Encyclopedia Delta Delta Kernel Check Check
ARTICLE 4 claims 4 theorems
Delta Kernel Check Check
A machine-checked library of formal theorems audits every proof it accepts, and records exactly which assumptions each one needed.
The checking function
A derivation is a complete record of reasoning: a tree of steps that starts from assumptions and ends at a conclusion. The Recognition Science framework's library is a machine-checked collection of formal theorems. Its checking function, called check, takes such a tree and either rejects it as ill-formed or returns the proved formula together with the exact set of posits it consumed. A posit is an assumption the proof chose to rely on, such as the law of excluded middle or a limited principle of omniscience. The function is total, meaning it always returns an answer, and it performs no search: every rule's conclusion is computable from its annotations and sub-conclusions.
This design produces two kinds of verdict. A forced verdict means the tree checks with an empty ledger, a discrete record of the posits used, so the formula is proved without any such assumptions. A conditional verdict means the tree checks and the ledger names the posits it needed. The distinction matters because it separates what the framework derives from what it merely assumes. The check itself is structural and Prop-free: the object logic never touches the host's propositions, so the audit is purely syntactic.
The rule inventory is a standard natural-deduction system for intuitionistic Heyting arithmetic over a signature of distinctions. It includes hypothesis by de Bruijn index, reflexivity and Leibniz substitution, the successor axioms, primitive-recursive equations for addition and multiplication, induction, and the full intuitionistic propositional and quantifier rules. Three posit rules, excluded middle, the limited principle of omniscience, and Markov's principle, are the only rules that post to the ledger. Markov's principle is restricted to quantifier-free matrices, so that posit stays honestly weaker than excluded middle.
A sorry has no counterpart here. There is no rule that closes a goal without a complete sub-tree, so an incomplete derivation is simply an ill-formed tree and the checker rejects it. This is what the declaration check establishes in plain terms: a proof is either complete and audited, or it is not a proof at all. What it does not claim is that the framework's axioms are true, or that its posits are forced by reality. The check certifies structure, not metaphysics.
THEOREM check · IndisputableMonolith/DeltaKernel/Check.lean
/-- The kernel: audit a derivation tree in a context. Returns the proved
formula and the exact posit ledger, or `none` if the tree is ill-formed.
Total, structural, and `Prop`-free: the object logic never touches the
host's propositions. -/
def check (Γ : Ctx) : Deriv → Option (DFormula × Ledger)
| .hyp i =>
match Γ[i]? with
| some φ => some (φ, .empty)
| none => none
| .eqRefl t => some (.eq t t, .empty)
| .eqSubst φ t s dEq dT =>
match check Γ dEq, check Γ dT with
| some (cEq, o₁), some (cT, o₂) =>
if cEq = DFormula.eq t s then
if cT = φ.subst 0 t then some (φ.subst 0 s, o₁.union o₂)
else none
else none
| _, _ => none
| .succNeZero t => some (.neg (.eq (.succ t) .zero), .empty)
| .succInj d =>
match check Γ d with
| some (.eq (.succ t) (.succ s), o) => some (.eq t s, o)
| _ => none
| .addZero t => some (.eq (.add t .zero) t, .empty)
| .addSucc t s => some (.eq (.add t (.succ s)) (.succ (.add t s)), .empty)
| .mulZero t => some (.eq (.mul t .zero) .zero, .empty)
| .mulSucc t s => some (.eq (.mul t (.succ s)) (.add (.mul t s) t), .empty)
| .ind φ d₀ dS =>
match check Γ d₀, check Γ dS with
| some (c₀, o₁), some (cS, o₂) =>
if c₀ = φ.subst 0 .zero then
if cS = DFormula.all (.impl φ φ.stepSucc) then
-- Stratification: induction on a quantified formula posts the
-- FULL-IND tier flag; on a QF formula it stays in the QF tier.
