Research · Papers · Formal verification and machine-checked proof · MF-006
Simultaneous and cyclic witness definitions in the Lean 4.28 kernel
Lean 4.28 accepts simultaneous and cyclic witness definitions with soundness, completeness, exact cost, computable witnesses, no sorryAx
Published 2026-08-29
For everyone
Plain summary
This entry checks whether Lean can accept witness definitions that refer to one another in loops. A witness is data showing that a construction meets its required conditions. Simultaneous definitions set up witnesses together, while cyclic definitions let their references form closed loops. The pinned Lean 4.28 proof kernel accepts both patterns. An independent replay verified six theorem receipts using only permitted axioms, with zero placeholder gaps (sorryAx). The replay confirmed soundness, completeness, exact costs, and computable witnesses. This result establishes the permitted envelope of the zkgolf verifier, which the register notes licensed the entire relational program. The page verdict is SHOW. The register records no novelty claims or prior-art comparisons.
Result
Under the pinned Lean 4.28 kernel, simultaneous and cyclic witness definitions are accepted with soundness, completeness, exact cost, and computable witnesses. Six theorem receipts replay on permitted axioms only, with no sorryAx.
Setting and definitions
A witness definition supplies the witness data used by the verifier to establish target properties. Simultaneous definitions introduce mutually dependent witnesses in a single definition block; cyclic definitions allow these dependency graphs to contain cycles. The verifier's legal envelope denotes the class of witness definitions and proof obligations accepted by the kernel.
The result tracks four obligations: soundness (accepted witnesses satisfy the target specification), completeness (the representation covers all intended witnesses), exact cost (witness cost metrics are preserved without slack), and computability (witnesses can be generated algorithmically). The axiom sorryAx denotes an admitted proof gap in Lean.
Method
Verification proceeds by replaying six theorem receipts directly through the pinned Lean 4.28 kernel. The theorem-level acceptance criteria cover soundness, completeness, exact cost, and computability under simultaneous and cyclic witness definitions.
An independent Lean 4.28 replay audit, available in this paper's downloadable evidence pack, documents verification across all six proofs. Replay tests the definitions at the kernel boundary using only permitted axioms, confirming the complete absence of sorryAx. The audit verifies the raw proof terms rather than informal summaries, establishing that cyclic dependency structures remain inside the verifier's legal envelope.
Discussion
MF-006 functions as a capability theorem for the zkgolf verifier: the system admits simultaneous and cyclic witness definitions while preserving soundness, completeness, exact cost, and witness computability across the replayed receipts. Per the register, this result licensed the entire relational program.
Scope is strictly limited to the pinned Lean 4.28 kernel and the six designated theorem receipts. The entry does not claim general acceptance of cyclic definitions across arbitrary proof assistants, nor does it certify unlisted witness constructions. Curation records list no scope flags, restorations, or withdrawn novelty claims, and no corrections are recorded. The register states no prior-art comparison or novelty claim.
The verdict is SHOW, supported by a complete kernel replay under permitted axioms.
For everyone — the takeaway
What this means
Lean can safely check definitions that reference each other in cycles. Many relational models are easiest to write this way, so knowing the verifier allows them without breaking guarantees is essential. The pinned Lean kernel passed all six proof receipts without shortcuts or unproved gaps. This sets a clear, verified boundary for how witness programs can be structured in zkgolf. It doesn't apply to other proof assistants or untested programs, but it proves the verifier handles these specific cyclic definitions cleanly.
Register references
MF-006
HANDOFF §2.7
phase_trellis_p5_verifier_legality_audit.json
Prior art: the register does not record this.
Every artifact named above is bundled in, or hashed by, this paper's evidence pack below.
Evidence pack
Everything needed to check this entry against its receipts: the register text, a manifest with a SHA-256 hash for every named receipt, and 1 of 1 receipt files bundled (6 KB). Anything not bundled is still hashed in the manifest and lives in the compute-box working trees.
Changelog
Last reviewed 2026-08-29
- 2026-08-29Published on this site.