Rocq as an Independent Kernel

Two kernels accepted a theorem about the square root. Does that show the theorem is right?

Only if both are about the same square root. Lean’s Real.sqrt comes from Mathlib, built on one construction of the real numbers. Rocq’s sqrt comes from its standard library, built on another. If the two constructions differed on some input, both kernels could accept their own statement and still disagree about the physics. The project has not proved that they agree. The accepted report says so, and attaches the conclusion semantic_equivalence_not_established to the gamma pair.

A second kernel reduces the chance that a proof-checking bug goes unnoticed. It does not, by itself, make the two statements equal. This chapter explains what an independently written second kernel buys, what it does not, and how the engine measures how close two formalizations are. It builds on Chapter 3 and Chapter 11.

The Rocq theorems

Reconstruction, not transliteration

The Rocq proofs were reconstructed, not translated line by line from Lean. The two algebraic proofs show what that means: the same statement by a different route.

Lean:

calc
  (gamma * (t - v * x)) ^ 2 - (gamma * (x - v * t)) ^ 2 =
      (gamma ^ 2 * (1 - v ^ 2)) * (t ^ 2 - x ^ 2) := by ring
  _ = 1 * (t ^ 2 - x ^ 2) := by rw [hgamma]
  _ = t ^ 2 - x ^ 2 := by ring

Rocq:

intros t x v gamma Hgamma.
replace ((gamma * (t - v * x)) ^ 2 - (gamma * (x - v * t)) ^ 2)
  with ((gamma ^ 2 * (1 - v ^ 2)) * (t ^ 2 - x ^ 2)) by ring.
rewrite Hgamma.
ring.

They share the idea (factor out $\gamma^2(1-v^2)$, then rewrite) and are otherwise different programs. The bridge proofs differ more:

(Read from source; also compiled in Docker on 2026-11-09.)

Different lemma names, different tactics, a different library underneath. Had one proof been mechanically translated from the other, a shared mistake would have carried across. That they were written separately is what earns the word “independent”.

How independent is it, really?

Partly, and it is worth being exact about which parts:

• Independent kernels. Lean and Rocq are separate implementations with separate trust bases. (General background, not from the repository.)
• Independent proofs. Written separately, as above.
• Not independent statements. The same project, the same author and the same contract wrote both. A misreading of the claim would be shared.
• Not proved-equivalent libraries. The real-number constructions differ, and nobody has proved them equivalent.
• Not independent reviewers. No human review of either proof is recorded.

How close are the two formalizations?

The R3 audit gives the engine a vocabulary for “how much do these two agree”, so that the claim never quietly grows. Chapter 15 presents this ladder in full; here is where the Lean and Rocq pair stands:

The audit’s own finding for the algebraic theorem is that both proof scripts use ring normalization only, with no order, square-root or division reasoning, so the identity is a polynomial identity valid in any commutative ring. That finding comes from inspecting the scripts; L2 is then kernel-checked as an interface theorem. It is why the algebraic pair is the stronger cross-kernel result, and the gamma pair, which touches the square root, the weaker one.

Checking that the kernel can say no

Both negative controls are in the repository. fixtures/Incomplete.v is an Admitted. theorem that the adapter’s pattern \bAdmitted\s*\. rejects. fixtures/KernelRejected.v states (1 = 2)%R and tries reflexivity; the real kernel is required to reject it (scripts/ci_kernel_rejection.py). The adapter’s Rocq patterns are Admitted., admit and Axiom.

What this establishes

Two accepted proofs in different systems are real, if modest, evidence against a proof-checker bug, and against a Lean-specific convention (such as the junk values of Chapter 11) doing hidden work. They are not evidence that the model matches nature, and they are not a proof that the two formalizations are equivalent.

This chapter is the cross-system audit for the formal pair. The machine-checked parts are L1 and L2. The unproved part is L3, and nothing in this book should suggest otherwise. The Rocq proofs were read from source and compiled in Docker; no independent human review is recorded.

Try it yourself

The accepted Rocq sources can be compiled from a copy in the pinned image rocq/rocq-prover:9.0.1. This was done on 2026-11-09:

docker run --rm \
  -v "$PWD/formal/rocq:/work:ro" -w /tmp \
  rocq/rocq-prover:9.0.1 \
  bash -lc 'cp -r /work /tmp/rocq && cd /tmp/rocq && \
    rocq compile LorentzInterval.v && \
    rocq compile GammaBridge.v && \
    rocq compile PhysicalComposition.v && \
    rocq compile EuclidI47Coordinate.v && \
    rocq compile PythagoreanRepair.v && \
    rocq compile PrintAssumptionsAlgebraic.v && \
    rocq compile PrintAssumptionsBridge.v && \
    rocq compile PrintAssumptionsPhysical.v'

The five theorem sources and the three PrintAssumptions drivers compiled, and the printed axiom inventories matched the recorded sets. On a host installation, the older path is:

cd formal/rocq
rocq compile LorentzInterval.v
rocq compile GammaBridge.v
rocq compile PrintAssumptionsAlgebraic.v
rocq compile PrintAssumptionsBridge.v

(Older installations use coqc.)

Seeded error. Change 1 - v ^ 2 to 1 + v ^ 2 in the first replace. The ring side goal should fail.

Open questions.

1. What would an L3 proof look like: a bijection between the two constructions of the reals that commutes with $+$, $\times$, order and the square root? Is it a research task or an engineering one?
2. Rocq’s behaviour for the square root of a negative real and for division by zero has not been checked in this edition against the Lean findings of Chapter 11. Do they match?
3. If an independent reviewer found a flaw in the shared statement, which of the engine’s records would show it, and which would still say formally_verified?

Evidence record

From the accepted R2 report (2026-10-23), Rocq 9.0.1: math01-rocq-algebraic-kernel-check-v1 and math01-rocq-gamma-bridge-kernel-check-v1, both succeeded and formally_verified. Kernel axioms recorded by Print Assumptions:

The names suggest that Rocq’s classical-real layer sits over a constructive construction of the reals, a different foundation from Mathlib’s. (This is an inference from the axiom names, not a statement in the repository.) The audit script enforces these exact sets and fails on Admitted or an unexpected Axiom.

In CI the Rocq lane runs on Windows with Rocq 9.0.1, and the full report job uses opam-installed Rocq 9.0.1 on Ubuntu. Rocq 9.3.0 was not executed.

The Docker compile above used image digest sha256:3ed9c46fa02e9fd7748a959abebb11b36f8818d10738dcc93edc67354c313ce2, which reports Rocq 9.0.1. It is a local, illustrative reproduction of the accepted Rocq evidence, not a new EvidenceResult; the accepted R2 hosted record remains the evidence source.

Sources

• The Rocq Development Team, The Rocq Prover Reference Manual, Version 9.0 (2025), https://rocq-prover.org/doc/v9.0/refman/
• Yves Bertot and Pierre Castéran, Interactive Theorem Proving and Program Development: Coq’Art (Springer, 2004). The system was called Coq before 2025; the book keeps that name for its history and uses Rocq for the pinned 9.0.1 behaviour.

No specific page is cited for Reals, sqrt or Print Assumptions. In the repository: formal/rocq/, docs/research/MATH01-R3-equivalence-audit.md and docs/research/MATH01-R2-evidence.md.