The Claim Before the Proof

“Lorentz boosts preserve the interval.” Is that true?

It depends on which sentence you mean.

• If $\gamma$ is any real number with $\gamma^2(1-v^2)=1$, yes, by a three-line expansion.
• If $\gamma$ is defined as $1/\sqrt{1-v^2}$, it takes an extra argument, and it needs $\lvert v\rvert<1$ so that the square root is real and nonzero.
• If “preserve” means that the physical world obeys the formula, no theorem settles it.

One sentence, three claims. A tool that reports “verified” for the sentence has told you nothing until you know which claim it checked. The design record behind the engine puts it plainly: the same sentence “can acquire materially different meanings when translated to SymPy, Z3, Lean, Rocq, or Isabelle,” and “a proof may also be correct under a stronger assumption than the prose disclosed.”

So the engine’s primary object is not a proof. It is a versioned claim: a record that says exactly which statement is meant, so that every proof, solver run and counterexample can be attached to that statement and no other. This chapter introduces that record and the fingerprint that ties evidence to it. Every later chapter depends on both.

One sentence, three claims. The gamma bridge is a fourth, separate claim that links the first two; the empirical reading stays outside every proof.

Why the split matters

Expanding the boost $t'=\gamma(t-vx)$, $x'=\gamma(x-vt)$ gives

These are its claims:

Each row is a separate object with its own evidence. The opening sentence has been split into the first three, and the version numbers already hint at the second idea of this chapter: when a claim’s meaning changes, it becomes a new version, and evidence for the old version does not carry over.

What a claim contains

A claim is a frozen record (Claim, in models.py). Its fields, in the order they matter:

The record forbids unknown fields and checks its internal references when it loads. An assumption that cites an unknown source, or a formalization that cites an unknown assumption, fails to load.

The formalizations field deserves a word now, because it is easy to over-read. Each binding states the quantifiers, assumption IDs, units and conventions one tool will use, and exposes a hash over them (contract_signature()). Two bindings with the same signature are declared aligned. The code’s own documentation is careful here: the binding “is evidence about intent, not a proof of semantic equivalence.” Chapter 15 is about the gap between those two things.

The fingerprint

How does a proof know which claim it proves? Through a hash.

Claim.fingerprint is the SHA-256 of the claim’s canonical JSON, with provenance left out. Every EvidenceResult stores the claim ID, the version and the fingerprint it was produced for, and assess_claim counts only evidence whose three values all match. Evidence from any other version is stale by default.

Here is what happens to the fingerprint of the committed claim lorentz-interval-invariance-1d-algebraic@1.0.0 under small edits (executed ad hoc, not recorded in an evidence bundle):

Two consequences follow. A prose edit counts as a change, because the engine cannot tell a harmless rewording from a changed meaning. And the fingerprint protects against silent drift: an old proof cannot be attached to a revised claim without someone noticing, because the hashes disagree.

What it does not protect against is a wrong claim. The fingerprint says that evidence and claim match. It says nothing about whether the claim says what you meant. Getting that right is the work of the next two chapters.

What this establishes

This chapter presents a data model, not a proof, so there is no derivation for a human to review. The behaviours described (the fingerprint excludes provenance and includes the prose) were observed by executing the model, not by reading its tests.

A claim contract is bookkeeping. It makes disagreement between tools visible; it does not make anything true. In particular it does not say that the physical claim describes nature. That is a separate question, taken up in Chapter 4.

The design record also lists the alternatives it rejected:

• a single boolean verified field, judged “too coarse”;
• majority voting among tools, because “a mistranslation can make every tool agree on the wrong proposition”;
• letting an AI judge its own proof text.

Try it yourself

uv sync --all-groups --locked
uv run pytest tests/test_models.py

Seeded error. Edit any assumption’s canonical_formulation in a claim file and re-run the report consistency check. Stored evidence should be reported as stale, not silently reused. (This edition did not run that check; confirm it before relying on it.)

Exercise. Expand $\gamma^2(t-vx)^2 - \gamma^2(x-vt)^2$ by hand and confirm that it equals $\gamma^2(1-v^2)(t^2-x^2)$. Which terms cancel?

Open questions.

1. Is it right that a prose-only edit changes the fingerprint? A claim author may want a prose-only change to be free.
2. What goes wrong if provenance were included? What if human_statement were excluded?
3. Can two claims with different canonical formulations still mean the same thing? The fingerprint says they differ; only a proof of equivalence says otherwise.

Evidence record

The accepted R2 report records, for the first three claims, the statuses formally_verified (algebraic, and gamma at 1.0.0) and computation_verified_within_stated_domain (physical at 1.0.0). It records no kernel proof of the physical claim at 1.0.0, and says why: the composition was an open obligation at the time. Version 1.1.0 of the physical claim, with $\gamma$ quantified explicitly, is the claim after the R4 revision. Chapter 20 has the full table.

Sources

The design rationale is ADR 0001 — Evidence-first, versioned claim contracts (accepted 2026-10-22). The claim model is in src/math_engine/models.py.