Formal verification and machine-checked proof

What this programme is about

When engineers optimize cryptographic circuits or simplify logic networks, hand calculations and monolithic automated solvers often fail, either by timing out or by hiding errors. This programme asks how we can mechanically certify that a digital circuit or witness construction is sound, complete, and functionally identical to its specification. Machine-checked proof replaces human trust with code verified down to an independent core. For anyone building cryptographic hardware or compilers outside this field, a result here buys complete certainty. An optimized component comes with an auditable proof object that verifies in seconds, guaranteeing that the circuit never miscalculates an output or leaks an unproved assumption into production systems.

What has been settled

Settled work divides into circuit equivalence tooling, kernel foundation checks.

For circuit equivalence, MF-016 establishes a receipted method for large cryptographic circuits. When monolithic bv_decide runs become intractable, cone-local proofs transported through existing semantic theorems compile without sorryAx in seconds to minutes. Extending this approach, MF-093 supplies CourtXAG, a Lean-checked prototype that binds local equivalence evidence and an explicit port map to end-to-end output equality along with exact structural and cost invariants. Using zero axioms in Lean 4.28, CourtXAG proves equivalence between a 30,003-gate reference hierarchy and a 20,002-gate optimized hierarchy. The register notes no prior-art claim for MF-093, treating it as a layer around existing solvers that extends MF-016. Neither MF-016 nor MF-093 lists corrections.

At the kernel level, MF-006 confirms that the pinned Lean 4.28 kernel accepts simultaneous and cyclic witness definitions. It delivers soundness, completeness, exact cost, and computable witnesses with no sorryAx. The entry records no corrections and states no prior-art comparison or novelty claim.

For finite relational checks, MF-027 provides an exhaustive-check verifier audit for finite phase-trellis relations. Its subset construction gives exact completeness, soundness, and Court-Zero legality checks. In these checks, the tested natural sample and the ITER19 K0 adapter fail soundness. The finding carries no corrections and states no prior-art position.

What is still open

One open conjecture stands on the limits ledger under ML-030. Within the verifier-level Phase-Trellis P5 model class, checker replays confirm Court Zero legality, and the fixed ITER19 K0 relation admits an exact adapter. The model currently lacks verified soundness. Both the natural-hull sample and the fixed ITER19 K0 adapter fail soundness checks, while alternative trellises remain untested. The register records no corrections and states no prior-art position for the conjecture.

How to read the evidence

Machine certificates and receipted execution logs dominate this programme's settled findings, accompanied by exhaustive checks. A Lean-verified result depends solely on the pinned Lean kernel checking proofs with zero unproved axioms (no sorryAx). That eliminates pencil-and-paper calculation slips. Receipts log verified solver runtimes, and exhaustive checks evaluate finite relation spaces completely. Readers can place high confidence in the proved circuit transformations and kernel witness definitions, while treating open conjectures like ML-030 as unverified pending sound models.