose structurally decreasing syntax argument comes\n  early in the argument list, with `termination_by` added before the proof grows.\n\nAvoid:\n\n- broad `simp_all` over compiler and interpreter definitions;\n- unfolding imported dispatchers across many constructors;\n- one theorem that case-splits over a large instruction set and tries many\n  `first | change ...` branches;\n- exposing large recursive compiler definitions as global simp rules;\n- proof terms that inline every compiled instruction or generated label;\n- broad imports in theorem files;\n- adding local heartbeats before checking whether the theorem\u002Finterface shape is\n  wrong.\n- continuing a proof whose statement has become a page of plumbing. Bundle the\n  invariant and prove the compiler supplies it.\n\nWhen widening primitive operations, classify by semantic family or require a\nsmall proof-carrying\u002Faccepted primitive interface. Prove PC\u002Fresource\u002Fstate\ninsensitivity once per family, then use a one-line wrapper per constructor. Do\nnot ask Lean to rediscover the same dispatcher facts for every opcode.\n\n## Primitive Classifiers\n\nFor large primitive or opcode surfaces, introduce a small semantic-family API\nbefore broadening the source layer. This API should be a proof boundary, not a\nsecond unverified semantics.\n\n\n## Documentation And Logs\n\nCode and theorem statements are the source of truth. Before reporting status,\ninspect the actual theorem names, statements, public imports, and build output.\n\n`ROADMAP.md` should stay sparse:\n\n```markdown\n# Roadmap\n\n## Public Spine\n\nAccepted AST -> LayerA -> LayerB -> Target interpreter\n\n## Next Layer\n\n- [ ] Interface: syntax, semantics, WF, relation\n- [ ] Theorem-truth check and external\u002Fresource boundary\n- [ ] Complete source-faithful feature set for this layer\n- [ ] Lowering function\n- [ ] Adjacent same-observation theorem\n- [ ] Composed public theorem\n- [ ] Boundary checkpoint\n```\n\n`PROGRESS_LOG.md` is append-only and flat:\n\n```markdown\n- 2026-05-12 18:17:26 - proof - proved `CompilerPreservation.block` and `compile_whole_program_sound_of_run`; command `lake build`; result green.\n- 2026-05-12 18:20:00 - architecture-risk - primitive widening proof unfolds full opcode dispatcher; replace with semantic family interface before adding more ops.\n```\n\nUse tags such as `proof`, `test`, `audit`, `bottleneck`,\n`theorem-boundary`, `architecture-risk`, `shortcut`, `consolidation`,\n`deletion`, and `incident`. For risks and shortcuts, name the artifact, why it\nis risky, and the generic theorem\u002Finterface that should replace it.\n\nKeep logs current, not just append-heavy. When a bottleneck, shortcut, or risk\nis resolved or superseded, add a short entry saying so and name the replacing\ntheorem or interface. Do not leave stale warnings that still read as active.\n\n## Git Preservation\n\nUse git to preserve meaningful theorem-bearing states. Commit only coherent\nmilestones, preferably green:\n\n- initial Lean package setup;\n- first target-reaching theorem;\n- new public layer or theorem boundary;\n- accepted-language\u002Ftheorem-boundary change;\n- byte encoder or real-machine bridge;\n- deletion of obsolete fixture\u002Fstory routes;\n- audited stable proof milestone.\n\nNever revert user changes. Before pausing or finishing substantial work, run\n`git status --short` and make the handoff state clear.\n\n## Anti-Patterns\n\nStop and repair the architecture if any of these appear:\n\n- full high-level language first, proofs later;\n- theorem ends at an IR while the claim says end-to-end;\n- special theorems for `if` inside `loop` or other combinations;\n- fused feature lemmas become public proof routes instead of temporary private\n  scaffolding;\n- parser helper recognizes a whole story instead of independent constructs;\n- semantic classifier or helper interpreter used as if it were the real target\n  without an equality\u002Frefinement theorem;\n- source semantics changed to match a compiler bug;\n- broad public imports retain obsolete compiler routes;\n- concrete external-world simulation is used where an open protocol is the real\n  theorem boundary;\n- observed target resources such as gas are patched by replay\u002Ffuture-answer\n  oracles instead of source semantics, acceptance rejection, or explicit\n  source-facing premises;\n- wrapper, adapter, callback, or compatibility-route churn continues without\n  reducing public assumptions;\n- proof relies on `sorry`, `admit`, new `axiom`, `unsafe`, `partial`, or\n  proof-critical external assumptions without excluding them from the claim;\n- tests or external review are treated as verification;\n- Lean timeout is answered by adding more feature code.\n\n## Completion Gate\n\nDo not call the compiler verified because tests pass, the compiler runs, or a\nscaffold theorem exists.\n\nBefore reporting a verified milestone:\n\n1. Inspect the accepted compiler path.\n2. Name the exact top theorem(s).\n3. Run the narrowest meaningful build command, and full build when practical.\n4. Run `#print axioms` or the local equivalent on public top theorem(s) when\n   practical.\n5. Scan for `sorry`, `admit`, `axiom`, `unsafe`, and `partial`.\n6. Check public imports for obsolete fixture\u002Fstory\u002Flegacy routes.\n7. Check public theorem arguments for compiler-generated certificates or layout\n   evidence. They must be discharged by checked constructors, be private helper\n   inputs, or be explicitly named as trusted external inputs approved by the\n   user. Otherwise keep working.\n8. Inspect `Accepted`\u002F`WF` records used by the public theorem. They must not\n   smuggle in compiler-output equality, label layout, replay certificates,\n   call\u002Freturn layout, generated-token uniqueness, or semantic preservation\n   oracles. They also must not exclude lower-layer capabilities merely because\n   the representation or proof is unfinished. If they do, split those fields out\n   and discharge them, explicitly narrow the requested source language with the\n   user, or keep the milestone incomplete.\n9. Check that resource and external-effect premises are source-facing or\n   actual-trace-derived, not globally quantified target facts.\n10. State remaining assumptions and unsupported features plainly.\n\nThe goal is complete only when every source-language feature in the requested\nscope has a checked path from trusted input or AST through acceptance,\nsemantics, compiler\u002Flowering, target interpreter, and theorem. If a fragment was\nexplicitly requested, say so in the theorem names or surrounding API and audit\nthe fragment boundary. Otherwise report the current work as a theorem-bearing\nmilestone and keep working on the missing source semantics.\n\n## References\n\nLoad only when useful:\n\n- `references\u002Fverified-compiler-patterns.md`: theorem-boundary patterns and\n  classic verified-compiler references.\n- `references\u002Fprocess-lessons.md`: earlier process failures to avoid.\n",{"data":35,"body":36},{"name":4,"description":6},{"type":37,"children":38},"root",[39,47,53,58,65,207,213,231,236,241,247,252,257,292,297,303,331,336,342,347,385,390,419,424,590,596,614,619,712,732,737,742,748,753,820,825,831,836,841,846,852,857,862,947,967,972,1009,1014,1053,1058,1104,1109,1114,1119,1124,1129,1134,1146,1151,1230,1235,1241,1246,1251,1269,1274,1302,1315,1321,1326,1331,1337,1342,1438,1443,1524,1529,1588,1593,1599,1604,1610,1615,1625,1804,1814,1899,1971,1976,1982,1987,2025,2037,2043,2048,2170,2176,2181,2186,2289,2294,2300,2305,2330],{"type":40,"tag":41,"props":42,"children":43},"element","h1",{"id":4},[44],{"type":45,"value":46},"text","Verifiable Compiler",{"type":40,"tag":48,"props":49,"children":50},"p",{},[51],{"type":45,"value":52},"Use this skill for Lean-first verified compiler work. The primary artifacts are\nLean definitions, compiler functions, semantics, relations, and checked\ntheorems. Tests, fixtures, docs, and external tools are support\nevidence only.",{"type":40,"tag":48,"props":54,"children":55},{},[56],{"type":45,"value":57},"The default shape is: start near\nthe target, add one semantic abstraction layer at a time, prove the adjacent\nlowering completely for the source language in scope, then move up.",{"type":40,"tag":59,"props":60,"children":62},"h2",{"id":61},"start-or-resume",[63],{"type":45,"value":64},"Start Or Resume",{"type":40,"tag":66,"props":67,"children":68},"ol",{},[69,129,142,162,190,202],{"type":40,"tag":70,"props":71,"children":72},"li",{},[73,75],{"type":45,"value":74},"Inspect local state before planning:\n",{"type":40,"tag":76,"props":77,"children":78},"ul",{},[79,91,110],{"type":40,"tag":70,"props":80,"children":81},{},[82,89],{"type":40,"tag":83,"props":84,"children":86},"code",{"className":85},[],[87],{"type":45,"value":88},"git status --short",{"type":45,"value":90}," (if this is not a git repo, initialize with a commit);",{"type":40,"tag":70,"props":92,"children":93},{},[94,100,102,108],{"type":40,"tag":83,"props":95,"children":97},{"className":96},[],[98],{"type":45,"value":99},"lakefile.lean",{"type":45,"value":101},", ",{"type":40,"tag":83,"props":103,"children":105},{"className":104},[],[106],{"type":45,"value":107},"lean-toolchain",{"type":45,"value":109},", root modules, theorem files, tests, and\nrecent build scripts;",{"type":40,"tag":70,"props":111,"children":112},{},[113,119,121,127],{"type":40,"tag":83,"props":114,"children":116},{"className":115},[],[117],{"type":45,"value":118},"ROADMAP.md",{"type":45,"value":120}," and ",{"type":40,"tag":83,"props":122,"children":124},{"className":123},[],[125],{"type":45,"value":126},"PROGRESS_LOG.md",{"type":45,"value":128},", if present.",{"type":40,"tag":70,"props":130,"children":131},{},[132,134,140],{"type":45,"value":133},"Call ",{"type":40,"tag":83,"props":135,"children":137},{"className":136},[],[138],{"type":45,"value":139},"get_goal",{"type":45,"value":141},". If no active goal exists, create one whose objective\nmatches the user's concrete request in this turn. For sustained build\nrequests, include the requested compiler scope and the end-to-end theorem\nstandard. For narrower work, keep the objective scoped to that audit,\nproof-debugging, refactor, architecture review, skill edit, or pass-specific\ntask.",{"type":40,"tag":70,"props":143,"children":144},{},[145,147,153,155,160],{"type":45,"value":146},"When starting or resuming sustained verified-compiler work, say explicitly\nthat this workflow is using ",{"type":40,"tag":83,"props":148,"children":150},{"className":149},[],[151],{"type":45,"value":152},"$verifiable-compiler",{"type":45,"value":154},", and remind the user\nthat future continuation requests should mention ",{"type":40,"tag":83,"props":156,"children":158},{"className":157},[],[159],{"type":45,"value":152},{"type":45,"value":161},".