-- Whether FULL-IND is "forced by initiality" or a strength step
-- is the measured question the flag exists to answer.
let base := o₁.union o₂
let o := if φ.isQF then base else base.union .ofIndFull
some (.all φ, o)
else none
else none
| _, _ => none
| .implIntro φ d =>
match check (φ :: Γ) d with
| some (ψ, o) => some (.impl φ ψ, o)
| none => none
| .implElim d₁ d₂ =>
match check Γ d₁, check Γ d₂ with
| some (.impl φ ψ, o₁), some (φ', o₂) =>
if φ' = φ then some (ψ, o₁.union o₂) else none
| _, _ => none
| .conjIntro d₁ d₂ =>
match check Γ d₁, check Γ d₂ with
| some (φ, o₁), some (ψ, o₂) => some (.conj φ ψ, o₁.union o₂)
| _, _ => none
| .conjElim1 d =>
match check Γ d with
| some (.conj φ _, o) => some (φ, o)
| _ => none
| .conjElim2 d =>
match check Γ d with
| some (.conj _ ψ, o) => some (ψ, o)
| _ => none
| .disjIntro1 ψ d =>
match check Γ d with
| some (φ, o) => some (.disj φ ψ, o)
| none => none
| .disjIntro2 φ d =>
match check Γ d with
| some (ψ, o) => some (.disj φ ψ, o)
| none => none
| .disjElim d dL dR =>
match check Γ d with
| some (.disj φ ψ, o) =>
match check (φ :: Γ) dL, check (ψ :: Γ) dR with
| some (χ₁, o₁), some (χ₂, o₂) =>
if χ₁ = χ₂ then some (χ₁, (o.union o₁).union o₂) else none
| _, _ => none
| _ => none
| .flsElim φ d =>
match check Γ d with
| some (.fls, o) => some (φ, o)
| _ => none
| .allIntro d =>
match check (Γ.map (DFormula.lift 1 0)) d with
| some (φ, o) => some (.all φ, o)
| none => none
| .allElim t d =>
match check Γ d with
| some (.all φ, o) => some (φ.subst 0 t, o)
| _ => none
| .exIntro φ t d =>
match check Γ d with
| some (c, o) =>
if c = φ.subst 0 t then some (.ex φ, o) else none
| none => none
| .exElim ψ d dBody =>
match check Γ d with
| some (.ex φ, o) =>
match check (φ :: Γ.map (DFormula.lift 1 0)) dBody with
| some (ψ', o₂) =>
if ψ' = ψ.lift 1 0 then some (ψ, o.union o₂) else none
| none => none
| _ => none
| .emPosit φ => some (.disj φ φ.neg, .ofEM)
| .lpoPosit φ =>
some (.impl (.all (.disj φ φ.neg)) (.disj (.ex φ) (.all φ.neg)), .ofLPO)
| .mpPosit φ =>
if φ.isQF then some (.impl (.neg (.neg (.ex φ))) (.ex φ), .ofMP)
else none
THEOREM Forced · IndisputableMonolith/DeltaKernel/Check.lean
/-- FORCED verdict: the tree checks with an empty ledger. This is the
kernel-native σ0 / DELTA_FORCED certificate. -/
def Forced (Γ : Ctx) (d : Deriv) (φ : DFormula) : Prop :=
check Γ d = some (φ, Ledger.empty)
THEOREM check · IndisputableMonolith/DeltaKernel/Check.lean
/-- The kernel: audit a derivation tree in a context. Returns the proved
formula and the exact posit ledger, or `none` if the tree is ill-formed.
