← Adversarial Math From First Principles

The Invariant Interval

The anchor chapter: the algebraic identity, the gamma bridge, their physical composition, and the false shear control, pinned to kernel-checked claims.

Adversarial Math From First Principles Chapter 20 of 30

01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

What are we actually proving?

A Lorentz boost in one space and one time dimension is often introduced with a formula and a promise: the formula preserves the interval between events. That sentence compresses several different mathematical claims. Before any proof assistant is asked to check one of them, we have to say which one we mean.

This chapter separates four claims.

An algebraic identity. For real numbers $t,x,v,\gamma$ satisfying $\gamma^2(1-v^2)=1$, the boost $t'=\gamma(t-vx)$, $x'=\gamma(x-vt)$ preserves $t^2-x^2$.
A gamma bridge. For real $v$ with $\lvert v\rvert<1$ and $\gamma=1/\sqrt{1-v^2}$, the hypothesis of the algebraic identity holds.
A physical composition. Combining the two gives the interval-preserving boost with the Lorentz factor defined by the positive square root.
A deliberately false control. The shear $t'=t$, $x'=x+vt$ does not preserve the interval. A rational witness refutes it.

The mathematical question is not whether special relativity is true. Special relativity is a well-tested physical theory. The question here is narrower and more useful for a book about verification: what exactly do the formal artifacts establish, under which assumptions, and where does the verification stop?

The short answer is: the algebra is proved, the gamma bridge is proved relative to each kernel’s real-number and square-root library, the composition is proved inside each kernel, and the false control is refuted. Cross-kernel model equivalence is not proved. Empirical adequacy is not addressed. Those are different claims, and the rest of the chapter keeps them separate.

$Map of four Lorentz claims. A, algebraic invariance: gamma free, assume gamma squared times one minus v squared equals one, conclude the interval is preserved; Lean and Rocq kernels accept the exact proposition and Z3 finds the encoded negation unsatisfiable. B, the gamma bridge: with the absolute value of v below one and the positive root, gamma squared times one minus v squared equals one; R2 kernel acceptance, R3 L1 alignment, P9 inconclusive. B’s conclusion is A’s hypothesis, and both feed C, physical composition: interval preserved in the model, with R4 kernel source and audit and P10-B local evidence, not yet in the accepted R2 report. D, the false shear control, dashed red, does not preserve the interval; Z3 finds and SymPy validates a witness with residual minus one quarter; it is a separate control, not a premise for C. A dashed box lists what the map does not establish: Lean and Rocq real-model equivalence, semantic equivalence, empirical adequacy, and human proof review.$

The case map. The bridge supplies the algebraic hypothesis; the composition uses both; the false shear is a separate refuted control. Cross-kernel model equivalence and empirical adequacy remain outside the map.

The mathematical object

We work in one spatial dimension and one time dimension, with units chosen so that the speed of light is $c=1$. An event has coordinates $(t,x)$. The quantity

I(t,x)=t^2-x^2 \tag{20.1}

is the squared interval of the $1+1$-dimensional quadratic form with signature $(+,-)$. It is not the Euclidean distance $t^2+x^2$. The sign matters, and so does the choice of units.

A frame $S'$ moves with velocity $v$ along the $x$-axis of $S$. In these units $v$ is dimensionless and satisfies $\lvert v\rvert<1$ for a physical boost. The standard boost is

t'=\gamma(t-vx),\qquad x'=\gamma(x-vt), \tag{20.2}

where $\gamma$ is the Lorentz factor. There are two different ways to read (20.2):

$\gamma$ is a free real parameter, subject only to an algebraic condition;
$\gamma$ is defined by $\gamma=1/\sqrt{1-v^2}$.

The first reading is the algebraic theorem. The second is the gamma bridge and the physical composition. Keeping them apart is the main structural decision of this chapter.

The coordinates are real numbers in the formal statements. That is a modeling choice: the theorem says nothing about clocks, rods, light signals, or whether the real-number model describes nature. Those questions belong to the interpretation of the model, not to the algebra.

The algebraic theorem

The primary teaching case is the claim lorentz-interval-invariance-1d-algebraic@1.0.0. Its exact mathematical content is the following.