\nDo this at start\u002Fresume or handoff, not in every status update.",{"type":40,"tag":70,"props":163,"children":164},{},[165,167],{"type":45,"value":166},"Use exactly two project docs by default:\n",{"type":40,"tag":76,"props":168,"children":169},{},[170,180],{"type":40,"tag":70,"props":171,"children":172},{},[173,178],{"type":40,"tag":83,"props":174,"children":176},{"className":175},[],[177],{"type":45,"value":118},{"type":45,"value":179},": sparse checklist and current public spine.",{"type":40,"tag":70,"props":181,"children":182},{},[183,188],{"type":40,"tag":83,"props":184,"children":186},{"className":185},[],[187],{"type":45,"value":126},{"type":45,"value":189},": flat timestamped log of proofs, tests, bottlenecks,\narchitecture risks, deletions, and status.",{"type":40,"tag":70,"props":191,"children":192},{},[193,195,200],{"type":45,"value":194},"Every time the agent restarts from conversation compaction, append a short\ntimestamped ",{"type":40,"tag":83,"props":196,"children":198},{"className":197},[],[199],{"type":45,"value":126},{"type":45,"value":201}," entry before continuing, including for narrow\nfollow-up tasks. Name it as a compaction resume, summarize the current\nobjective\u002Fcheckpoint in one sentence, and keep it concise.",{"type":40,"tag":70,"props":203,"children":204},{},[205],{"type":45,"value":206},"Do not create feature matrices, trust ledgers, design histories, or incident\nreports unless the user asks. If legacy docs exist, read them as context but\ndo not keep adding synchronized truth there.",{"type":40,"tag":59,"props":208,"children":210},{"id":209},"git-checkpoints",[211],{"type":45,"value":212},"Git Checkpoints",{"type":40,"tag":76,"props":214,"children":215},{},[216,221,226],{"type":40,"tag":70,"props":217,"children":218},{},[219],{"type":45,"value":220},"Commit verified checkpoints as you go. After a meaningful theorem, boundary\ncleanup, refactor, or audit passes its relevant build\u002Faxiom checks, create a\nfocused git commit before starting the next substantial proof thread.",{"type":40,"tag":70,"props":222,"children":223},{},[224],{"type":45,"value":225},"Keep commits honest: include only project files that belong to the verified\ncheckpoint, and mention the Lean build or axiom audit that passed. Do not\ncommit huge build logs, scratch outputs, or unrelated generated clutter.",{"type":40,"tag":70,"props":227,"children":228},{},[229],{"type":45,"value":230},"If the user says all current work belongs to the agent, treat the dirty tree\nas owned work for staging purposes, while still keeping commits coherent and\navoiding accidental inclusion of temporary logs or secrets.",{"type":40,"tag":48,"props":232,"children":233},{},[234],{"type":45,"value":235},"For a broad build request, the goal is not complete until concrete Lean theorem\nstatements connect every source-language feature in scope to the declared target\ninterpreter. Do not silently reinterpret a request for a source language as a\nrequest for a convenient accepted fragment.",{"type":40,"tag":48,"props":237,"children":238},{},[239],{"type":45,"value":240},"For any active goal that asks to complete a layer or compiler pass, do not stop\nwhile the public theorem still takes compiler-generated evidence as an\nunproved input. Treat these as blockers, not residual assumptions: generated\nlayout records, compilation certificates, replay certificates, whole-program\ncall or callee-preservation obligations, return-layout obligations, generated\nlabel\u002Ftoken uniqueness tables, and proof-carrying emitted-code segments. It is\nacceptable to expose fundamental semantic or resource premises such as source\nacceptedness, input run\u002Fevaluation, initial-state relation, fuel\u002Fgas bounds, or\nexplicit code-size\u002Fno-overflow bounds, but any compiler artifact that can be\ncomputed from the source program must either be constructed by a checked Lean\ntheorem or remain an explicitly unfinished goal.",{"type":40,"tag":59,"props":242,"children":244},{"id":243},"theorem-truth-checks",[245],{"type":45,"value":246},"Theorem-Truth Checks",{"type":40,"tag":48,"props":248,"children":249},{},[250],{"type":45,"value":251},"Before major proof grinding, check whether the theorem is true as quantified.\nTry to find small counterexamples involving arbitrary target PC, fuel-zero\nstates, stack height, static-context restrictions, gas observations, external\ncalls, revert\u002Ferror outcomes, and unsupported source constructs.",{"type":40,"tag":48,"props":253,"children":254},{},[255],{"type":45,"value":256},"If a target fact is only true for traces produced by accepted source programs,\nstate it over those actual traces or derive it from source-facing premises. Do\nnot keep a globally quantified target premise just because it is convenient for\nthe proof.",{"type":40,"tag":48,"props":258,"children":259},{},[260,262,267,269,275,276,282,284,290],{"type":45,"value":261},"When a theorem is false or overbroad, fix the statement before adding wrappers,\ncompatibility lemmas, or local heartbeats. Record the correction in\n",{"type":40,"tag":83,"props":263,"children":265},{"className":264},[],[266],{"type":45,"value":126},{"type":45,"value":268}," as ",{"type":40,"tag":83,"props":270,"children":272},{"className":271},[],[273],{"type":45,"value":274},"theorem-boundary",{"type":45,"value":101},{"type":40,"tag":83,"props":277,"children":279},{"className":278},[],[280],{"type":45,"value":281},"deletion",{"type":45,"value":283},", or ",{"type":40,"tag":83,"props":285,"children":287},{"className":286},[],[288],{"type":45,"value":289},"architecture-risk",{"type":45,"value":291},".",{"type":40,"tag":48,"props":293,"children":294},{},[295],{"type":45,"value":296},"Once the project freezes its public specification — hash-pinned theorem\nstatements, a frozen-closure checker, or a challenge\u002Fscoring regime that\nmeasures rewrites against a fixed theorem — this workflow changes mode. A\nfrozen statement is an immutable interface: do not restate, weaken, or\n\"improve\" it, even when the boundary looks fixable; rewrites and\noptimizations must reprove the exact frozen statement. If a frozen statement\nturns out to be false or overbroad, that is a project-level incident — report\nit and get an explicit unfreeze decision from the user instead of editing\naround it. Run the project's freeze gates (hash and closure checks) alongside\nthe usual build and axiom audits before calling any change complete.",{"type":40,"tag":59,"props":298,"children":300},{"id":299},"no-unproven-compiler-paths",[301],{"type":45,"value":302},"No Unproven Compiler Paths",{"type":40,"tag":48,"props":304,"children":305},{},[306,308,314,315,321,323,329],{"type":45,"value":307},"Do not introduce, wire in, or commit an unproven path that emits compiler output\nor deployable bytecode. This includes paths named ",{"type":40,"tag":83,"props":309,"children":311},{"className":310},[],[312],{"type":45,"value":313},"unchecked",{"type":45,"value":101},{"type":40,"tag":83,"props":316,"children":318},{"className":317},[],[319],{"type":45,"value":320},"unsafe",{"type":45,"value":322},",\n",{"type":40,"tag":83,"props":324,"children":326},{"className":325},[],[327],{"type":45,"value":328},"artifact-only",{"type":45,"value":330},", benchmark-only, fallback, fast path, or executable shortcut.\nIf such a path is used by the compiler, bytecode\u002Fartifact generation, bridge\nrunner, benchmark harness, or user-facing validation, it must either be the\nchecked theorem path or have a Lean theorem proving equality\u002Frefinement to the\nchecked theorem path, with an axiom audit showing only standard Lean axioms.",{"type":40,"tag":48,"props":332,"children":333},{},[334],{"type":45,"value":335},"Executable variants are allowed only when a checked equality\u002Frefinement\ntheorem connects them to the proof-facing definition, and all\ncallers that emit bytecode can be transported back to the public preservation\ntheorem through checked lemmas. Existing unproven output paths are blockers to\nremove, prove equivalent\u002Frefining, or quarantine as non-compiler diagnostics;\ndo not commit new work that relies on them.",{"type":40,"tag":59,"props":337,"children":339},{"id":338},"core-strategy",[340],{"type":45,"value":341},"Core Strategy",{"type":40,"tag":48,"props":343,"children":344},{},[345],{"type":45,"value":346},"Build a target-up semantic tower, one complete layer at a time:",{"type":40,"tag":66,"props":348,"children":349},{},[350,355,360,365,370,375,380],{"type":40,"tag":70,"props":351,"children":352},{},[353],{"type":45,"value":354},"Choose or define the declared target interpreter and observation model.",{"type":40,"tag":70,"props":356,"children":357},{},[358],{"type":45,"value":359},"Define the lowest useful layer above that target.",{"type":40,"tag":70,"props":361,"children":362},{},[363],{"type":45,"value":364},"Add exactly one real semantic abstraction in the next higher layer.",{"type":40,"tag":70,"props":366,"children":367},{},[368],{"type":45,"value":369},"Give that layer syntax, semantics, wellformedness\u002Facceptance, a relation to\nthe lower layer, compiler\u002Flowering, and preservation theorem. You can add slices\nto that layer one at a time, but the layer needs to be feature-complete,\nnot a toy version of the language, before moving on. Its feature set should\ncover the whole abstraction that belongs at that layer and, as far as possible\nbefore higher abstractions exist, match how that feature works in the source\nlanguage being targeted.\nThe semantics must be an independent interpreter or evaluation relation over\nthat layer's own syntax. Defining the layer's run\u002Feval as \"lower\u002Fcompile this\nprogram, then run the lower layer\" is not a valid source semantics, except for\nan explicitly named transparent adapter boundary with no new source constructs\nand a recorded audit note.