The `sorry` That Wasn't the Proof

Here are six facts about one Lean formalization of an action theorem related to Cannon’s conjecture, all true at the pinned commit:

the challenge file ends in sorry
the catalogue omits the result
the documentation says the formalization proves the theorem
the separate solution theorem passes the Lean kernel
the Comparator accepts the mapping
the human reviewer says the statement looks plausible but was not carefully checked

A reader who sees only the first fact concludes that the proof is incomplete. A reader who sees only the fourth concludes that it is done. Both are reading one record as if it were the whole story.

This chapter shows how the engine takes an external formalization, pins it, runs its checks independently, and reconciles conflicting signals into an evidence vector with a bounded conclusion, without forcing a pass-or-fail verdict. It builds on dossiers (Chapter 16), kernel evidence (Chapter 3 and Chapter 20) and the vacuity lesson of Chapter 27.

What is being claimed, and by whom

This chapter claims nothing about Cannon’s conjecture. It reports on a pinned external artifact: a challenge wrapper, a solution module, documentation and a catalogue in one public repository, plus a pre-referee status table from a second project, the Comparator tool, and three GitHub discussion threads. The exact pins are in the evidence record.

The project’s source note is explicit that it claims no originality for the conjecture, the formalization, the Comparator or MathVet. It claims an independent reproduction and a reconciliation that respects each record’s scope.

GitHub discussions change, so they are kept as snapshots, hashed at capture time. At capture, issue #28 was open with 5 comments, PR #37 was merged, and PR #46 was open with no comments. Anyone reading this later may find different states.

Reading each record at its own scope

The sorry

Lean’s sorry is a placeholder. It lets a file compile by introducing sorryAx, which is exactly what a proof must not depend on (Chapter 11). The challenge wrapper ComparatorChallenges/CannonGeometricAction.lean has exactly one sorry, at line 94, column 3. The engine classifies it as present and wrapper_only, with proof_evidence = false.

A Comparator challenge file states a target and leaves the proof to a separate solution module. The placeholder is the interface, so it says nothing either way about the solution. It does not follow that the separately named theorem in another module is incomplete; equally, it is not proof evidence.

The solution theorem

OAI.CannonRelease.cannon, in OAI.Geometry.Cannon.Main, was built with lake build OAI.Geometry.Cannon.Main on Lean 4.34.1 and exited with 0. A #print axioms audit found only Classical.choice, Quot.sound and propext, with no unexpected axioms. A static scan of the 299 local files in the import closure found no sorry, admit, custom axiom, unsafe or native_decide.

Note the scope of that scan: the local files of the external project. It is not a scan of Mathlib or of the toolchain.

The Comparator

The Comparator builds the challenge and solution modules, exports their declarations, compares the configured challenge theorem with the solution theorem, and checks the permitted axioms and kernel acceptance. Executed, it reported Lean default kernel accepts the solution and Your solution is okay!.

It checks the configured relationship. It does not decide whether the Lean proposition is the theorem a paper states in prose.

The sandbox had a limit worth recording. landrun ran in --best-effort mode on WSL Ubuntu with Landlock ABI v7. That is not a container or a full VM, and the command log says so.

The catalogue and the documentation

lean/docs/246.md says the formalization proves the proper, cocompact, finite-kernel action theorem. lean/formalization.yaml has no Cannon entry. The engine classifies catalogue consistency as inconsistent, and classifies the omission as a gap in metadata and coverage, not a mathematical refutation. A missing row is not a missing theorem.

PR #37, a merged correction to the metadata, approves the metadata. It does not approve the theorem.

The reviews

• The human comment on the statement calls it structurally plausible, says it was not carefully checked, and raises a question about the boundary between synchronous distance and asymptotic equivalence. The engine records plausible_not_checked, with approval not_approved. PR #46, proposing that comment as a review record, was open and pending at capture.
• AI-authored comments are recorded as reported, with approval not_approved. One discloses that no human checked it. An AI report is not independent peer review.
• MathVet’s entry for this item says family_verdict = full. The engine records it as reported: pre-referee and model-assisted, corroborating provenance, not a substitute for the execution above.

The evidence vector

artifact integrity          verified
challenge placeholder       present
placeholder interpretation  wrapper_only
solution kernel             accepted
dependency audit            passed
comparator                  accepted
catalogue consistency       inconsistent
statement correspondence    qualified
proof digestion             not_evaluated
historical correspondence   not_evaluated
cross-kernel equivalence    not_established

There is no total. statement_correspondence = qualified is the strongest claim about mathematical meaning in the vector, and it is qualified by the reviewer’s own caveat and the open boundary question. proof_digestion is not_evaluated because no human has recorded reading the proof.

The record states that neither dismissal nor full verification is justified. Its safe statement for review is:

The pinned challenge wrapper contains an intentional placeholder and is not proof evidence. A separately identified Lean theorem is kernel-accepted in Lean 4.34.1 with only propext, Classical.choice, and Quot.sound; the executed Comparator accepts the configured challenge-to-solution mapping. The external catalogue and documentation disagree, statement correspondence remains qualified, proof digestion is not evaluated, and historical and cross-kernel obligations remain open.

Statements this chapter must not make

The engine’s list of prohibited conclusions is part of the record. Do not write:

• Cannon’s conjecture is proved.
• The paper is verified.
• The formalization is semantically equivalent to the natural-language theorem.
• The human reviewer approved the formalization.
• The challenge file is complete.
• The catalogue proves there is no formalization.
• The result is independently verified in multiple kernels.
• The external project is free of all placeholders.
• The AI review is independent peer review.