Theorem 20.1 (Algebraic interval invariance). Let $t,x,v,\gamma\in\mathbb{R}$. Assume

\gamma^2(1-v^2)=1. \tag{20.3}

Define $t'=\gamma(t-vx)$ and $x'=\gamma(x-vt)$. Then

t'^2-x'^2=t^2-x^2. \tag{20.4}

**Proof.** Expand the two squares:

\begin{aligned} t'^2-x'^2 &=\gamma^2\bigl((t-vx)^2-(x-vt)^2\bigr)\\ &=\gamma^2\bigl(t^2-2vtx+v^2x^2-x^2+2vxt-v^2t^2\bigr)\\ &=\gamma^2\bigl(t^2(1-v^2)-x^2(1-v^2)\bigr)\\ &=\gamma^2(1-v^2)(t^2-x^2). \end{aligned} \tag{20.5}

The mixed terms $-2vtx$ and $+2vxt$ cancel. By (20.3), the factor $\gamma^2(1-v^2)$ is $1$, so (20.5) becomes (20.4). $\square$

The hypothesis (20.3) is not a definition of $\gamma$. It is an assumption, and it is exactly what the algebra needs. The theorem does not assume $\lvert v\rvert<1$ explicitly. It does not need to: if $\gamma$ is real and $\gamma^2(1-v^2)=1$, then $\gamma\neq 0$ and

1-v^2=\frac{1}{\gamma^2}>0,

so $\lvert v\rvert<1$ follows. The algebraic statement is therefore not making a claim about superluminal boosts with a real $\gamma$; there are no such real instances of its hypothesis.

The identity is also insensitive to the sign of $\gamma$: if $\gamma$ satisfies (20.3), so does $-\gamma$, and (20.4) still holds. The physical boost convention will select the positive sign through the square-root definition. That choice is part of the gamma bridge, not part of the algebra.

The Lean and Rocq proofs follow the same expansion. The exact Lean source is formal/lean/LorentzInterval.lean:

theorem lorentzIntervalInvariantAlgebraic
    (t x v gamma : ℝ)
    (hgamma : gamma ^ 2 * (1 - v ^ 2) = 1) :
    (gamma * (t - v * x)) ^ 2 - (gamma * (x - v * t)) ^ 2 = t ^ 2 - x ^ 2 := by
  calc
    (gamma * (t - v * x)) ^ 2 - (gamma * (x - v * t)) ^ 2 =
        (gamma ^ 2 * (1 - v ^ 2)) * (t ^ 2 - x ^ 2) := by ring
    _ = 1 * (t ^ 2 - x ^ 2) := by rw [hgamma]
    _ = t ^ 2 - x ^ 2 := by ring

The exact Rocq source is formal/rocq/LorentzInterval.v:

Theorem lorentz_interval_invariant_algebraic :
  forall t x v gamma : R,
    gamma ^ 2 * (1 - v ^ 2) = 1 ->
    (gamma * (t - v * x)) ^ 2 - (gamma * (x - v * t)) ^ 2 =
      t ^ 2 - x ^ 2.
Proof.
  intros t x v gamma Hgamma.
  replace
    ((gamma * (t - v * x)) ^ 2 - (gamma * (x - v * t)) ^ 2)
    with ((gamma ^ 2 * (1 - v ^ 2)) * (t ^ 2 - x ^ 2)) by ring.
  rewrite Hgamma.
  ring.
Qed.

The two proofs are independently written, not transliterations. They both reduce the goal to the same polynomial identity. The R3 interface development goes further and proves the algebra over an arbitrary commutative ring, which shows that the identity does not depend on the order or the square root. That interface result is a supporting observation, not a replacement for the concrete real claim.

The gamma bridge

The algebraic theorem deliberately does not say what $\gamma$ is. The physical boost does. The second claim is lorentz-gamma-relation-1d@1.1.0.