\nThe semantics must also abstract the feature this layer introduces. Do not\ndefine a new source construct by exposing the lower representation it is meant\nto hide. For example, a locals\u002Fframe layer should have a named-environment\nsource semantics; stack slots, layout depths, swaps, pops, or frame encodings\nbelong in that layer's compiler\u002Flowering relation and proof, not in the\nsource interpreter used by higher layers.",{"type":40,"tag":70,"props":371,"children":372},{},[373],{"type":45,"value":374},"Compose the new theorem into the public spine.",{"type":40,"tag":70,"props":376,"children":377},{},[378],{"type":45,"value":379},"Run a brief theorem-boundary checkpoint before moving on.",{"type":40,"tag":70,"props":381,"children":382},{},[383],{"type":45,"value":384},"Only then add the next layer.",{"type":40,"tag":48,"props":386,"children":387},{},[388],{"type":45,"value":389},"Example of good abstraction steps include labels over byte offsets, structured control over\njumps, locals\u002Fframes over stack slots, expressions over primitive stack code,\nfunctions over entry labels, or objects\u002Fmodules over flat functions.",{"type":40,"tag":48,"props":391,"children":392},{},[393,395,401,403,409,411,417],{"type":45,"value":394},"Bad layers are story-shaped features (",{"type":40,"tag":83,"props":396,"children":398},{"className":397},[],[399],{"type":45,"value":400},"let-if-assign-return",{"type":45,"value":402},"), parser fixtures,\none-off combinations (",{"type":40,"tag":83,"props":404,"children":406},{"className":405},[],[407],{"type":45,"value":408},"if",{"type":45,"value":410}," inside ",{"type":40,"tag":83,"props":412,"children":414},{"className":413},[],[415],{"type":45,"value":416},"for",{"type":45,"value":418},"), or helper representations with no\nindependent semantic contract.",{"type":40,"tag":48,"props":420,"children":421},{},[422],{"type":45,"value":423},"Before implementing a broad layer, run this checklist. This is a thinking\ncheckpoint, not a request to create new documents:",{"type":40,"tag":76,"props":425,"children":426},{},[427,432,437,442,447,468,473,478,498,503,508,513,518,523,528],{"type":40,"tag":70,"props":428,"children":429},{},[430],{"type":45,"value":431},"Grammar frozen: every construct in scope is named, and every tempting\nconstruct out of scope is explicitly excluded.",{"type":40,"tag":70,"props":433,"children":434},{},[435],{"type":45,"value":436},"Prior art checked: inspect the existing lower layer, adjacent completed\nlayers, and any sibling worktree or earlier implementation the user points to\nbefore inventing a new proof route. Reuse proven theorem shapes when they\nfit; record why they do not if you diverge.",{"type":40,"tag":70,"props":438,"children":439},{},[440],{"type":45,"value":441},"Semantics frozen: outcomes, errors, effects, divergence\u002Ffuel behavior, and\nobservable state are clear for the accepted subset.",{"type":40,"tag":70,"props":443,"children":444},{},[445],{"type":45,"value":446},"Theorem-truth checked: known counterexample shapes such as arbitrary PC,\nfuel-zero target states, stack\u002Fresource exhaustion, static context, gas\nobservability, and external effects have been ruled out or reflected in the\ntheorem boundary.",{"type":40,"tag":70,"props":448,"children":449},{},[450,452,458,460,466],{"type":45,"value":451},"Interpreter independence checked: ",{"type":40,"tag":83,"props":453,"children":455},{"className":454},[],[456],{"type":45,"value":457},"run",{"type":45,"value":459},"\u002F",{"type":40,"tag":83,"props":461,"children":463},{"className":462},[],[464],{"type":45,"value":465},"Eval",{"type":45,"value":467}," is not merely lower-layer\nexecution after compiling\u002Felaborating the source; any exception is an explicit\ntransparent adapter boundary, not a completed compiler layer.",{"type":40,"tag":70,"props":469,"children":470},{},[471],{"type":45,"value":472},"Abstraction boundary checked: the layer's source semantics hides the lower\nrepresentation that its new feature abstracts. Any proof terms, layouts,\nslots, continuations, frame encodings, return tokens, cleanup code, or other\nlower-level machinery needed to implement the feature live in the compiler\nand preservation proof, not in the source interpreter or the interface used by\nhigher layers.",{"type":40,"tag":70,"props":474,"children":475},{},[476],{"type":45,"value":477},"Lower capabilities pass through: the layer does not silently shrink the\nalready-verified lower language surface.",{"type":40,"tag":70,"props":479,"children":480},{},[481,483,489,490,496],{"type":45,"value":482},"Accepted restrictions classified: every nontrivial ",{"type":40,"tag":83,"props":484,"children":486},{"className":485},[],[487],{"type":45,"value":488},"Accepted",{"type":45,"value":459},{"type":40,"tag":83,"props":491,"children":493},{"className":492},[],[494],{"type":45,"value":495},"WF",{"type":45,"value":497}," predicate\nis checked against the requested scope. An explicit predicate name is not by\nitself a justification; if it excludes lower-layer behavior because the proof\nroute or representation is unfinished, keep the layer incomplete unless the\nuser explicitly narrowed the language.",{"type":40,"tag":70,"props":499,"children":500},{},[501],{"type":45,"value":502},"Public theorem sketched: adjacent theorem and composed theorem have the right\nshape before helper proofs begin.",{"type":40,"tag":70,"props":504,"children":505},{},[506],{"type":45,"value":507},"Proof interface sketched: layout, freshness, state relation, continuation,\nresource, or environment assumptions are bundled when they are conceptually\none invariant.",{"type":40,"tag":70,"props":509,"children":510},{},[511],{"type":45,"value":512},"External\u002Fresource boundary classified: gas, fuel, code size, stack depth,\nstatic-context restrictions, storage\u002Faccount state, and external responses\nare either modeled by source semantics, rejected by acceptance, or exposed as\nexplicit source-facing premises.",{"type":40,"tag":70,"props":514,"children":515},{},[516],{"type":45,"value":517},"Temporary scaffolds named: replay\u002Fcertificate\u002Fhelper routes have a planned\nreplacement theorem or are kept private.",{"type":40,"tag":70,"props":519,"children":520},{},[521],{"type":45,"value":522},"Public certificate boundary checked: if a theorem still takes a compiler\ncertificate, layout witness, replay witness, proof-carrying emitted-code\nsegment, or generated-label table as an input, do not call the pass complete\nunless that certificate is itself generated by a checked compiler theorem or\nthe user explicitly accepted it as a trusted input format.",{"type":40,"tag":70,"props":524,"children":525},{},[526],{"type":45,"value":527},"No public call oracle: for recursive source features, the public theorem must\nnot take an all-callees-preserve, all-functions-preserve, replay, or call\nobligation premise. Discharge those obligations by source-fuel, evaluation,\nor well-founded induction, leaving only explicit resource bounds or source\nacceptedness assumptions at the public boundary.",{"type":40,"tag":70,"props":529,"children":530},{},[531,533,539,540,546,547,553,554,560,561,567,568,574,575,581,582,588],{"type":45,"value":532},"Public theorem grep: before declaring success, search the public spine for\nnames like ",{"type":40,"tag":83,"props":534,"children":536},{"className":535},[],[537],{"type":45,"value":538},"Certificate",{"type":45,"value":101},{"type":40,"tag":83,"props":541,"children":543},{"className":542},[],[544],{"type":45,"value":545},"CompilationCertificate",{"type":45,"value":101},{"type":40,"tag":83,"props":548,"children":550},{"className":549},[],[551],{"type":45,"value":552},"Replay",{"type":45,"value":101},{"type":40,"tag":83,"props":555,"children":557},{"className":556},[],[558],{"type":45,"value":559},"Obligation",{"type":45,"value":322},{"type":40,"tag":83,"props":562,"children":564},{"className":563},[],[565],{"type":45,"value":566},"ProcPreserves",{"type":45,"value":101},{"type":40,"tag":83,"props":569,"children":571},{"className":570},[],[572],{"type":45,"value":573},"Layout",{"type":45,"value":101},{"type":40,"tag":83,"props":576,"children":578},{"className":577},[],[579],{"type":45,"value":580},"Evidence",{"type":45,"value":101},{"type":40,"tag":83,"props":583,"children":585},{"className":584},[],[586],{"type":45,"value":587},"CallPreserves",{"type":45,"value":589},", and project-specific\ncertificate names. Any remaining public occurrence must be either generated by\na checked constructor theorem or justified as a fundamental resource\u002Finput\npremise in the audit entry.",{"type":40,"tag":59,"props":591,"children":593},{"id":592},"source-language-completeness",[594],{"type":45,"value":595},"Source-Language Completeness",{"type":40,"tag":48,"props":597,"children":598},{},[599,601,606,607,612],{"type":45,"value":600},"When the user asks for a verified compiler for a named source language or layer,\nthe default obligation is the complete semantics of that source language layer.\n",{"type":40,"tag":83,"props":602,"children":604},{"className":603},[],[605],{"type":45,"value":488},{"type":45,"value":459},{"type":40,"tag":83,"props":608,"children":610},{"className":609},[],[611],{"type":45,"value":495},{"type":45,"value":613}," may reject malformed, ill-scoped, ill-typed, or otherwise\nsemantically invalid programs, but it must not reject implemented source\nconstructs merely because they are proof-inconvenient unless the user explicitly\napproved a fragment.",{"type":40,"tag":48,"props":615,"children":616},{},[617],{"type":45,"value":618},"Before marking such a goal complete:",{"type":40,"tag":66,"props":620,"children":621},{},[622,627,645,650,697,702,707],{"type":40,"tag":70,"props":623,"children":624},{},[625],{"type":45,"value":626},"Inventory the source grammar against the source semantics and compiler.",{"type":40,"tag":70,"props":628,"children":629},{},[630,632,637,638,643],{"type":45,"value":631},"For every construct, record one status: supported and covered by the theorem;\nsemantically invalid and rejected by WF\u002FAccepted; or explicitly out of scope\nby user-approved fragment boundary. Apply the same classification to every\n",{"type":40,"tag":83,"props":633,"children":635},{"className":634},[],[636],{"type":45,"value":488},{"type":45,"value":459},{"type":40,"tag":83,"props":639,"children":641},{"className":640},[],[642],{"type":45,"value":495},{"type":45,"value":644}," field, not only to syntax constructors.",{"type":40,"tag":70,"props":646,"children":647},{},[648],{"type":45,"value":649},"If the source is a named external or imported language, name the exact\nreference semantics being targeted and require a checked theorem from that\nsemantics to the compiler source semantics; elaboration through the compiler\nis not enough by itself.",{"type":40,"tag":70,"props":651,"children":652},{},[653,655,660,661,666,668,674,675,681,682,688,689,695],{"type":45,"value":654},"Confirm the source semantics is an independent interpreter or evaluation\nrelation over the source syntax. If ",{"type":40,"tag":83,"props":656,"children":658},{"className":657},[],[659],{"type":45,"value":457},{"type":45,"value":459},{"type":40,"tag":83,"props":662,"children":664},{"className":663},[],[665],{"type":45,"value":465},{"type":45,"value":667}," delegates through ",{"type":40,"tag":83,"props":669,"children":671},{"className":670},[],[672],{"type":45,"value":673},"compile",{"type":45,"value":322},{"type":40,"tag":83,"props":676,"children":678},{"className":677},[],[679],{"type":45,"value":680},"lower",{"type":45,"value":101},{"type":40,"tag":83,"props":683,"children":685},{"className":684},[],[686],{"type":45,"value":687},"elaborate",{"type":45,"value":101},{"type":40,"tag":83,"props":690,"children":692},{"className":691},[],[693],{"type":45,"value":694},"toLower?",{"type":45,"value":696},", or similar, the layer is incomplete until\nit has its own semantics and a checked equivalence\u002Fpreservation theorem, or\nthe user explicitly accepts it as a transparent adapter boundary.",{"type":40,"tag":70,"props":698,"children":699},{},[700],{"type":45,"value":701},"Check that supported constructs include all outcomes their source semantics\nadmits, including errors, halts, resource failures, divergence\u002Ffuel behavior,\ntraces, and external observations claimed by the theorem.",{"type":40,"tag":70,"props":703,"children":704},{},[705],{"type":45,"value":706},"Confirm theorem statements quantify over the real source semantics, not only\nover a compiler-success witness or replay certificate.",{"type":40,"tag":70,"props":708,"children":709},{},[710],{"type":45,"value":711},"If any source construct is missing semantics or theorem coverage, keep\nworking or report a blocker; do not call the compiler fully verified.",{"type":40,"tag":48,"props":713,"children":714},{},[715,717,723,725,730],{"type":45,"value":716},"Add this source-language audit as its own ",{"type":40,"tag":83,"props":718,"children":720},{"className":719},[],[721],{"type":45,"value":722},"audit",{"type":45,"value":724}," entry in ",{"type":40,"tag":83,"props":726,"children":728},{"className":727},[],[729],{"type":45,"value":126},{"type":45,"value":731}," at\nmajor layer boundaries and before declaring an end-to-end theorem complete.",{"type":40,"tag":48,"props":733,"children":734},{},[735],{"type":45,"value":736},"Share source and target components where this reduces real proof burden:\nvalues, arithmetic, memory\u002Fstorage models, errors, traces, environments, and\nexternal state. Do not share away the compiler obligation. Source and target\ncontrol semantics, layout, resource assumptions, and observations must remain\nexplicit.",{"type":40,"tag":48,"props":738,"children":739},{},[740],{"type":45,"value":741},"It is valid for shared primitive operations to pass through the same semantics\nacross many layers when they are not the abstraction being introduced by that\nlayer. For example, arithmetic, hashing, memory\u002Fstorage operations, and\nexplicitly shared external effects may reuse the same primitive meaning all the\nway up to the source language. That exception does not apply to a feature whose\npurpose is to hide a lower representation: locals should hide stack slots,\nstructured control should hide jump encodings, functions should hide\nreturn-token\u002Fframe conventions, and so on.",{"type":40,"tag":59,"props":743,"children":745},{"id":744},"boundary-checkpoints",[746],{"type":45,"value":747},"Boundary Checkpoints",{"type":40,"tag":48,"props":749,"children":750},{},[751],{"type":45,"value":752},"At major semantic pass boundaries, pause briefly before moving upward:",{"type":40,"tag":66,"props":754,"children":755},{},[756,761,766,784,789,802],{"type":40,"tag":70,"props":757,"children":758},{},[759],{"type":45,"value":760},"Name the adjacent preservation theorem and the composed public spine theorem.",{"type":40,"tag":70,"props":762,"children":763},{},[764],{"type":45,"value":765},"Confirm syntax, semantics, acceptance\u002FWF, lowering, relation, and\nobservation\u002Foutcome model exist for the accepted feature set.",{"type":40,"tag":70,"props":767,"children":768},{},[769,771,776,777,782],{"type":45,"value":770},"Check for silent narrowing: ",{"type":40,"tag":83,"props":772,"children":774},{"className":773},[],[775],{"type":45,"value":488},{"type":45,"value":459},{"type":40,"tag":83,"props":778,"children":780},{"className":779},[],[781],{"type":45,"value":495},{"type":45,"value":783}," predicates must not exclude\nsupported behavior only because the proof route is unfinished.",{"type":40,"tag":70,"props":785,"children":786},{},[787],{"type":45,"value":788},"Check for theorem-boundary leaks: public theorem statements should not expose\nlower representation details, generated certificates, replay witnesses, or\nstale compatibility routes unless those are explicitly trusted inputs.",{"type":40,"tag":70,"props":790,"children":791},{},[792,794,800],{"type":45,"value":793},"Run the narrowest meaningful build, and ",{"type":40,"tag":83,"props":795,"children":797},{"className":796},[],[798],{"type":45,"value":799},"#print axioms",{"type":45,"value":801}," or the local\nequivalent for public theorem(s) when practical.",{"type":40,"tag":70,"props":803,"children":804},{},[805,807,812,813,818],{"type":45,"value":806},"Record one concise ",{"type":40,"tag":83,"props":808,"children":810},{"className":809},[],[811],{"type":45,"value":722},{"type":45,"value":724},{"type":40,"tag":83,"props":814,"children":816},{"className":815},[],[817],{"type":45,"value":126},{"type":45,"value":819}," with theorem names,\ncommand run, axiom result, and any remaining assumptions or unsupported\nbehavior.",{"type":40,"tag":48,"props":821,"children":822},{},[823],{"type":45,"value":824},"If the checkpoint finds a shortcut, stale public route, or accepted feature\noutside theorem coverage, fix it, explicitly narrow the layer with the user, or\nreport the blocker.",{"type":40,"tag":59,"props":826,"children":828},{"id":827},"external-effects-and-resources",[829],{"type":45,"value":830},"External Effects And Resources",{"type":40,"tag":48,"props":832,"children":833},{},[834],{"type":45,"value":835},"For external effects such as calls, chain state, storage, balances, precompiles,\nor environment responses, default to an open request\u002Fresponse protocol at the\ncompiler theorem boundary. Concrete world simulation is useful only when the\ntheorem is explicitly about that world model.",{"type":40,"tag":48,"props":837,"children":838},{},[839],{"type":45,"value":840},"For resource-sensitive behavior such as gas, fuel, stack limits, code-size\nlimits, static context, memory growth, or no-overflow obligations, prefer\nsource-facing premises and actual-trace lemmas. A target-side runtime fact is\nacceptable only when it is derived from the accepted source run, the checked\ncompiler output, and explicitly named resource bounds.",{"type":40,"tag":48,"props":842,"children":843},{},[844],{"type":45,"value":845},"If a source primitive observes target resource state directly, either include\nthat observation in the source semantics and prove it end to end, or reject the\nprimitive in the accepted language. Do not patch it with future-answer or replay\noracles in the main public theorem.",{"type":40,"tag":59,"props":847,"children":849},{"id":848},"preservation-shape",[850],{"type":45,"value":851},"Preservation Shape",{"type":40,"tag":48,"props":853,"children":854},{},[855],{"type":45,"value":856},"The main public theorem for an adjacent pass is a same-observation theorem.\nReplay certificates, traces, and local simulations are proof machinery; they\nshould not be the public theorem boundary once the layer is stable.",{"type":40,"tag":48,"props":858,"children":859},{},[860],{"type":45,"value":861},"Use this shape, adapted to local names:",{"type":40,"tag":863,"props":864,"children":869},"pre",{"className":865,"code":866,"language":867,"meta":868,"style":868},"language-lean shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","theorem compile_sound\n    (hWF : Hi.WF program)\n    (hCompile : Hi.compile program = lower)\n    (hEval : Hi.Eval program initial obs)\n    (hRel : StateRel initial lowerInitial) :\n    Exists fun lowerObs =>\n      And (Lo.Eval lower lowerInitial lowerObs) (ObsRel obs lowerObs) := by\n  ...\n","lean","",[870],{"type":40,"tag":83,"props":871,"children":872},{"__ignoreMap":868},[873,884,893,902,911,920,929,938],{"type":40,"tag":874,"props":875,"children":878},"span",{"class":876,"line":877},"line",1,[879],{"type":40,"tag":874,"props":880,"children":881},{},[882],{"type":45,"value":883},"theorem compile_sound\n",{"type":40,"tag":874,"props":885,"children":887},{"class":876,"line":886},2,[888],{"type":40,"tag":874,"props":889,"children":890},{},[891],{"type":45,"value":892},"    (hWF : Hi.WF program)\n",{"type":40,"tag":874,"props":894,"children":896},{"class":876,"line":895},3,[897],{"type":40,"tag":874,"props":898,"children":899},{},[900],{"type":45,"value":901},"    (hCompile : Hi.compile program = lower)\n",{"type":40,"tag":874,"props":903,"children":905},{"class":876,"line":904},4,[906],{"type":40,"tag":874,"props":907,"children":908},{},[909],{"type":45,"value":910},"    (hEval : Hi.Eval program initial obs)\n",{"type":40,"tag":874,"props":912,"children":914},{"class":876,"line":913},5,[915],{"type":40,"tag":874,"props":916,"children":917},{},[918],{"type":45,"value":919},"    (hRel : StateRel initial lowerInitial) :\n",{"type":40,"tag":874,"props":921,"children":923},{"class":876,"line":922},6,[924],{"type":40,"tag":874,"props":925,"children":926},{},[927],{"type":45,"value":928},"    Exists fun lowerObs =>\n",{"type":40,"tag":874,"props":930,"children":932},{"class":876,"line":931},7,[933],{"type":40,"tag":874,"props":934,"children":935},{},[936],{"type":45,"value":937},"      And (Lo.Eval lower lowerInitial lowerObs) (ObsRel obs lowerObs) := by\n",{"type":40,"tag":874,"props":939,"children":941},{"class":876,"line":940},8,[942],{"type":40,"tag":874,"props":943,"children":944},{},[945],{"type":45,"value":946},"  ...\n",{"type":40,"tag":48,"props":948,"children":949},{},[950,952,957,959,965],{"type":45,"value":951},"When both semantics are executable and deterministic, this may be an equality\ntheorem over ",{"type":40,"tag":83,"props":953,"children":955},{"className":954},[],[956],{"type":45,"value":457},{"type":45,"value":958},"; when the layer erases representation details, use ",{"type":40,"tag":83,"props":960,"children":962},{"className":961},[],[963],{"type":45,"value":964},"ObsRel",{"type":45,"value":966},".