Total, structural, and `Prop`-free: the object logic never touches the
host's propositions. -/
def check (Γ : Ctx) : Deriv → Option (DFormula × Ledger)
| .hyp i =>
match Γ[i]? with
| some φ => some (φ, .empty)
| none => none
| .eqRefl t => some (.eq t t, .empty)
| .eqSubst φ t s dEq dT =>
match check Γ dEq, check Γ dT with
| some (cEq, o₁), some (cT, o₂) =>
if cEq = DFormula.eq t s then
if cT = φ.subst 0 t then some (φ.subst 0 s, o₁.union o₂)
else none
else none
| _, _ => none
| .succNeZero t => some (.neg (.eq (.succ t) .zero), .empty)
| .succInj d =>
match check Γ d with
| some (.eq (.succ t) (.succ s), o) => some (.eq t s, o)
| _ => none
| .addZero t => some (.eq (.add t .zero) t, .empty)
| .addSucc t s => some (.eq (.add t (.succ s)) (.succ (.add t s)), .empty)
| .mulZero t => some (.eq (.mul t .zero) .zero, .empty)
| .mulSucc t s => some (.eq (.mul t (.succ s)) (.add (.mul t s) t), .empty)
| .ind φ d₀ dS =>
match check Γ d₀, check Γ dS with
| some (c₀, o₁), some (cS, o₂) =>
if c₀ = φ.subst 0 .zero then
if cS = DFormula.all (.impl φ φ.stepSucc) then
-- Stratification: induction on a quantified formula posts the
-- FULL-IND tier flag; on a QF formula it stays in the QF tier.
-- Whether FULL-IND is "forced by initiality" or a strength step
-- is the measured question the flag exists to answer.
let base := o₁.union o₂
let o := if φ.isQF then base else base.union .ofIndFull
some (.all φ, o)
else none
else none
| _, _ => none
| .implIntro φ d =>
match check (φ :: Γ) d with
| some (ψ, o) => some (.impl φ ψ, o)
| none => none
| .implElim d₁ d₂ =>
match check Γ d₁, check Γ d₂ with
| some (.impl φ ψ, o₁), some (φ', o₂) =>
if φ' = φ then some (ψ, o₁.union o₂) else none
| _, _ => none
| .conjIntro d₁ d₂ =>
match check Γ d₁, check Γ d₂ with
| some (φ, o₁), some (ψ, o₂) => some (.conj φ ψ, o₁.union o₂)
| _, _ => none
| .conjElim1 d =>
match check Γ d with
| some (.conj φ _, o) => some (φ, o)
| _ => none
| .conjElim2 d =>
match check Γ d with
| some (.conj _ ψ, o) => some (ψ, o)
| _ => none
| .disjIntro1 ψ d =>
match check Γ d with
| some (φ, o) => some (.disj φ ψ, o)
| none => none
| .disjIntro2 φ d =>
match check Γ d with
| some (ψ, o) => some (.disj φ ψ, o)
| none => none
| .disjElim d dL dR =>
match check Γ d with
| some (.disj φ ψ, o) =>
match check (φ :: Γ) dL, check (ψ :: Γ) dR with
| some (χ₁, o₁), some (χ₂, o₂) =>
if χ₁ = χ₂ then some (χ₁, (o.union o₁).union o₂) else none
| _, _ => none
| _ => none
| .flsElim φ d =>
match check Γ d with
| some (.fls, o) => some (φ, o)
| _ => none
| .allIntro d =>
match check (Γ.map (DFormula.lift 1 0)) d with
| some (φ, o) => some (.all φ, o)
| none => none
| .allElim t d =>
match check Γ d with
| some (.all φ, o) => some (φ.subst 0 t, o)
| _ => none
| .exIntro φ t d =>
match check Γ d with
| some (c, o) =>
if c = φ.subst 0 t then some (.ex φ, o) else none
| none => none
| .exElim ψ d dBody =>
match check Γ d with
| some (.ex φ, o) =>
match check (φ :: Γ.map (DFormula.lift 1 0)) dBody with
| some (ψ', o₂) =>
if ψ' = ψ.lift 1 0 then some (ψ, o.union o₂) else none
| none => none
| _ => none
| .emPosit φ => some (.disj φ φ.neg, .ofEM)
| .lpoPosit φ =>
some (.impl (.all (.disj φ φ.neg)) (.disj (.ex φ) (.all φ.neg)), .ofLPO)
| .mpPosit φ =>
if φ.isQF then some (.impl (.neg (.neg (.ex φ))) (.ex φ), .ofMP)
else none
THEOREM check · IndisputableMonolith/DeltaKernel/Check.lean
/-- The kernel: audit a derivation tree in a context. Returns the proved
formula and the exact posit ledger, or `none` if the tree is ill-formed.