Theorem 20.2 (Gamma bridge). Let $v,\gamma\in\mathbb{R}$. Assume $\lvert v\rvert<1$ and

\gamma=\frac{1}{\sqrt{1-v^2}}. \tag{20.6}

Then

\gamma^2(1-v^2)=1. \tag{20.7}

**Proof.** Since $\lvert v\rvert<1$, we have $-1< v<1$. Hence

\[ 1-v^2=(1-v)(1+v)>0. \]

The positive real square root is therefore defined and nonzero, and it satisfies the square law

\bigl(\sqrt{1-v^2}\bigr)^2=1-v^2.

Substituting (20.6),

\gamma^2(1-v^2) =\left(\frac{1}{\sqrt{1-v^2}}\right)^2(1-v^2) =\frac{1-v^2}{1-v^2} =1.

$\square$

The domain condition $\lvert v\rvert<1$ is doing real work. It makes $1-v^2$ positive, so the intended real square root exists and the denominator is nonzero. At $\lvert v\rvert=1$ the denominator is zero. For $\lvert v\rvert>1$, $1-v^2$ is negative and the real equation $\gamma^2(1-v^2)=1$ has no real solution at all. The physical theorem therefore states the subluminal hypothesis explicitly.

The bridge also explains the sign. From $\gamma^2(1-v^2)=1$ and $\lvert v\rvert<1$, one can conclude only

\gamma=\pm\frac{1}{\sqrt{1-v^2}}.

The definition (20.6) chooses the positive root. The algebraic theorem would accept either sign; the physical boost convention accepts the positive one. That is why the bridge is a separate claim rather than a rewrite of the algebraic hypothesis.

The Lean declaration is AdversarialMath.gammaRelationOfDefinition; the Rocq declaration is gamma_relation_of_definition. Both quantify $v$ and $\gamma$, assume the strict velocity bound and the defining equation, and conclude (20.7). The current 1.1.0 claim record makes the $\gamma$ quantifier explicit. The kernel proof source is unchanged from the earlier 1.0.0 run; R3-R1 rebinds that same source to the corrected 1.1.0 contract. It is not a new theorem.

The bridge is where the two real-number libraries visibly differ in their foundations. Lean’s Real.sqrt and Rocq’s sqrt are both intended to be the nonnegative real square root on nonnegative inputs, but the project has not proved that the two functions are extensionally equal across the two constructions. The bridge proof uses each library’s own square law and positivity facts. That is enough for each kernel’s theorem; it is not a cross-kernel model equivalence proof.

From algebra to physical composition

The physical claim is lorentz-interval-invariance-1d-physical@1.1.0.

Theorem 20.3 (Physical interval invariance). Let $t,x,v,\gamma\in\mathbb{R}$. Assume $\lvert v\rvert<1$ and

\gamma=\frac{1}{\sqrt{1-v^2}}.

Define $t'=\gamma(t-vx)$ and $x'=\gamma(x-vt)$. Then

\[ t'^2-x'^2=t^2-x^2. \]

**Proof.** By Theorem 20.2, the definition of $\gamma$ implies $\gamma^2(1-v^2)=1$. Theorem 20.1 then gives the conclusion. $\square$

This is a composition, not a new algebraic identity. The Lean declaration is AdversarialMath.lorentzIntervalInvariantPhysical:

theorem lorentzIntervalInvariantPhysical
    (t x v gamma : ℝ)
    (hv : |v| < 1)
    (hgamma_def : gamma = 1 / Real.sqrt (1 - v ^ 2)) :
    (gamma * (t - v * x)) ^ 2 - (gamma * (x - v * t)) ^ 2 = t ^ 2 - x ^ 2 := by
  have hgamma : gamma ^ 2 * (1 - v ^ 2) = 1 :=
    gammaRelationOfDefinition v gamma hv hgamma_def
  exact lorentzIntervalInvariantAlgebraic t x v gamma hgamma

The Rocq declaration lorentz_interval_invariant_physical has the same shape: it applies lorentz_interval_invariant_algebraic after gamma_relation_of_definition. The formal statement quantifies $\gamma$ and assumes the defining equation rather than hiding the definition inside a let. That makes the dependency on the bridge explicit.