What this establishes

About the artifact: the stated Lean theorem is accepted by Lean’s kernel with a standard set of axioms, and the Comparator accepts the configured mapping. About the record: it is internally inconsistent in its metadata, and under-reviewed on what the statement means.

What it does not establish: that the formal statement means what the paper’s prose means, that the result is correct as mathematics about Cannon’s conjecture, or anything about the repository’s other challenges, none of which was examined. The scope is the single record CannonGeometricAction. The full external repository and its 416 Comparator challenges are not audited, and the paper’s prose is not formally compared with the Lean statement.

There is one kernel here, Lean 4.34.1, so cross-kernel equivalence is not_established by construction. The Comparator is a second tool on the same kernel, which is a different kind of independence. Human review: not evaluated. Nobody on this project has recorded reading the proof itself; this chapter’s whole argument is about records, not about the mathematics inside the proof.

Review is specific to each dimension. The human comment, the AI comments, MathVet and the metadata PR are four kinds of record with four different scopes, and none moves a mathematical status. No acceptance by the project, an author, a publisher or peer review is claimed, and the engine made no external write, comment or PR on the external repository.

Chapter 27’s Candidate C was a kernel-accepted proof that meant nothing, because its premise was inconsistent. The sorry here is the mirror image: a file the kernel warns about, sitting beside a theorem it accepts. In both cases a single record, read alone, points the wrong way. The lesson is the same: ask what each record is about.

Try it yourself

The P8 commands are math-engine p8 {validate, acquire, qualify, dossier, verify}, with the plan at experiments/external/oai-cannon/p8.plan.json. The qualification commands recorded in the bundle are:

lake build OAI.Geometry.Cannon.Main
lake env lean .p8-audit/P8AxiomAudit.lean
lake env <comparator> ComparatorChallenges/CannonGeometricAction.json

The first full build needs about 7.6 GiB of memory and about eight minutes.

Seeded error. In a scratch copy, remove Classical.choice from the challenge JSON’s list of permitted axioms. The Comparator should reject the solution, because the audit found that axiom in use.

Exercise. Classify each statement as kernel evidence, comparator evidence, metadata, human comment, AI report or open obligation:

1. “The wrapper has one sorry at line 94.”
2. “formalization.yaml has no Cannon entry.”
3. “The solution theorem uses only propext, Classical.choice, Quot.sound.”
4. “The statement looks plausible but wasn’t carefully checked.”
5. “Synchronous distance may not match asymptotic equivalence at the boundary.”
6. “MathVet gives the family verdict full.”

Then: which conclusions change if the Comparator is rerun with a different configuration? (This edition’s reading of the record: the Comparator row, and anything that depended on it. The solution-kernel and dependency rows stand on their own executions.)

Open questions.

1. Does the statement’s treatment of the boundary between synchronous and asymptotic distance match the paper? A reviewer’s answer would move statement_correspondence either way.
2. Does the Comparator’s configured mapping leave out anything relevant? The engine records what it checks, not whether that is enough.
3. If the catalogue is corrected upstream, which rows of the vector change? (Only catalogue consistency. Rerun and re-hash the snapshots.)

Evidence record

The solution build ran 9,222 jobs on the first full build (7:39 wall time, 7.6 GiB peak memory); the recorded qualification build reused the cache and took 9.99 s. The Comparator run took 180.09 s and exited with 0.

The first hosted attempt (run 40562688741) failed with no space left on device during the external build. That was an infrastructure failure, not a Lean or Comparator rejection and not a mathematical result. The job was changed to free runner disk before building, and the corrective hosted run 40581533575 (head 9e528601b85bd1bf34aa88cfc17713644ceacede, workflow MATH01 CI, 2026-10-27) completed successfully: https://github.com/ernanhughes/math/actions/runs/40581533575. The earlier hosted-qualification note’s “attempt 2” placeholder is superseded by that run record. The recorded local qualification used WSL, not a clean-room machine.

Two independent local builds produced identical index, canonical-notebook, scope, vector and dossier identities. P8 index p8-qualification-index-6a583f68024ffafab28ee7cb3a54deadd90be3b49b24b0058f77b0f76750f407; canonical executed notebook f9fbfcf8b616121c09b7940d7d46948f6fbf668556ce1696b1df57bda521d3ef. Execution counts: 1 solution build, 1 axiom audit, 1 Comparator run. The notebook, dossier, reporting and verification steps each ran zero external executions.

Sources

Background on Cannon’s conjecture, not on the formalized result:

• James W. Cannon, “The Combinatorial Riemann Mapping Theorem”, Acta Mathematica (1994), https://doi.org/10.1007/BF02398434
• James W. Cannon and Eric L. Swenson, “Recognizing Constant Curvature Discrete Groups in Dimension 3”, Transactions of the AMS (1998), https://doi.org/10.1090/S0002-9947-98-02107-2
• Mario Bonk and Bruce Kleiner, “Conformal Dimension and Gromov Hyperbolic Groups with 2-Sphere Boundary”, Geometry and Topology (2005), https://doi.org/10.2140/gt.2005.9.219
• Vladimir Markovic, “Criterion for Cannon’s Conjecture”, GAFA (2013), https://arxiv.org/abs/1205.5747

The paper whose theorem is formalized is not yet cited; that citation should come from its authors, not from this project’s summary of it. The other sources are mixed in kind, deliberately:

The P8 source note also records that the MathVet address originally given to the project was wrong; the pinned record lives at mathvet/mathvet.