Total, structural, and `Prop`-free: the object logic never touches the
host's propositions. -/
def check (Γ : Ctx) : Deriv → Option (DFormula × Ledger)
| .hyp i =>
match Γ[i]? with
| some φ => some (φ, .empty)
| none => none
| .eqRefl t => some (.eq t t, .empty)
| .eqSubst φ t s dEq dT =>
match check Γ dEq, check Γ dT with
| some (cEq, o₁), some (cT, o₂) =>
if cEq = DFormula.eq t s then
if cT = φ.subst 0 t then some (φ.subst 0 s, o₁.union o₂)
else none
else none
| _, _ => none
| .succNeZero t => some (.neg (.eq (.succ t) .zero), .empty)
| .succInj d =>
match check Γ d with
| some (.eq (.succ t) (.succ s), o) => some (.eq t s, o)
| _ => none
| .addZero t => some (.eq (.add t .zero) t, .empty)
| .addSucc t s => some (.eq (.add t (.succ s)) (.succ (.add t s)), .empty)
| .mulZero t => some (.eq (.mul t .zero) .zero, .empty)
| .mulSucc t s => some (.eq (.mul t (.succ s)) (.add (.mul t s) t), .empty)
| .ind φ d₀ dS =>
match check Γ d₀, check Γ dS with
| some (c₀, o₁), some (cS, o₂) =>
if c₀ = φ.subst 0 .zero then
if cS = DFormula.all (.impl φ φ.stepSucc) then
-- Stratification: induction on a quantified formula posts the
-- FULL-IND tier flag; on a QF formula it stays in the QF tier.
-- Whether FULL-IND is "forced by initiality" or a strength step
-- is the measured question the flag exists to answer.
let base := o₁.union o₂
let o := if φ.isQF then base else base.union .ofIndFull
some (.all φ, o)
else none
else none
| _, _ => none
| .implIntro φ d =>
match check (φ :: Γ) d with
| some (ψ, o) => some (.impl φ ψ, o)
| none => none
| .implElim d₁ d₂ =>
match check Γ d₁, check Γ d₂ with
| some (.impl φ ψ, o₁), some (φ', o₂) =>
if φ' = φ then some (ψ, o₁.union o₂) else none
| _, _ => none
| .conjIntro d₁ d₂ =>
match check Γ d₁, check Γ d₂ with
| some (φ, o₁), some (ψ, o₂) => some (.conj φ ψ, o₁.union o₂)
| _, _ => none
| .conjElim1 d =>
match check Γ d with
| some (.conj φ _, o) => some (φ, o)
| _ => none
| .conjElim2 d =>
match check Γ d with
| some (.conj _ ψ, o) => some (ψ, o)
| _ => none
| .disjIntro1 ψ d =>
match check Γ d with
| some (φ, o) => some (.disj φ ψ, o)
| none => none
| .disjIntro2 φ d =>
match check Γ d with
| some (ψ, o) => some (.disj φ ψ, o)
| none => none
| .disjElim d dL dR =>
match check Γ d with
| some (.disj φ ψ, o) =>
match check (φ :: Γ) dL, check (ψ :: Γ) dR with
| some (χ₁, o₁), some (χ₂, o₂) =>
if χ₁ = χ₂ then some (χ₁, (o.union o₁).union o₂) else none
| _, _ => none
| _ => none
| .flsElim φ d =>
match check Γ d with
| some (.fls, o) => some (φ, o)
| _ => none
| .allIntro d =>
match check (Γ.map (DFormula.lift 1 0)) d with
| some (φ, o) => some (.all φ, o)
| none => none
| .allElim t d =>
match check Γ d with
| some (.all φ, o) => some (φ.subst 0 t, o)
| _ => none
| .exIntro φ t d =>
match check Γ d with
| some (c, o) =>
if c = φ.subst 0 t then some (.ex φ, o) else none
| none => none
| .exElim ψ d dBody =>
match check Γ d with
| some (.ex φ, o) =>
match check (φ :: Γ.map (DFormula.lift 1 0)) dBody with
| some (ψ', o₂) =>
if ψ' = ψ.lift 1 0 then some (ψ, o.union o₂) else none
| none => none
| _ => none
| .emPosit φ => some (.disj φ φ.neg, .ofEM)
| .lpoPosit φ =>
some (.impl (.all (.disj φ φ.neg)) (.disj (.ex φ) (.all φ.neg)), .ofLPO)
| .mpPosit φ =>
if φ.isQF then some (.impl (.neg (.neg (.ex φ))) (.ex φ), .ofMP)
else none
What this page does not claim
The check does not prove that the framework's axioms are true. The check does not claim that its posits are forced by reality. The check does not certify that a formula is meaningful, only that its derivation is well-formed.