A version note is necessary here. The accepted R2 report records the physical claim at 1.0.0 as computation_verified_within_stated_domain by SymPy, with no kernel proof. The composed Lean and Rocq theorems were added by R4 and versioned as 1.1.0. R4’s source and dependency audit is hosted-qualified, but the accepted report has not been migrated to 1.1.0. The chapter therefore cites the report only for the 1.0.0 computation and the R4 bundle for the 1.1.0 kernel composition. It does not say that the report verifies 1.1.0.

The physical theorem establishes a statement inside the real-number model. It does not establish that the model’s coordinates are the coordinates of a real laboratory, that clocks and rods behave as the model assumes, or that the postulates of special relativity hold in nature. Those are separate empirical questions (Chapter 18).

The deliberately false case

The negative control is incorrect-transform-preserves-interval@1.0.0. It considers the shear

t'=t,\qquad x'=x+vt, \tag{20.8}

and claims

\[ t'^2-x'^2=t^2-x^2 \]

for every real $t,x$ and every $\lvert v\rvert<1$. The claim is false. The difference between the transformed and original intervals is

\begin{aligned} t'^2-x'^2-(t^2-x^2) &=t^2-(x+vt)^2-(t^2-x^2)\\ &=-2vxt-v^2t^2\\ &=-vt(2x+vt). \end{aligned} \tag{20.9}

Take $t=1$, $x=0$, $v=1/2$. Then

t'^2-x'^2=1-\left(\frac12\right)^2=\frac34, \qquad t^2-x^2=1,

so the residual is $3/4-1=-1/4$. The SymPy result records exactly this assignment. Z3 found a second witness, $t=-1$, $x=0$, $v=1/2$, with the same residual. Both witnesses satisfy the encoded subluminal domain. The Z3 encoding also carries the side conditions $v\neq 0$ and $t\neq 0$; the witness satisfies them.

One witness is enough to refute a universal claim. The negative control therefore does what a negative control should do: it shows that the pipeline can detect a false preservation claim rather than merely producing green output. It does not show that the Lorentz transformation is false. The shear (20.8) is a different transformation, and the counterexample is scoped to that exact claim.

What the machines checked

The four claims are supported by different kinds of evidence. A compact summary:

Claim	Lean	Rocq	Other evidence	Recorded standing
A. Algebraic invariance, 1.0.0	`lorentzIntervalInvariantAlgebraic`	`lorentz_interval_invariant_algebraic`	Z3: negation `unsat`	R2 hosted `formally_verified`; P9 structural
B. Gamma bridge, 1.1.0	`gammaRelationOfDefinition`	`gamma_relation_of_definition`	SymPy only for the 1.0.0 contract	R2 kernel source; R3 L1 alignment; P9 `inconclusive`; P10-B local
C. Physical composition, 1.1.0	`lorentzIntervalInvariantPhysical`	`lorentz_interval_invariant_physical`	SymPy only for 1.0.0	R4 hosted source/audit; P10-B local
D. False shear, 1.0.0	none	none	SymPy and Z3 witnesses	P3/P4 `refuted_by_valid_counterexample`

Lean is a dependent type theory with a small trusted kernel. A proof is a term whose type is the proposition; the kernel checks the term. #print axioms shows the foundational axioms a declaration depends on. Rocq is a separate proof assistant with its own kernel and its own real-number library. Its Print Assumptions command plays a similar role. Z3 is a satisfiability solver: unsat for the negation of the encoded identity is a solver result, not a proof term in Lean or Rocq. SymPy is a symbolic computation library: simplifying a residual to zero is a computation within its encoding, not a universally quantified kernel proof. Isabelle and SageMath have illustrative Docker executions, but no claim-bound engine result; for these claims they remain not evaluated, and this chapter claims no success for either.

The formal dependencies are declaration-specific. Do not read one row as a universal inventory.

