Definitions and Assumptions

Which of these does the algebraic Lorentz theorem need: $\lvert v\rvert<1$, $\gamma>0$, $c=1$, or $\gamma=1/\sqrt{1-v^2}$?

None of them. The Lean statement takes four real numbers and one hypothesis, $\gamma^2(1-v^2)=1$:

theorem lorentzIntervalInvariantAlgebraic
    (t x v gamma : ℝ)
    (hgamma : gamma ^ 2 * (1 - v ^ 2) = 1) : ...

A reader who “knows” that boosts need $\lvert v\rvert<1$ may assume the theorem uses it. It does not. The opposite mistake is worse: the physical theorem does need $\lvert v\rvert<1$, because without it $1-v^2$ can be zero or negative, and then $\sqrt{1-v^2}$ is not a real number. Whether a condition carries weight is a fact about one specific claim, and the claim contract from Chapter 1 is where that fact is written down.

This chapter shows how. Every assumption in a claim carries an ID, a canonical formula and a role, and the roles are what make hidden conditions visible.

Five roles

The claim model defines five roles for an assumption (AssumptionRole): axiom, definition, domain, side_condition and derived.

Here is how the case-study claims file their assumptions:

The same formula in three roles

The point of the roles is that one formula can change status from claim to claim.

• In the algebraic claim, $\gamma^2(1-v^2)=1$ is an axiom. It is simply assumed.
• In the gamma bridge, it is the conclusion.
• The physical claim (1.1.0) composes the two. It assumes the definition and the side condition, and the bridge turns them into the algebraic claim’s axiom. In the physical claim the formula is therefore an intermediate result, derived on the way, even though no assumption is filed with the derived role.

Nothing was assumed twice, and nothing was assumed silently.

The same formula, three roles. The role belongs to the claim, not to the symbols.

Which step uses which hypothesis

Spell out the physical proof one step at a time:

1. $\lvert v\rvert<1$ gives $-1< v<1$, so $0<1+v$ and $0<1-v$, and therefore $0<1-v^2$.
2. With $0<1-v^2$, $\sqrt{1-v^2}$ is a positive real and $\left(\sqrt{1-v^2}\right)^2 = 1-v^2$.
3. Then $\gamma^2(1-v^2) = \left(1/\sqrt{1-v^2}\right)^2(1-v^2) = \frac{1}{1-v^2}(1-v^2) = 1$.
4. With $\gamma^2(1-v^2)=1$, the interval expansion closes (Chapter 20).

Steps 1 to 3 are the bridge; they use the side condition and the definition. Step 4 uses only the axiom. The Lean proof of the bridge follows this order literally: it derives $0<1-v^2$ from $\lvert v\rvert<1$ before it touches the square root.

Delete a hypothesis and watch what breaks

Hidden assumptions are easiest to see by removing one.

• Delete hgamma from the algebraic theorem. The statement becomes false for most values of $\gamma$, and no proof exists.
• Delete hv : |v| < 1 from the bridge. Now something subtler happens. In Lean, Real.sqrt of a negative number is defined: Mathlib’s convention makes it zero. So $\gamma = 1/\sqrt{1-v^2}$ becomes $1/0$, which Lean also defines as $0$, and $\gamma^2(1-v^2)$ comes out as $0$, not $1$. The side condition is doing real work, and its absence produces no error message, only a silently wrong value.

This was executed on 2026-11-09 with Lean 4.35.0 and Mathlib v4.35.0, using ch02_lean_sqrt_demo.lean:

#check Real.sqrt_eq_zero_of_nonpos
#check div_zero

theorem sqrt_negative_is_zero : Real.sqrt (-3 : ℝ) = 0 := by
  simp [Real.sqrt_eq_zero_of_nonpos]

theorem gamma_relation_fails_at_two :
    (1 / Real.sqrt (1 - (2 : ℝ)^2))^2 * (1 - (2 : ℝ)^2) = 0 := by
  norm_num [Real.sqrt_eq_zero_of_nonpos]

Both declarations elaborate with exit code 0. The helper facts are Real.sqrt_eq_zero_of_nonpos and div_zero. The example is illustrative, not a versioned claim.

Assumptions the claim does not list

Roles cover the assumptions a claim states. Two other kinds sit underneath.

The axioms of the logic. The kernel proofs (Chapter 20) depend on axioms of the proof assistant itself. Lean uses propext, Classical.choice and Quot.sound; Rocq uses sig_forall_dec and functional_extensionality_dep (and sig_not_dec for the bridge). Those are assumptions too, and the engine audits them rather than hiding them.

Assumptions a tool adds. A formalization binding may introduce assumptions that are not in the claim (introduced_assumptions). The R3 audit found a practical consequence. The SymPy binding for the gamma claim quantifies only over $v$, because its proposition substitutes $\gamma$; the claim-level, Lean and Rocq bindings quantify over both $v$ and $\gamma$. The gamma contract was bumped to 1.1.0 to make $\gamma$ explicit. Different tools carry different quantifier structure for the “same” claim, so the audit compares them instead of trusting the label. A second difference: the Rocq bridge interface abstracts the square-root law over R, while the Lean bridge abstracts the whole ordered field.

What this establishes

Roles are recorded in each claim file, so which conditions a claim uses is a checkable fact rather than a reader’s guess. The step-by-step reading of the bridge above is the author’s reading of the Lean proof; no independent reviewer is recorded.

Assumptions such as $c=1$ and the definition of $\gamma$ encode choices of units and parameterization, not physical findings. The postulates of special relativity are a different layer of assumption (Chapter 18), and these claims do not formalize them.

Try it yourself

uv run python scripts/ci_equivalence_audit.py

This is the static R3 statement audit; it needs only Python.

Seeded error. Change gamma-subluminal-speed from abs(v)<1 to abs(v)<=1 in the gamma claim. The audit should report a mismatch against the kernel-elaborated statements, which still say <. (Not run for this edition.)

Exercise. Take $v = 3/5$. Compute $1-v^2$, then $\gamma = 1/\sqrt{1-v^2}$, then $\gamma^2(1-v^2)$. Now repeat with $v=2$ using Lean’s conventions ($\sqrt{\text{negative}} = 0$ and $1/0 = 0$). Which hypothesis of the bridge failed in the second case? (Answers: $16/25$, $5/4$, $1$; then $-3$, $0$, $0$; the side condition $\lvert v\rvert<1$.)

Open questions.

1. Is the physical claim at $\lvert v\rvert=1$ meaningful in any limit sense? The contract excludes it, and nothing here discusses the limit.
2. Should derived assumptions appear in a claim whose dependencies are other claims? None of the current claims use them.
3. Where does the project record that $c=1$ is a choice? Today it is a definition-role assumption, and there is no dimensional-analysis check.

Sources

The algebraic claim cites physlib-lorentz-group, the Physlib Community’s Physlib: The Lean Physics Library (2024), https://github.com/leanprover-community/physlib. The physical claim cites einstein-1905, Albert Einstein, “Zur Elektrodynamik bewegter Körper”, Annalen der Physik (1905), https://doi.org/10.1002/andp.19053221004. Each assumption in a claim file lists its own source_ids.