\nThe important claim is that the lower semantics has the same observable program\nresult, not merely that some hand-written replay witness exists.",{"type":40,"tag":48,"props":968,"children":969},{},[970],{"type":45,"value":971},"Prefer strengthened, compositional theorem statements from the beginning.",{"type":40,"tag":48,"props":973,"children":974},{},[975,977,983,985,991,993,999,1001,1007],{"type":45,"value":976},"Lean theorem boundaries matter. If witness data is derived from a ",{"type":40,"tag":83,"props":978,"children":980},{"className":979},[],[981],{"type":45,"value":982},"Prop",{"type":45,"value":984},"\nrelation such as a source run, evaluation derivation, or preservation theorem,\nthe public result should usually expose ",{"type":40,"tag":83,"props":986,"children":988},{"className":987},[],[989],{"type":45,"value":990},"∃",{"type":45,"value":992}," or ",{"type":40,"tag":83,"props":994,"children":996},{"className":995},[],[997],{"type":45,"value":998},"Nonempty",{"type":45,"value":1000}," evidence. Do not make\nthe public route depend on returning an arbitrary structure in ",{"type":40,"tag":83,"props":1002,"children":1004},{"className":1003},[],[1005],{"type":45,"value":1006},"Type",{"type":45,"value":1008}," unless\nthat structure is produced by computation or is passed in as explicit data.",{"type":40,"tag":48,"props":1010,"children":1011},{},[1012],{"type":45,"value":1013},"For expression-like code generation, use an arbitrary continuation\u002Fsuffix:",{"type":40,"tag":863,"props":1015,"children":1017},{"className":865,"code":1016,"language":867,"meta":868,"style":868},"theorem compile_correct_aux (e : Expr) (k : Code) (s : Stack) :\n    run (compile e ++ k) s = run k (eval e :: s) := by\n  induction e generalizing k s with\n  | ... => ...\n",[1018],{"type":40,"tag":83,"props":1019,"children":1020},{"__ignoreMap":868},[1021,1029,1037,1045],{"type":40,"tag":874,"props":1022,"children":1023},{"class":876,"line":877},[1024],{"type":40,"tag":874,"props":1025,"children":1026},{},[1027],{"type":45,"value":1028},"theorem compile_correct_aux (e : Expr) (k : Code) (s : Stack) :\n",{"type":40,"tag":874,"props":1030,"children":1031},{"class":876,"line":886},[1032],{"type":40,"tag":874,"props":1033,"children":1034},{},[1035],{"type":45,"value":1036},"    run (compile e ++ k) s = run k (eval e :: s) := by\n",{"type":40,"tag":874,"props":1038,"children":1039},{"class":876,"line":895},[1040],{"type":40,"tag":874,"props":1041,"children":1042},{},[1043],{"type":45,"value":1044},"  induction e generalizing k s with\n",{"type":40,"tag":874,"props":1046,"children":1047},{"class":876,"line":904},[1048],{"type":40,"tag":874,"props":1049,"children":1050},{},[1051],{"type":45,"value":1052},"  | ... => ...\n",{"type":40,"tag":48,"props":1054,"children":1055},{},[1056],{"type":45,"value":1057},"For statement\u002Fcontrol layers, generalize this idea. Use whichever local shape\nmatches the layer:",{"type":40,"tag":76,"props":1059,"children":1060},{},[1061,1066,1071,1076,1081,1086,1099],{"type":40,"tag":70,"props":1062,"children":1063},{},[1064],{"type":45,"value":1065},"arbitrary code suffix;",{"type":40,"tag":70,"props":1067,"children":1068},{},[1069],{"type":45,"value":1070},"continuation or defunctionalized continuation;",{"type":40,"tag":70,"props":1072,"children":1073},{},[1074],{"type":45,"value":1075},"evaluation\u002Fcontrol context;",{"type":40,"tag":70,"props":1077,"children":1078},{},[1079],{"type":45,"value":1080},"entry\u002Fdestination labels;",{"type":40,"tag":70,"props":1082,"children":1083},{},[1084],{"type":45,"value":1085},"layout and no-wrap assumptions;",{"type":40,"tag":70,"props":1087,"children":1088},{},[1089,1091,1097],{"type":45,"value":1090},"state relation at an exact target PC, such as ",{"type":40,"tag":83,"props":1092,"children":1094},{"className":1093},[],[1095],{"type":45,"value":1096},"RelAt",{"type":45,"value":1098},";",{"type":40,"tag":70,"props":1100,"children":1101},{},[1102],{"type":45,"value":1103},"outcome relation for normal return, halt, revert, throw, break\u002Fcontinue, or\nother abrupt exits.",{"type":40,"tag":48,"props":1105,"children":1106},{},[1107],{"type":45,"value":1108},"The public proof route should be structural: sequence, context, branch, loop,\ncall, frame\u002Flayout, and outcome lemmas compose into the same-observation theorem.\nIf theorem names start encoding whole programs or feature combinations, stop and\nreplace them with generic recursive\u002Fcompositional theorems.",{"type":40,"tag":48,"props":1110,"children":1111},{},[1112],{"type":45,"value":1113},"If a proof is becoming a long run of nearly identical constructors or opcodes,\npause before continuing. Look for a semantic-family classifier, pass-through\nlemma, source syntax traversal, or relation-preservation theorem that proves the\ncommon case once and leaves only genuinely distinct cases as wrappers.",{"type":40,"tag":48,"props":1115,"children":1116},{},[1117],{"type":45,"value":1118},"If several consecutive changes add wrappers, adapters, callbacks, bridge\naliases, or compatibility routes without shrinking the public assumptions, stop\nand inspect the theorem boundary. Usually the right next patch is deletion or\nrestatement, not another adapter.",{"type":40,"tag":48,"props":1120,"children":1121},{},[1122],{"type":45,"value":1123},"After a few helper lemmas for a new construct, inspect the next theorem\nstatement. If it needs many independent PC, label, freshness, layout, resource,\nor environment premises, introduce a small structure or relation that names that\ninterface. Long premise lists are usually missing abstraction, not proof\nprogress.",{"type":40,"tag":48,"props":1125,"children":1126},{},[1127],{"type":45,"value":1128},"Wherever feasible, derive full preservation proofs from accepted source runs;\ntreat assumed replay\u002Fcertificate witnesses as temporary scaffolding, not the\npublic theorem boundary.",{"type":40,"tag":48,"props":1130,"children":1131},{},[1132],{"type":45,"value":1133},"Compiler-generated evidence is not a fundamental assumption. Before declaring a\nlayer done, try to prove a checked constructor for every public certificate:\nlayout, freshness, label resolution, call-site table inclusion, PC-fit, typed\ncontinuation boundary, and compiler-output equality. If construction is not yet\nproved, the layer is not complete; log the missing constructor and keep working\nor explicitly report the blocker.",{"type":40,"tag":48,"props":1135,"children":1136},{},[1137,1139,1144],{"type":45,"value":1138},"Do not hide unfinished compiler evidence inside source acceptance. ",{"type":40,"tag":83,"props":1140,"children":1142},{"className":1141},[],[1143],{"type":45,"value":488},{"type":45,"value":1145},"\nmay bundle source wellformedness, source semantic safety, checked resource\nlimits, or user-approved trusted-input contracts, but it must not contain a\ncompiler-generated layout, replay witness, call-site table, label-resolution\nproof, procedure-body preservation proof, or semantic call oracle unless the\nskill user explicitly chose proof-carrying source input as the trusted source\nformat. If a preservation theorem needs such evidence, either generate it with\na checked compiler theorem or keep the layer incomplete.",{"type":40,"tag":48,"props":1147,"children":1148},{},[1149],{"type":45,"value":1150},"For recursive source features such as procedure calls, function calls,\nrecursive loops expressed through fuel, or mutually recursive declarations, the\ndefault discharge route is induction on source fuel or on the relational\nevaluation derivation. Do not replace this with an assumed \"all callees\npreserve\" oracle. If a temporary all-callee\u002Fcall obligation is introduced, keep\nit private, give it a fuel-bounded replacement plan immediately, and do not\nreport the layer complete until the public theorem derives it.",{"type":40,"tag":48,"props":1152,"children":1153},{},[1154,1156,1161,1162,1168,1169,1175,1177,1182,1184,1190,1191,1196,1197,1202,1207,1208,1214,1216,1222,1223,1228],{"type":45,"value":1155},"Avoid brittle fusion lemmas. A lemma about ",{"type":40,"tag":83,"props":1157,"children":1159},{"className":1158},[],[1160],{"type":45,"value":408},{"type":45,"value":410},{"type":40,"tag":83,"props":1163,"children":1165},{"className":1164},[],[1166],{"type":45,"value":1167},"loop",{"type":45,"value":101},{"type":40,"tag":83,"props":1170,"children":1172},{"className":1171},[],[1173],{"type":45,"value":1174},"switch",{"type":45,"value":1176}," inside\n",{"type":40,"tag":83,"props":1178,"children":1180},{"className":1179},[],[1181],{"type":45,"value":416},{"type":45,"value":1183},", or assignment plus branch plus return is not a milestone unless it is a\nprivate stepping stone being replaced immediately by generic ",{"type":40,"tag":83,"props":1185,"children":1187},{"className":1186},[],[1188],{"type":45,"value":1189},"seq",{"type":45,"value":459},{"type":40,"tag":83,"props":1192,"children":1194},{"className":1193},[],[1195],{"type":45,"value":408},{"type":45,"value":459},{"type":40,"tag":83,"props":1198,"children":1200},{"className":1199},[],[1201],{"type":45,"value":1174},{"type":40,"tag":83,"props":1203,"children":1205},{"className":1204},[],[1206],{"type":45,"value":1167},{"type":45,"value":459},{"type":40,"tag":83,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":45,"value":1213},"outcome",{"type":45,"value":1215}," composition. If a fused lemma remains useful, log it as a\n",{"type":40,"tag":83,"props":1217,"children":1219},{"className":1218},[],[1220],{"type":45,"value":1221},"shortcut",{"type":45,"value":992},{"type":40,"tag":83,"props":1224,"children":1226},{"className":1225},[],[1227],{"type":45,"value":289},{"type":45,"value":1229}," and keep it out of the public spine.",{"type":40,"tag":48,"props":1231,"children":1232},{},[1233],{"type":45,"value":1234},"CPS is a tool, not a mandate. Raw higher-order continuations can make Lean\nterms huge. Prefer a small continuation\u002Fcontext interface that keeps compiled\nprograms folded and lets induction hypotheses apply under arbitrary suffixes.",{"type":40,"tag":59,"props":1236,"children":1238},{"id":1237},"accepted-subsets",[1239],{"type":45,"value":1240},"Accepted Subsets",{"type":40,"tag":48,"props":1242,"children":1243},{},[1244],{"type":45,"value":1245},"Full preservation means full semantics for the accepted subset, but an accepted\nsubset is allowed only when the user requested a fragment or when the source\nlanguage definition itself is intentionally smaller than its parser or host AST.