Declaration	Kernel	Recorded dependencies
`lorentzIntervalInvariantAlgebraic`	Lean	`propext`, `Classical.choice`, `Quot.sound`
`lorentz_interval_invariant_algebraic`	Rocq	`ClassicalDedekindReals.sig_forall_dec`, `FunctionalExtensionality.functional_extensionality_dep`
`gammaRelationOfDefinition`	Lean	`propext`, `Classical.choice`, `Quot.sound`
`gamma_relation_of_definition`	Rocq	`ClassicalDedekindReals.sig_forall_dec`, `ClassicalDedekindReals.sig_not_dec`, `FunctionalExtensionality.functional_extensionality_dep`
`lorentzIntervalInvariantPhysical`	Lean	`propext`, `Classical.choice`, `Quot.sound`
`lorentz_interval_invariant_physical`	Rocq	`ClassicalDedekindReals.sig_forall_dec`, `ClassicalDedekindReals.sig_not_dec`, `FunctionalExtensionality.functional_extensionality_dep`
`lorentzIntervalInvariantCommRing` (R3 interface)	Lean	`Quot.sound`, `propext`
`lorentz_interval_invariant_cring` (R3 interface)	Rocq	none

These are foundational or library dependencies, not assumptions of special relativity. propext is propositional extensionality; Classical.choice is classical choice; Quot.sound is the quotient soundness principle. On the Rocq side, sig_forall_dec and sig_not_dec come from the classical real-number construction, and functional_extensionality_dep is functional extensionality. The extra Rocq dependency in the gamma and physical declarations belongs to the square-root environment. The theorem’s mathematical hypotheses remain the explicit ones in its statement; the foundational inventory is a separate fact about the proof environment.

Correspondence is not equivalence

Two kernels accepting similarly typed statements is evidence that each kernel accepted its own statement. It is not, by itself, a proof that the statements are semantically equivalent. The project records several weaker findings:

P9 is hosted-qualified for its extraction, comparison, archive and notebook path. Its strongest positive result for the algebraic pair is structurally_consistent under a documented real/field mapping. Formal equivalence is not_established. The gamma bridge is a P9 coverage case marked inconclusive with unsupported_construct.
P10-A is a local-only checked translation certificate for an abstract commutative-ring schema. Its classification is equivalent_under_mapping for that schema. It is not a concrete Lean-Real versus Rocq-R specialization.
P10-B is local-only concrete theorem correspondence for the 1.1.0 gamma and physical claims. Its classification is concrete_theorem_correspondence_under_mapping. It does not establish real-model equivalence and does not establish a P10-A specialization.
R3/R4 statement alignment is L1: the parsed statements align under a documented translation. That is statement alignment, not theorem equivalence and not model equivalence.

The absence of an equivalence certificate is not evidence that the two results differ. It means the project has not proved that they agree at the model level. That distinction is the subject of Chapter 15.

What remains unestablished

The following claims are not established by the evidence in this chapter.

Cross-kernel model equivalence. The project has not proved that Lean’s Mathlib reals and Rocq’s Stdlib reals are isomorphic as ordered fields, nor that the isomorphism preserves sqrt and absolute value.
Formal equivalence in P9. P9’s strongest positive classification is structurally_consistent; the formal-equivalence arm has no certificate.
Concrete-model equivalence in P10-B. P10-B records correspondence under a mapping, not equality or isomorphism of the concrete real-number models.
P10-A specialization. The abstract commutative-ring certificate has not been specialized to the concrete real theorem.
R4 report integration. The R4 source/audit is hosted-qualified, but the accepted R2 report has not been migrated to physical 1.1.0.
P2/P3/P4 coverage of 1.1.0. The current case manifest and notebook plan cover the 1.0.0 claims; the 1.1.0 gamma and physical kernel results are outside that pipeline. Bringing them in needs new versioned 1.1.0 evidence. The R4 results cannot simply be written into a projection of the 1.0.0 bundle.
Empirical adequacy. Nothing here tests whether nature obeys the model. Interval invariance as physics rests on the postulates of Chapter 18, which are empirical premises.
Three-dimensional physics. The formal development is 1+1-dimensional. It does not cover rotations, three-dimensional boosts, or the full Lorentz group.
Human proof digestion. The agent-prepared review in the planning directory is not owner approval. The repository records no independent human sign-off.

The formal results are therefore conditional: if the real-number model and its explicit hypotheses are accepted, then the interval is invariant. The verification stops before the model’s empirical interpretation.