Verify this page
Every tagged claim above names its theorem. To check one yourself rather than trust this page, elaborate the source module with Lean 4 and audit its axiom basis:
$ lake env lean IndisputableMonolith/DeltaKernel/Check.lean
expected axiom basis: [propext, Classical.choice, Quot.sound] (the Lean kernel's standard three; no RS-specific axioms)
A page whose claims cannot be reproduced this way does not ship. In production, every anchor links to the exact declaration in the public source release, and this block carries the build receipt for the page itself.
Derived articles
This page is generated by a question-recursion engine: the questions its answers raise become the next pages. The current agenda, with open targets marked red:
- What distinguishes a forced derivation from one that merely relies on weaker posits?
- How does the ledger audit scale to the full forcing chain of the framework?
- Which classical theorems in the library check with an empty ledger?
- What would a derivation that uses Markov's principle but not excluded middle look like?
MACHINE LAYER · GROUNDED CLAIM TABLE · CLICK TO EXPAND
THEOREM check · IndisputableMonolith/DeltaKernel/Check.lean
/-- The kernel: audit a derivation tree in a context. Returns the proved formula and the exact posit ledger, or `none` if the tree is ill-formed. Total, structural, and `Prop`-free: the object logic never touches the host's propositions. -/ def check (Γ : Ctx) : Deriv → Option (DFormula × Ledger) | .hyp i => match Γ[i]? with | some φ => some (φ, .empty) | none => none | .eqRefl t => some (.eq t t, .empty) | .eqSubst φ t s dEq dT => match check Γ dEq, check Γ dT with | some (cEq, o₁), some (cT, o₂) => if cEq = DFormula.eq t s then if cT = φ.subst 0 t then some (φ.subst 0 s, o₁.union o₂) else none else none | _, _ => none | .succNeZero t => some (.neg (.eq (.succ t) .zero), .empty) | .succInj d => match check Γ d with | some (.eq (.succ t) (.succ s), o) => some (.eq t s, o) | _ => none | .addZero t => some (.eq (.add t .zero) t, .empty) | .addSucc t s => some (.eq (.add t (.succ s)) (.succ (.add t s)), .empty) | .mulZero t => some (.eq (.mul t .zero) .zero, .empty) | .mulSucc t s => some (.eq (.mul t (.succ s)) (.add (.mul t s) t), .empty) | .ind φ d₀ dS => match check Γ d₀, check Γ dS with | some (c₀, o₁), some (cS, o₂) => if c₀ = φ.subst 0 .zero then if cS = DFormula.all (.impl φ φ.stepSucc) then -- Stratification: induction on a quantified formula posts the -- FULL-IND tier flag; on a QF formula it stays in the QF tier. -- Whether FULL-IND is "forced by initiality" or a strength step -- is the measured question the flag exists to answer. let base := o₁.union o₂ let o := if φ.isQF then base else base.union .ofIndFull some (.all φ, o) else none else none | _, _ => none | .implIntro φ d => match check (φ :: Γ) d with | some (ψ, o) => some (.impl φ ψ, o) | none => none | .implElim d₁ d₂ => match check Γ d₁, check Γ d₂ with | some (.impl φ ψ, o₁), some (φ', o₂) => if φ' = φ then some (ψ, o₁.union o₂) else none | _, _ => none | .conjIntro d₁ d₂ => match check