\nIf the user asks for a compiler for the whole source language, the accepted\nsubset must be source-complete except for malformed or semantically invalid\nprograms.",{"type":40,"tag":48,"props":1247,"children":1248},{},[1249],{"type":45,"value":1250},"Do prove all relevant outcomes of accepted programs: success, errors, halts,\nresource failures, traces, divergence\u002Ffuel behavior, and external observations\nthat the theorem claims to model.",{"type":40,"tag":48,"props":1252,"children":1253},{},[1254,1256,1261,1262,1267],{"type":45,"value":1255},"Do not prove only the terminating happy path unless the theorem name and\naccepted checker explicitly say that is the claim. Unsupported behavior should\nbe rejected by ",{"type":40,"tag":83,"props":1257,"children":1259},{"className":1258},[],[1260],{"type":45,"value":488},{"type":45,"value":459},{"type":40,"tag":83,"props":1263,"children":1265},{"className":1264},[],[1266],{"type":45,"value":495},{"type":45,"value":1268},", guarded by explicit theorem assumptions, or\ncalled executable-only.",{"type":40,"tag":48,"props":1270,"children":1271},{},[1272],{"type":45,"value":1273},"Keep these notions separate:",{"type":40,"tag":76,"props":1275,"children":1276},{},[1277,1282,1287,1292,1297],{"type":40,"tag":70,"props":1278,"children":1279},{},[1280],{"type":45,"value":1281},"parser\u002Fdecoder success;",{"type":40,"tag":70,"props":1283,"children":1284},{},[1285],{"type":45,"value":1286},"semantic acceptance or wellformedness;",{"type":40,"tag":70,"props":1288,"children":1289},{},[1290],{"type":45,"value":1291},"compiler success;",{"type":40,"tag":70,"props":1293,"children":1294},{},[1295],{"type":45,"value":1296},"certificate checking;",{"type":40,"tag":70,"props":1298,"children":1299},{},[1300],{"type":45,"value":1301},"target execution success.",{"type":40,"tag":48,"props":1303,"children":1304},{},[1305,1307,1313],{"type":45,"value":1306},"Accepted input must not mean \"the compiler returned ",{"type":40,"tag":83,"props":1308,"children":1310},{"className":1309},[],[1311],{"type":45,"value":1312},"some",{"type":45,"value":1314},".\" Compiler-success\ntheorems are useful, but they are weaker than accepted-input theorems.",{"type":40,"tag":59,"props":1316,"children":1318},{"id":1317},"lean-blowup-rules",[1319],{"type":45,"value":1320},"Lean Blowup Rules",{"type":40,"tag":48,"props":1322,"children":1323},{},[1324],{"type":45,"value":1325},"Treat timeouts and heartbeat explosions as architecture feedback, not merely\ntactic problems.",{"type":40,"tag":48,"props":1327,"children":1328},{},[1329],{"type":45,"value":1330},"Do not let Lean normalize whole compiled programs as a proof strategy.",{"type":40,"tag":59,"props":1332,"children":1334},{"id":1333},"context-hygiene",[1335],{"type":45,"value":1336},"Context Hygiene",{"type":40,"tag":48,"props":1338,"children":1339},{},[1340],{"type":45,"value":1341},"Preserve context for theorem state, not logs or repo tours:",{"type":40,"tag":76,"props":1343,"children":1344},{},[1345,1350,1379,1428,1433],{"type":40,"tag":70,"props":1346,"children":1347},{},[1348],{"type":45,"value":1349},"Before every read, search, or build, name the narrow question it should\nanswer; avoid fresh \"getting bearings\" sweeps after a handoff identifies the\nnext target.",{"type":40,"tag":70,"props":1351,"children":1352},{},[1353,1355,1361,1363,1369,1371,1377],{"type":45,"value":1354},"Keep build output out of context: redirect noisy ",{"type":40,"tag":83,"props":1356,"children":1358},{"className":1357},[],[1359],{"type":45,"value":1360},"lake build",{"type":45,"value":1362}," logs to ",{"type":40,"tag":83,"props":1364,"children":1366},{"className":1365},[],[1367],{"type":45,"value":1368},"\u002Ftmp",{"type":45,"value":1370},"\nand inspect only ",{"type":40,"tag":83,"props":1372,"children":1374},{"className":1373},[],[1375],{"type":45,"value":1376},"error:",{"type":45,"value":1378}," lines plus the smallest needed neighborhood.",{"type":40,"tag":70,"props":1380,"children":1381},{},[1382,1384,1390,1391,1397,1398,1404,1405,1411,1413,1418,1420,1426],{"type":45,"value":1383},"Scope searches tightly. Prefer module-specific ",{"type":40,"tag":83,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":45,"value":1389},"rg",{"type":45,"value":101},{"type":40,"tag":83,"props":1392,"children":1394},{"className":1393},[],[1395],{"type":45,"value":1396},"rg -n -m",{"type":45,"value":322},{"type":40,"tag":83,"props":1399,"children":1401},{"className":1400},[],[1402],{"type":45,"value":1403},"rg --files",{"type":45,"value":101},{"type":40,"tag":83,"props":1406,"children":1408},{"className":1407},[],[1409],{"type":45,"value":1410},"git diff --stat",{"type":45,"value":1412},", and short line windows; broad repo-wide\n",{"type":40,"tag":83,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":45,"value":1389},{"type":45,"value":1419},", full diffs, generated-file searches, and wide ",{"type":40,"tag":83,"props":1421,"children":1423},{"className":1422},[],[1424],{"type":45,"value":1425},"sed",{"type":45,"value":1427}," ranges are last\nresorts.",{"type":40,"tag":70,"props":1429,"children":1430},{},[1431],{"type":45,"value":1432},"On resume, trust the latest handoff\u002Fprogress log unless a specific line must\nbe checked.",{"type":40,"tag":70,"props":1434,"children":1435},{},[1436],{"type":45,"value":1437},"After any large tool output, retain only theorem names, file\u002Fline pointers,\nfailing goals, and the concrete next patch.",{"type":40,"tag":48,"props":1439,"children":1440},{},[1441],{"type":45,"value":1442},"Prefer:",{"type":40,"tag":76,"props":1444,"children":1445},{},[1446,1451,1456,1461,1466,1471,1476,1487,1492,1511],{"type":40,"tag":70,"props":1447,"children":1448},{},[1449],{"type":45,"value":1450},"structural lemmas over syntax\u002Fcontrol contexts;",{"type":40,"tag":70,"props":1452,"children":1453},{},[1454],{"type":45,"value":1455},"one-step semantic interface lemmas;",{"type":40,"tag":70,"props":1457,"children":1458},{},[1459],{"type":45,"value":1460},"semantic classifiers for large opcode\u002Foperator families;",{"type":40,"tag":70,"props":1462,"children":1463},{},[1464],{"type":45,"value":1465},"small public wrapper theorems around imported or recursive definitions;",{"type":40,"tag":70,"props":1467,"children":1468},{},[1469],{"type":45,"value":1470},"explicit state\u002Flayout relations instead of massive record equalities;",{"type":40,"tag":70,"props":1472,"children":1473},{},[1474],{"type":45,"value":1475},"named intermediate definitions to share structure;",{"type":40,"tag":70,"props":1477,"children":1478},{},[1479,1485],{"type":40,"tag":83,"props":1480,"children":1482},{"className":1481},[],[1483],{"type":45,"value":1484},"simp only [...]",{"type":45,"value":1486}," with local simp sets;",{"type":40,"tag":70,"props":1488,"children":1489},{},[1490],{"type":45,"value":1491},"controlled unfolding of one definition at a time;",{"type":40,"tag":70,"props":1493,"children":1494},{},[1495,1497,1503,1504,1510],{"type":45,"value":1496},"narrow module builds: ",{"type":40,"tag":83,"props":1498,"children":1500},{"className":1499},[],[1501],{"type":45,"value":1502},"lake build Module.Name",{"type":45,"value":992},{"type":40,"tag":83,"props":1505,"children":1507},{"className":1506},[],[1508],{"type":45,"value":1509},"lake env lean path\u002FFile.lean",{"type":45,"value":291},{"type":40,"tag":70,"props":1512,"children":1513},{},[1514,1516,1522],{"type":45,"value":1515},"recursive theorem families whose structurally decreasing syntax argument comes\nearly in the argument list, with ",{"type":40,"tag":83,"props":1517,"children":1519},{"className":1518},[],[1520],{"type":45,"value":1521},"termination_by",{"type":45,"value":1523}," added before the proof grows.",{"type":40,"tag":48,"props":1525,"children":1526},{},[1527],{"type":45,"value":1528},"Avoid:",{"type":40,"tag":76,"props":1530,"children":1531},{},[1532,1545,1550,1563,1568,1573,1578,1583],{"type":40,"tag":70,"props":1533,"children":1534},{},[1535,1537,1543],{"type":45,"value":1536},"broad ",{"type":40,"tag":83,"props":1538,"children":1540},{"className":1539},[],[1541],{"type":45,"value":1542},"simp_all",{"type":45,"value":1544}," over compiler and interpreter definitions;",{"type":40,"tag":70,"props":1546,"children":1547},{},[1548],{"type":45,"value":1549},"unfolding imported dispatchers across many constructors;",{"type":40,"tag":70,"props":1551,"children":1552},{},[1553,1555,1561],{"type":45,"value":1554},"one theorem that case-splits over a large instruction set and tries many\n",{"type":40,"tag":83,"props":1556,"children":1558},{"className":1557},[],[1559],{"type":45,"value":1560},"first | change ...",{"type":45,"value":1562}," branches;",{"type":40,"tag":70,"props":1564,"children":1565},{},[1566],{"type":45,"value":1567},"exposing large recursive compiler definitions as global simp rules;",{"type":40,"tag":70,"props":1569,"children":1570},{},[1571],{"type":45,"value":1572},"proof terms that inline every compiled instruction or generated label;",{"type":40,"tag":70,"props":1574,"children":1575},{},[1576],{"type":45,"value":1577},"broad imports in theorem files;",{"type":40,"tag":70,"props":1579,"children":1580},{},[1581],{"type":45,"value":1582},"adding local heartbeats before checking whether the theorem\u002Finterface shape is\nwrong.",{"type":40,"tag":70,"props":1584,"children":1585},{},[1586],{"type":45,"value":1587},"continuing a proof whose statement has become a page of plumbing. Bundle the\ninvariant and prove the compiler supplies it.",{"type":40,"tag":48,"props":1589,"children":1590},{},[1591],{"type":45,"value":1592},"When widening primitive operations, classify by semantic family or require a\nsmall proof-carrying\u002Faccepted primitive interface. Prove PC\u002Fresource\u002Fstate\ninsensitivity once per family, then use a one-line wrapper per constructor. Do\nnot ask Lean to rediscover the same dispatcher facts for every opcode.",{"type":40,"tag":59,"props":1594,"children":1596},{"id":1595},"primitive-classifiers",[1597],{"type":45,"value":1598},"Primitive Classifiers",{"type":40,"tag":48,"props":1600,"children":1601},{},[1602],{"type":45,"value":1603},"For large primitive or opcode surfaces, introduce a small semantic-family API\nbefore broadening the source layer. This API should be a proof boundary, not a\nsecond unverified semantics.",{"type":40,"tag":59,"props":1605,"children":1607},{"id":1606},"documentation-and-logs",[1608],{"type":45,"value":1609},"Documentation And Logs",{"type":40,"tag":48,"props":1611,"children":1612},{},[1613],{"type":45,"value":1614},"Code and theorem statements are the source of truth. Before reporting status,\ninspect the actual theorem names, statements, public imports, and build output.",{"type":40,"tag":48,"props":1616,"children":1617},{},[1618,1623],{"type":40,"tag":83,"props":1619,"children":1621},{"className":1620},[],[1622],{"type":45,"value":118},{"type":45,"value":1624}," should