The Cross-System Claim Contract

Here is what the engine reports when it compares three tools’ versions of the gamma-relation claim at version 1.1.0 (executed):

gamma-sympy-v1 <-> gamma-lean4-v1   declared_mismatch   ['quantifiers']
gamma-sympy-v1 <-> gamma-rocq-v1    declared_mismatch   ['quantifiers']
gamma-lean4-v1 <-> gamma-rocq-v1    semantic_equivalence_not_established

The SymPy check and the Lean check are both of “the same” gamma claim, and the engine says their contracts do not match. The reason is concrete. The SymPy binding substitutes the defining equation $\gamma = 1/\sqrt{1-v^2}$ into the expression, so it quantifies only over $v$. The Lean and Rocq statements quantify over $\gamma$ as a variable and take the definition as a hypothesis. The recorded obligation reads: “gamma was eliminated by substituting the defining equation … this binding quantifies only v.”

Both checks succeed, and each is correct about its own proposition. But they are two propositions. Version 1.0.0 of this contract hid the difference: the accepted R2 report shows the same pairs as aligned, with semantic equivalence not established. A correction during the R3 audit (R3-R1) made $\gamma$ explicit, and that turned a quiet gap into a recorded mismatch. A version bump made the engine less flattering and more honest.

Many tools check “the same claim”. This chapter is about how the engine says how much they actually agree, at five graded levels, and why it refuses to say “equivalent” until the strongest level is proved. It builds on claims (Chapter 1), assumptions (Chapter 2) and the tool chapters (Chapters 9 to 14).

The contract between tools

The cross-system unit is a FormalizationBinding. For each tool it records:

contract_signature() hashes the quantifiers, assumption IDs, introduced assumptions, units and conventions. Two bindings with the same signature are declared aligned. The model’s own documentation is blunt: “This record is evidence about intent, not a proof of semantic equivalence.”

The ladder, from L0 to L4

Chapter 12 showed where the Lean and Rocq pair stands. Here is the ladder itself, with the code that checks each rung:

The correspondence ladder. Agreement at L0–L2 does not imply equivalence at L3–L4.

L0: three outcomes, no vote

compare_bindings returns one of three outcomes:

• declared_mismatch, if the quantifiers, common assumptions, introduced assumptions, units or conventions differ;
• semantic_equivalence_not_established, if everything matches but an equivalence obligation is recorded;
• declared_alignment_only, if everything matches and no obligation is recorded.

There is no equivalent outcome. The best L0 can report is “aligned on paper”. For the algebraic claim, all six pairs among Lean, Rocq, Isabelle and Z3 read declared_alignment_only with zero obligations (executed). That includes the Isabelle binding, whose repaired example builds in Docker but whose accepted source and engine result are unchanged (Chapter 13). L0 inspects metadata, so a binding to a tool that has never run in the engine still lines up. That is the limit of the rung.

L1: parse the real statements

The first R3 implementation compared a hand-written, shared “normalized statement” string as its evidence. That could not detect a divergence between the actual source files, and the R3-R1 correction removed it. The audit now parses three things into a restricted, canonical syntax tree and compares their structure:

1. the formal source header (the Lean or Rocq theorem text);
2. the kernel-elaborated type, printed by the kernel itself;
3. the claim’s own canonical formulation.

It applies a documented translation (the required map includes ℝ → R, Real.sqrt → sqrt and |v| → Rabs v), requires that each translation is actually used, and fails closed on syntax it cannot parse. The parser handles universal binders, implications, equality and order, $+$, $-$, $\times$, $/$, powers, numerals, absolute value and square root. Executed:

scripts/ci_equivalence_audit.py   -> {"status": "passed", "errors": []}

That is the static mode, which needs only Python. The --kernel mode, which reruns Lean’s and Rocq’s statement printers, needs both toolchains and was not run for this edition.

What L1 buys: the Lean and Rocq statements say the same thing in the same shape, under that translation. What it does not buy: that the translated symbols mean the same thing. It treats ℝ and R as the same type because the translation table says so.

L2: a shared interface

The second part of the R3 audit (R3-B) proves interface theorems over abstract structures in both kernels: the algebraic identity in any commutative ring, and the bridge in an ordered field with a square-root law (the Rocq version abstracts the law over R only). Because the proofs use only the interface, they hold in any model of it. That narrows what the choice of real-number construction can affect to one thing: whether each library’s sqrt satisfies the square-root law. Both do.

L3: the missing rung

An L3 result would show that Mathlib’s reals and Rocq’s standard-library reals are isomorphic, and that the isomorphism preserves sqrt and absolute value. The R3 note calls this “a cross-foundation research problem, not a CI task,” and the only argument available is informal: the categoricity of the complete ordered field. So across the whole project, semantic_equivalence = not_established, on every conclusion, including the highest rung of Chapter 6.

Declared conventions versus actual behaviour

All three gamma bindings declare the convention “positive real square root”. That is accurate on the domain $\lvert v\rvert<1$. Chapter 11 showed what happens off that domain: Lean’s Real.sqrt of a negative number is $0$, and SymPy’s is imaginary. The convention field describes the intended branch; it does not enforce it.