A reproducible mathematical claim

The mathematical spine of the chapter is short enough to reproduce by hand:

t'^2-x'^2=\gamma^2(1-v^2)(t^2-x^2)=t^2-x^2.

The formal spine is equally short: the algebraic theorem, the gamma bridge, and their composition. The evidence companion records the exact claim fingerprints, source hashes, declarations, tool versions, and artifact paths. It is kept in the repository, not on this site, as `content/planning/CHAPTER-20-EVIDENCE-REFERENCES.md`. The Stage 02 proof-lab plan and manuscript reference are tracked in `experiments/relativity/notebooks/`; the generated notebook is an untracked local projection of verified P3 evidence. This chapter does not claim that the P4 notebook displays the 1.1.0 kernel composition.

A reader can inspect:

experiments/relativity/special/lorentz-algebraic.claim.json;
experiments/relativity/special/gamma-relation-1.1.0.claim.json;
experiments/relativity/special/lorentz-physical-1.1.0.claim.json;
experiments/relativity/special/incorrect-transform.claim.json;
formal/lean/LorentzInterval.lean, GammaBridge.lean, and PhysicalComposition.lean;
formal/rocq/LorentzInterval.v, GammaBridge.v, and PhysicalComposition.v;
artifacts/math01/, artifacts/math01-r3/, and artifacts/math01-r4/.

The P2 → P3 → P4 command sequence and its authority boundaries are in the evidence companion. Lean and Rocq are optional in a local environment. When a tool is absent, the engine reports not_evaluated; it does not report success. That rule is more important than any single green result.

The chapter’s conclusion is deliberately modest. The algebra is clear, the bridge is clear, the composition is clear, and the false control is genuinely false. The remaining questions are about correspondence and interpretation, not about filling in a missing algebraic step.

Try it yourself

cd formal/lean
lake exe cache get
lake env lean LorentzInterval.lean
lake env lean GammaBridge.lean
lake env lean PhysicalComposition.lean

Each file should elaborate with no errors. The axiom audit of Chapter 11 (lake env lean AxiomAudit.lean) prints the dependency lines in the table above.

Seeded errors. In LorentzInterval.lean, change 1 - v ^ 2 to 1 + v ^ 2 in the first calc step; ring should fail. In PhysicalComposition.lean, delete the hypothesis hv; the call to gammaRelationOfDefinition should no longer typecheck.

Exercises.

Show that if $\gamma$ satisfies (20.3), so does $-\gamma$, and check (20.4) with $\gamma = -5/4$, $v = 3/5$ at the event $(t,x) = (5,3)$. (Answer: the boosted event is $(-4, 0)$, and $16 - 0 = 25 - 9$.)
Using (20.9), find every point $(t,x)$ at which the shear does preserve the interval for $v = 1/2$. (Answer: the residual $-\tfrac12 t(2x + \tfrac12 t)$ vanishes exactly on the lines $t = 0$ and $x = -t/4$.)
Why can’t the algebraic theorem have a real instance with $\lvert v\rvert>1$? (Answer: (20.3) forces $1 - v^2 = 1/\gamma^2 > 0$.)

Sources

Source	Class	Used for
`physlib2026` (Physlib Lorentz group)	software repository	prior art and provenance of the algebraic claim
`einstein1905elektrodynamik`	historical source	provenance of the physical model’s assumptions, not execution evidence
`docs/research/MATH01-R4-hosted-run-3.md`	repository evidence	R4 hosted source/audit status
`docs/research/MATH-VAL01-P9-hosted-qualification.md`	repository evidence	P9 hosted structural result and limits
`docs/research/MATH-VAL01-P10A-evidence.md`	repository evidence	P10-A local abstract certificate
`docs/research/MATH-VAL01-P10B-evidence.md`	repository evidence	P10-B local concrete correspondence

The Einstein paper is cited by the physical claim for the model assumptions (real coordinates, subluminal speed, the gamma definition, and $c=1$). It is a historical source, not proof that the software verification pipeline ran. The bibliographic record is einstein1905elektrodynamik in content/research/sources.bib.