stay sparse:",{"type":40,"tag":863,"props":1626,"children":1630},{"className":1627,"code":1628,"language":1629,"meta":868,"style":868},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Roadmap\n\n## Public Spine\n\nAccepted AST -> LayerA -> LayerB -> Target interpreter\n\n## Next Layer\n\n- [ ] Interface: syntax, semantics, WF, relation\n- [ ] Theorem-truth check and external\u002Fresource boundary\n- [ ] Complete source-faithful feature set for this layer\n- [ ] Lowering function\n- [ ] Adjacent same-observation theorem\n- [ ] Composed public theorem\n- [ ] Boundary checkpoint\n","markdown",[1631],{"type":40,"tag":83,"props":1632,"children":1633},{"__ignoreMap":868},[1634,1649,1658,1671,1678,1687,1694,1706,1713,1727,1740,1752,1765,1778,1791],{"type":40,"tag":874,"props":1635,"children":1636},{"class":876,"line":877},[1637,1643],{"type":40,"tag":874,"props":1638,"children":1640},{"style":1639},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1641],{"type":45,"value":1642},"# ",{"type":40,"tag":874,"props":1644,"children":1646},{"style":1645},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1647],{"type":45,"value":1648},"Roadmap\n",{"type":40,"tag":874,"props":1650,"children":1651},{"class":876,"line":886},[1652],{"type":40,"tag":874,"props":1653,"children":1655},{"emptyLinePlaceholder":1654},true,[1656],{"type":45,"value":1657},"\n",{"type":40,"tag":874,"props":1659,"children":1660},{"class":876,"line":895},[1661,1666],{"type":40,"tag":874,"props":1662,"children":1663},{"style":1639},[1664],{"type":45,"value":1665},"## ",{"type":40,"tag":874,"props":1667,"children":1668},{"style":1645},[1669],{"type":45,"value":1670},"Public Spine\n",{"type":40,"tag":874,"props":1672,"children":1673},{"class":876,"line":904},[1674],{"type":40,"tag":874,"props":1675,"children":1676},{"emptyLinePlaceholder":1654},[1677],{"type":45,"value":1657},{"type":40,"tag":874,"props":1679,"children":1680},{"class":876,"line":913},[1681],{"type":40,"tag":874,"props":1682,"children":1684},{"style":1683},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1685],{"type":45,"value":1686},"Accepted AST -> LayerA -> LayerB -> Target interpreter\n",{"type":40,"tag":874,"props":1688,"children":1689},{"class":876,"line":922},[1690],{"type":40,"tag":874,"props":1691,"children":1692},{"emptyLinePlaceholder":1654},[1693],{"type":45,"value":1657},{"type":40,"tag":874,"props":1695,"children":1696},{"class":876,"line":931},[1697,1701],{"type":40,"tag":874,"props":1698,"children":1699},{"style":1639},[1700],{"type":45,"value":1665},{"type":40,"tag":874,"props":1702,"children":1703},{"style":1645},[1704],{"type":45,"value":1705},"Next Layer\n",{"type":40,"tag":874,"props":1707,"children":1708},{"class":876,"line":940},[1709],{"type":40,"tag":874,"props":1710,"children":1711},{"emptyLinePlaceholder":1654},[1712],{"type":45,"value":1657},{"type":40,"tag":874,"props":1714,"children":1716},{"class":876,"line":1715},9,[1717,1722],{"type":40,"tag":874,"props":1718,"children":1719},{"style":1639},[1720],{"type":45,"value":1721},"-",{"type":40,"tag":874,"props":1723,"children":1724},{"style":1683},[1725],{"type":45,"value":1726}," [ ] Interface: syntax, semantics, WF, relation\n",{"type":40,"tag":874,"props":1728,"children":1730},{"class":876,"line":1729},10,[1731,1735],{"type":40,"tag":874,"props":1732,"children":1733},{"style":1639},[1734],{"type":45,"value":1721},{"type":40,"tag":874,"props":1736,"children":1737},{"style":1683},[1738],{"type":45,"value":1739}," [ ] Theorem-truth check and external\u002Fresource boundary\n",{"type":40,"tag":874,"props":1741,"children":1742},{"class":876,"line":27},[1743,1747],{"type":40,"tag":874,"props":1744,"children":1745},{"style":1639},[1746],{"type":45,"value":1721},{"type":40,"tag":874,"props":1748,"children":1749},{"style":1683},[1750],{"type":45,"value":1751}," [ ] Complete source-faithful feature set for this layer\n",{"type":40,"tag":874,"props":1753,"children":1755},{"class":876,"line":1754},12,[1756,1760],{"type":40,"tag":874,"props":1757,"children":1758},{"style":1639},[1759],{"type":45,"value":1721},{"type":40,"tag":874,"props":1761,"children":1762},{"style":1683},[1763],{"type":45,"value":1764}," [ ] Lowering function\n",{"type":40,"tag":874,"props":1766,"children":1768},{"class":876,"line":1767},13,[1769,1773],{"type":40,"tag":874,"props":1770,"children":1771},{"style":1639},[1772],{"type":45,"value":1721},{"type":40,"tag":874,"props":1774,"children":1775},{"style":1683},[1776],{"type":45,"value":1777}," [ ] Adjacent same-observation theorem\n",{"type":40,"tag":874,"props":1779,"children":1781},{"class":876,"line":1780},14,[1782,1786],{"type":40,"tag":874,"props":1783,"children":1784},{"style":1639},[1785],{"type":45,"value":1721},{"type":40,"tag":874,"props":1787,"children":1788},{"style":1683},[1789],{"type":45,"value":1790}," [ ] Composed public theorem\n",{"type":40,"tag":874,"props":1792,"children":1794},{"class":876,"line":1793},15,[1795,1799],{"type":40,"tag":874,"props":1796,"children":1797},{"style":1639},[1798],{"type":45,"value":1721},{"type":40,"tag":874,"props":1800,"children":1801},{"style":1683},[1802],{"type":45,"value":1803}," [ ] Boundary checkpoint\n",{"type":40,"tag":48,"props":1805,"children":1806},{},[1807,1812],{"type":40,"tag":83,"props":1808,"children":1810},{"className":1809},[],[1811],{"type":45,"value":126},{"type":45,"value":1813}," is append-only and flat:",{"type":40,"tag":863,"props":1815,"children":1817},{"className":1627,"code":1816,"language":1629,"meta":868,"style":868},"- 2026-05-12 18:17:26 - proof - proved `CompilerPreservation.block` and `compile_whole_program_sound_of_run`; command `lake build`; result green.\n- 2026-05-12 18:20:00 - architecture-risk - primitive widening proof unfolds full opcode dispatcher; replace with semantic family interface before adding more ops.\n",[1818],{"type":40,"tag":83,"props":1819,"children":1820},{"__ignoreMap":868},[1821,1887],{"type":40,"tag":874,"props":1822,"children":1823},{"class":876,"line":877},[1824,1828,1833,1838,1844,1848,1852,1856,1861,1865,1870,1874,1878,1882],{"type":40,"tag":874,"props":1825,"children":1826},{"style":1639},[1827],{"type":45,"value":1721},{"type":40,"tag":874,"props":1829,"children":1830},{"style":1683},[1831],{"type":45,"value":1832}," 2026-05-12 18:17:26 - proof - proved ",{"type":40,"tag":874,"props":1834,"children":1835},{"style":1639},[1836],{"type":45,"value":1837},"`",{"type":40,"tag":874,"props":1839,"children":1841},{"style":1840},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1842],{"type":45,"value":1843},"CompilerPreservation.block",{"type":40,"tag":874,"props":1845,"children":1846},{"style":1639},[1847],{"type":45,"value":1837},{"type":40,"tag":874,"props":1849,"children":1850},{"style":1683},[1851],{"type":45,"value":120},{"type":40,"tag":874,"props":1853,"children":1854},{"style":1639},[1855],{"type":45,"value":1837},{"type":40,"tag":874,"props":1857,"children":1858},{"style":1840},[1859],{"type":45,"value":1860},"compile_whole_program_sound_of_run",{"type":40,"tag":874,"props":1862,"children":1863},{"style":1639},[1864],{"type":45,"value":1837},{"type":40,"tag":874,"props":1866,"children":1867},{"style":1683},[1868],{"type":45,"value":1869},"; command ",{"type":40,"tag":874,"props":1871,"children":1872},{"style":1639},[1873],{"type":45,"value":1837},{"type":40,"tag":874,"props":1875,"children":1876},{"style":1840},[1877],{"type":45,"value":1360},{"type":40,"tag":874,"props":1879,"children":1880},{"style":1639},[1881],{"type":45,"value":1837},{"type":40,"tag":874,"props":1883,"children":1884},{"style":1683},[1885],{"type":45,"value":1886},"; result green.\n",{"type":40,"tag":874,"props":1888,"children":1889},{"class":876,"line":886},[1890,1894],{"type":40,"tag":874,"props":1891,"children":1892},{"style":1639},[1893],{"type":45,"value":1721},{"type":40,"tag":874,"props":1895,"children":1896},{"style":1683},[1897],{"type":45,"value":1898}," 2026-05-12 18:20:00 - architecture-risk - primitive widening proof unfolds full opcode dispatcher; replace with semantic family interface before adding more ops.\n",{"type":40,"tag":48,"props":1900,"children":1901},{},[1902,1904,1910,1911,1917,1918,1923,1924,1930,1931,1936,1937,1942,1943,1948,1949,1955,1956,1961,1963,1969],{"type":45,"value":1903},"Use tags such as ",{"type":40,"tag":83,"props":1905,"children":1907},{"className":1906},[],[1908],{"type":45,"value":1909},"proof",{"type":45,"value":101},{"type":40,"tag":83,"props":1912,"children":1914},{"className":1913},[],[1915],{"type":45,"value":1916},"test",{"type":45,"value":101},{"type":40,"tag":83,"props":1919,"children":1921},{"className":1920},[],[1922],{"type":45,"value":722},{"type":45,"value":101},{"type":40,"tag":83,"props":1925,"children":1927},{"className":1926},[],[1928],{"type":45,"value":1929},"bottleneck",{"type":45,"value":322},{"type":40,"tag":83,"props":1932,"children":1934},{"className":1933},[],[1935],{"type":45,"value":274},{"type":45,"value":101},{"type":40,"tag":83,"props":1938,"children":1940},{"className":1939},[],[1941],{"type":45,"value":289},{"type":45,"value":101},{"type":40,"tag":83,"props":1944,"children":1946},{"className":1945},[],[1947],{"type":45,"value":1221},{"type":45,"value":101},{"type":40,"tag":83,"props":1950,"children":1952},{"className":1951},[],[1953],{"type":45,"value":1954},"consolidation",{"type":45,"value":322},{"type":40,"tag":83,"props":1957,"children":1959},{"className":1958},[],[1960],{"type":45,"value":281},{"type":45,"value":1962},", and ",{"type":40,"tag":83,"props":1964,"children":1966},{"className":1965},[],[1967],{"type":45,"value":1968},"incident",{"type":45,"value":1970},". For risks and shortcuts, name the artifact, why it\nis risky, and the generic theorem\u002Finterface that should replace it.",{"type":40,"tag":48,"props":1972,"children":1973},{},[1974],{"type":45,"value":1975},"Keep logs current, not just append-heavy. When a bottleneck, shortcut, or risk\nis resolved or superseded, add a short entry saying so and name the replacing\ntheorem or interface. Do not leave stale warnings that still read as active.",{"type":40,"tag":59,"props":1977,"children":1979},{"id":1978},"git-preservation",[1980],{"type":45,"value":1981},"Git Preservation",{"type":40,"tag":48,"props":1983,"children":1984},{},[1985],{"type":45,"value":1986},"Use git to preserve meaningful theorem-bearing states. Commit only coherent\nmilestones, preferably green:",{"type":40,"tag":76,"props":1988,"children":1989},{},[1990,1995,2000,2005,2010,2015,2020],{"type":40,"tag":70,"props":1991,"children":1992},{},[1993],{"type":45,"value":1994},"initial