What keeps the three tools on common ground is the abs(v)<1 restriction, and the audit checks that each binding carries it. A claim whose domain included negative values under the root would show these differences as mismatches. Declared conventions are only as good as the restrictions that back them.

The same idea, later

Later phases of the project reuse this graded approach, each within its own scope, and none ever reports plain “equivalent”:

• Source to claim (P3): structural correspondence between spans of a source text and the claims made from them.
• Pythagoras (P6) and the repairs (P7): audits of the Lean and Rocq statements, reported as structurally_aligned, with axiom baselines.
• Challenge versus solution (P8): the Comparator checks whether a proof solves a stated challenge within one kernel. That is a different kind of check.
• Statement correspondence (P9): five kinds of evidence, from matching identifiers up to a formal-equivalence check, and eight classifications. Its test corpus includes a Rocq theorem that keeps the intended name but proves a trivial conclusion. Its strongest result for the Lorentz algebraic pair is structurally_consistent.
• Checked translation (P10-A and P10-B): local-only certificates of correspondence under an explicit mapping.

The evidence record below gives the exact classifications. The design reflects this chapter’s lesson: a matching name is not a matching statement.

What this establishes

The summary is short. The tools agree on the shape of the proposition (L1); the algebraic theorem holds in every commutative ring (L2); and the two real-number constructions are not shown to coincide (L3). The L1 translation table is short enough for a person to review, and it has not been independently reviewed.

Cross-system agreement defends against some errors and is blind to others. It catches a prover bug, a library quirk or a typo in one encoding. It cannot catch a shared misreading of the claim, because every tool was handed the same sentence. In the words of the design record, “a mistranslation can make every tool agree on the wrong proposition,” and the ladder keeps that risk visible.

Try it yourself

PYTHONPATH=src uv run python content/examples/math/tool-chapters/ch13_16_probe_and_audit_demo.py
uv run python scripts/ci_equivalence_audit.py
uv run python scripts/ci_equivalence_audit.py --kernel   # needs Lean and Rocq
uv run python scripts/ci_interface_audit.py              # needs Lean and Rocq

The first script prints the L0 comparisons shown at the start of the chapter (download).

Seeded error. In gamma-relation-1.1.0.claim.json, remove the gamma quantifier from the Lean binding. L0 should report the Lean and Rocq pair as declared_mismatch, and the L1 audit should fail on the parsed binders. (Not run.)

Open questions.

1. Is “declared mismatch” the right outcome for SymPy, or should substitution be a recognized, harmless transformation with its own status?
2. The translation table is what L1 trusts. Who reviews it, and what happens when a third system (Isabelle) adds real?
3. What is the cheapest argument that closes L3 for these two theorems, given that the algebraic one needs no square root at all? Restricting the claim to the algebraic case might make the project’s strongest cross-kernel statement both true and provable.

Evidence record

The accepted R2 report’s “Cross-system contract audit” table (generated 2026-10-23) lists the 1.0.0 pairs: gamma pairs semantic_equivalence_not_established, algebraic pairs declared_alignment_only. The 1.1.0 gamma contract and the R3 audit are in experiments/relativity/special/gamma-relation-1.1.0.claim.json and artifacts/math01-r3/statement-alignment.json; the R4 physical equivalent is artifacts/math01-r4/statement-alignment.json. The executed L0 audit of the 1.1.0 physical claim also reports declared_mismatch on quantifiers for the SymPy-versus-kernel pairs (4 obligations each), for the same substitution reason as the gamma claim.

The R3-R1 correction was hosted-qualified in run 40142444043; the hosted record includes the statement-alignment and interface-dependency audits. Exact kernel-axiom dependencies for the four L2 interface theorems are stored in artifacts/math01-r3/interface-baseline.json.

P9 is merged and hosted-qualified for its extraction, comparison, archive and notebook path. Its eight classifications run from same_formal_statement down to inconclusive. Its strongest positive result for the Lorentz algebraic pair is structurally_consistent; formal equivalence remains not_established, and the gamma bridge is recorded as a coverage case with inconclusive and unsupported_construct.

P10-A and P10-B extend that question rather than replace P9. P10-A is a local-only checked translation certificate for an abstract commutative-ring schema, classified equivalent_under_mapping for that schema. P10-B is local-only concrete theorem correspondence for lorentz-gamma-relation-1d@1.1.0 and lorentz-interval-invariance-1d-physical@1.1.0, classified concrete_theorem_correspondence_under_mapping. Neither establishes concrete real-model equivalence, and P10-B does not establish a P10-A specialization.

Sources

• Kunhao Zheng, Jesse Michael Han and Stanislas Polu, “miniF2F: a cross-system benchmark for formal Olympiad-level mathematics” (2021), https://arxiv.org/abs/2109.00110, for context on cross-prover benchmarks; not read for this edition.

The literature on the categoricity of the real numbers and on cross-prover translation is not yet cited. In the repository: src/math_engine/equivalence.py, statement_alignment.py, statement_ast.py, docs/research/MATH01-R3-equivalence-audit.md, MATH01-R3-evidence.md and MATH01-R3-R1-correction.md.