Lean package setup;",{"type":40,"tag":70,"props":1996,"children":1997},{},[1998],{"type":45,"value":1999},"first target-reaching theorem;",{"type":40,"tag":70,"props":2001,"children":2002},{},[2003],{"type":45,"value":2004},"new public layer or theorem boundary;",{"type":40,"tag":70,"props":2006,"children":2007},{},[2008],{"type":45,"value":2009},"accepted-language\u002Ftheorem-boundary change;",{"type":40,"tag":70,"props":2011,"children":2012},{},[2013],{"type":45,"value":2014},"byte encoder or real-machine bridge;",{"type":40,"tag":70,"props":2016,"children":2017},{},[2018],{"type":45,"value":2019},"deletion of obsolete fixture\u002Fstory routes;",{"type":40,"tag":70,"props":2021,"children":2022},{},[2023],{"type":45,"value":2024},"audited stable proof milestone.",{"type":40,"tag":48,"props":2026,"children":2027},{},[2028,2030,2035],{"type":45,"value":2029},"Never revert user changes. Before pausing or finishing substantial work, run\n",{"type":40,"tag":83,"props":2031,"children":2033},{"className":2032},[],[2034],{"type":45,"value":88},{"type":45,"value":2036}," and make the handoff state clear.",{"type":40,"tag":59,"props":2038,"children":2040},{"id":2039},"anti-patterns",[2041],{"type":45,"value":2042},"Anti-Patterns",{"type":40,"tag":48,"props":2044,"children":2045},{},[2046],{"type":45,"value":2047},"Stop and repair the architecture if any of these appear:",{"type":40,"tag":76,"props":2049,"children":2050},{},[2051,2056,2061,2079,2084,2089,2094,2099,2104,2109,2114,2119,2160,2165],{"type":40,"tag":70,"props":2052,"children":2053},{},[2054],{"type":45,"value":2055},"full high-level language first, proofs later;",{"type":40,"tag":70,"props":2057,"children":2058},{},[2059],{"type":45,"value":2060},"theorem ends at an IR while the claim says end-to-end;",{"type":40,"tag":70,"props":2062,"children":2063},{},[2064,2066,2071,2072,2077],{"type":45,"value":2065},"special theorems for ",{"type":40,"tag":83,"props":2067,"children":2069},{"className":2068},[],[2070],{"type":45,"value":408},{"type":45,"value":410},{"type":40,"tag":83,"props":2073,"children":2075},{"className":2074},[],[2076],{"type":45,"value":1167},{"type":45,"value":2078}," or other combinations;",{"type":40,"tag":70,"props":2080,"children":2081},{},[2082],{"type":45,"value":2083},"fused feature lemmas become public proof routes instead of temporary private\nscaffolding;",{"type":40,"tag":70,"props":2085,"children":2086},{},[2087],{"type":45,"value":2088},"parser helper recognizes a whole story instead of independent constructs;",{"type":40,"tag":70,"props":2090,"children":2091},{},[2092],{"type":45,"value":2093},"semantic classifier or helper interpreter used as if it were the real target\nwithout an equality\u002Frefinement theorem;",{"type":40,"tag":70,"props":2095,"children":2096},{},[2097],{"type":45,"value":2098},"source semantics changed to match a compiler bug;",{"type":40,"tag":70,"props":2100,"children":2101},{},[2102],{"type":45,"value":2103},"broad public imports retain obsolete compiler routes;",{"type":40,"tag":70,"props":2105,"children":2106},{},[2107],{"type":45,"value":2108},"concrete external-world simulation is used where an open protocol is the real\ntheorem boundary;",{"type":40,"tag":70,"props":2110,"children":2111},{},[2112],{"type":45,"value":2113},"observed target resources such as gas are patched by replay\u002Ffuture-answer\noracles instead of source semantics, acceptance rejection, or explicit\nsource-facing premises;",{"type":40,"tag":70,"props":2115,"children":2116},{},[2117],{"type":45,"value":2118},"wrapper, adapter, callback, or compatibility-route churn continues without\nreducing public assumptions;",{"type":40,"tag":70,"props":2120,"children":2121},{},[2122,2124,2130,2131,2137,2139,2145,2146,2151,2152,2158],{"type":45,"value":2123},"proof relies on ",{"type":40,"tag":83,"props":2125,"children":2127},{"className":2126},[],[2128],{"type":45,"value":2129},"sorry",{"type":45,"value":101},{"type":40,"tag":83,"props":2132,"children":2134},{"className":2133},[],[2135],{"type":45,"value":2136},"admit",{"type":45,"value":2138},", new ",{"type":40,"tag":83,"props":2140,"children":2142},{"className":2141},[],[2143],{"type":45,"value":2144},"axiom",{"type":45,"value":101},{"type":40,"tag":83,"props":2147,"children":2149},{"className":2148},[],[2150],{"type":45,"value":320},{"type":45,"value":101},{"type":40,"tag":83,"props":2153,"children":2155},{"className":2154},[],[2156],{"type":45,"value":2157},"partial",{"type":45,"value":2159},", or\nproof-critical external assumptions without excluding them from the claim;",{"type":40,"tag":70,"props":2161,"children":2162},{},[2163],{"type":45,"value":2164},"tests or external review are treated as verification;",{"type":40,"tag":70,"props":2166,"children":2167},{},[2168],{"type":45,"value":2169},"Lean timeout is answered by adding more feature code.",{"type":40,"tag":59,"props":2171,"children":2173},{"id":2172},"completion-gate",[2174],{"type":45,"value":2175},"Completion Gate",{"type":40,"tag":48,"props":2177,"children":2178},{},[2179],{"type":45,"value":2180},"Do not call the compiler verified because tests pass, the compiler runs, or a\nscaffold theorem exists.",{"type":40,"tag":48,"props":2182,"children":2183},{},[2184],{"type":45,"value":2185},"Before reporting a verified milestone:",{"type":40,"tag":66,"props":2187,"children":2188},{},[2189,2194,2199,2204,2216,2251,2256,2261,2279,2284],{"type":40,"tag":70,"props":2190,"children":2191},{},[2192],{"type":45,"value":2193},"Inspect the accepted compiler path.",{"type":40,"tag":70,"props":2195,"children":2196},{},[2197],{"type":45,"value":2198},"Name the exact top theorem(s).",{"type":40,"tag":70,"props":2200,"children":2201},{},[2202],{"type":45,"value":2203},"Run the narrowest meaningful build command, and full build when practical.",{"type":40,"tag":70,"props":2205,"children":2206},{},[2207,2209,2214],{"type":45,"value":2208},"Run ",{"type":40,"tag":83,"props":2210,"children":2212},{"className":2211},[],[2213],{"type":45,"value":799},{"type":45,"value":2215}," or the local equivalent on public top theorem(s) when\npractical.",{"type":40,"tag":70,"props":2217,"children":2218},{},[2219,2221,2226,2227,2232,2233,2238,2239,2244,2245,2250],{"type":45,"value":2220},"Scan for ",{"type":40,"tag":83,"props":2222,"children":2224},{"className":2223},[],[2225],{"type":45,"value":2129},{"type":45,"value":101},{"type":40,"tag":83,"props":2228,"children":2230},{"className":2229},[],[2231],{"type":45,"value":2136},{"type":45,"value":101},{"type":40,"tag":83,"props":2234,"children":2236},{"className":2235},[],[2237],{"type":45,"value":2144},{"type":45,"value":101},{"type":40,"tag":83,"props":2240,"children":2242},{"className":2241},[],[2243],{"type":45,"value":320},{"type":45,"value":1962},{"type":40,"tag":83,"props":2246,"children":2248},{"className":2247},[],[2249],{"type":45,"value":2157},{"type":45,"value":291},{"type":40,"tag":70,"props":2252,"children":2253},{},[2254],{"type":45,"value":2255},"Check public imports for obsolete fixture\u002Fstory\u002Flegacy routes.",{"type":40,"tag":70,"props":2257,"children":2258},{},[2259],{"type":45,"value":2260},"Check public theorem arguments for compiler-generated certificates or layout\nevidence. They must be discharged by checked constructors, be private helper\ninputs, or be explicitly named as trusted external inputs approved by the\nuser. Otherwise keep working.",{"type":40,"tag":70,"props":2262,"children":2263},{},[2264,2266,2271,2272,2277],{"type":45,"value":2265},"Inspect ",{"type":40,"tag":83,"props":2267,"children":2269},{"className":2268},[],[2270],{"type":45,"value":488},{"type":45,"value":459},{"type":40,"tag":83,"props":2273,"children":2275},{"className":2274},[],[2276],{"type":45,"value":495},{"type":45,"value":2278}," records used by the public theorem. They must not\nsmuggle in compiler-output equality, label layout, replay certificates,\ncall\u002Freturn layout, generated-token uniqueness, or semantic preservation\noracles. They also must not exclude lower-layer capabilities merely because\nthe representation or proof is unfinished. If they do, split those fields out\nand discharge them, explicitly narrow the requested source language with the\nuser, or keep the milestone incomplete.",{"type":40,"tag":70,"props":2280,"children":2281},{},[2282],{"type":45,"value":2283},"Check that resource and external-effect premises are source-facing or\nactual-trace-derived, not globally quantified target facts.",{"type":40,"tag":70,"props":2285,"children":2286},{},[2287],{"type":45,"value":2288},"State remaining assumptions and unsupported features plainly.",{"type":40,"tag":48,"props":2290,"children":2291},{},[2292],{"type":45,"value":2293},"The goal is complete only when every source-language feature in the requested\nscope has a checked path from trusted input or AST through acceptance,\nsemantics, compiler\u002Flowering, target interpreter, and theorem. If a fragment was\nexplicitly requested, say so in the theorem names or surrounding API and audit\nthe fragment boundary. Otherwise report the current work as a theorem-bearing\nmilestone and keep working on the missing source semantics.",{"type":40,"tag":59,"props":2295,"children":2297},{"id":2296},"references",[2298],{"type":45,"value":2299},"References",{"type":40,"tag":48,"props":2301,"children":2302},{},[2303],{"type":45,"value":2304},"Load only when useful:",{"type":40,"tag":76,"props":2306,"children":2307},{},[2308,2319],{"type":40,"tag":70,"props":2309,"children":2310},{},[2311,2317],{"type":40,"tag":83,"props":2312,"children":2314},{"className":2313},[],[2315],{"type":45,"value":2316},"references\u002Fverified-compiler-patterns.md",{"type":45,"value":2318},": theorem-boundary patterns and\nclassic verified-compiler references.",{"type":40,"tag":70,"props":2320,"children":2321},{},[2322,2328],{"type":40,"tag":83,"props":2323,"children":2325},{"className":2324},[],[2326],{"type":45,"value":2327},"references\u002Fprocess-lessons.md",{"type":45,"value":2329},": earlier process failures to avoid.",{"type":40,"tag":2331,"props":2332,"children":2333},"style",{},[2334],{"type":45,"value":2335},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2337,"total":877},[2338],{"slug":4,"name":4,"fn":5,"description":6,"org":2339,"tags":2340,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2341,2342,2343],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"items":2345,"total":877},[2346],{"slug":4,"name":4,"fn":5,"description":6,"org":2347,"tags":2348,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2349,2350,2351],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16}]