Γ d₁, check Γ d₂ with | some (φ, o₁), some (ψ, o₂) => some (.conj φ ψ, o₁.union o₂) | _, _ => none | .conjElim1 d => match check Γ d with | some (.conj φ _, o) => some (φ, o) | _ => none | .conjElim2 d => match check Γ d with | some (.conj _ ψ, o) => some (ψ, o) | _ => none | .disjIntro1 ψ d => match check Γ d with | some (φ, o) => some (.disj φ ψ, o) | none => none | .disjIntro2 φ d => match check Γ d with | some (ψ, o) => some (.disj φ ψ, o) | none => none | .disjElim d dL dR => match check Γ d with | some (.disj φ ψ, o) => match check (φ :: Γ) dL, check (ψ :: Γ) dR with | some (χ₁, o₁), some (χ₂, o₂) => if χ₁ = χ₂ then some (χ₁, (o.union o₁).union o₂) else none | _, _ => none | _ => none | .flsElim φ d => match check Γ d with | some (.fls, o) => some (φ, o) | _ => none | .allIntro d => match check (Γ.map (DFormula.lift 1 0)) d with | some (φ, o) => some (.all φ, o) | none => none | .allElim t d => match check Γ d with | some (.all φ, o) => some (φ.subst 0 t, o) | _ => none | .exIntro φ t d => match check Γ d with | some (c, o) => if c = φ.subst 0 t then some (.ex φ, o) else none | none => none | .exElim ψ d dBody => match check Γ d with | some (.ex φ, o) => match check (φ :: Γ.map (DFormula.lift 1 0)) dBody with | some (ψ', o₂) => if ψ' = ψ.lift 1 0 then some (ψ, o.union o₂) else none | none => none | _ => none | .emPosit φ => some (.disj φ φ.neg, .ofEM) | .lpoPosit φ => some (.impl (.all (.disj φ φ.neg)) (.disj (.ex φ) (.all φ.neg)), .ofLPO) | .mpPosit φ => if φ.isQF then some (.impl (.neg (.neg (.ex φ))) (.ex φ), .ofMP) else noneThe checking function takes a derivation tree and either rejects it as ill-formed or returns the proved formula together with the exact set of posits it consumed. check · IndisputableMonolith/DeltaKernel/Check.leanTHEOREM Forced · IndisputableMonolith/DeltaKernel/Check.lean
/-- FORCED verdict: the tree checks with an empty ledger. This is the kernel-native σ0 / DELTA_FORCED certificate. -/ def Forced (Γ : Ctx) (d : Deriv) (φ : DFormula) : Prop := check Γ d = some (φ, Ledger.empty)A forced verdict means the tree checks with an empty ledger, so the formula is proved without any posits. Forced · IndisputableMonolith/DeltaKernel/Check.leanTHEOREM check · IndisputableMonolith/DeltaKernel/Check.lean
/-- The kernel: audit a derivation tree in a context. Returns the proved formula and the exact posit ledger, or `none` if the tree is ill-formed. Total, structural, and `Prop`-free: the object logic never touches the host's propositions. -/ def check (Γ : Ctx) : Deriv → Option (DFormula × Ledger) | .hyp i => match Γ[i]? with | some φ => some (φ, .empty) | none => none | .eqRefl t => some (.eq t t, .empty) | .eqSubst φ t s dEq dT => match check Γ dEq, check Γ dT with | some (cEq, o₁), some (cT, o₂) => if cEq = DFormula.eq t s then if cT = φ.subst 0 t then some (φ.subst 0 s, o₁.union o₂) else none else none | _, _ => none | .succNeZero t => some (.neg (.eq (.succ t) .zero), .empty) | .succInj d => match check Γ d with | some (.eq (.succ t) (.succ s), o) => some (.eq t s, o) | _ => none | .addZero t => some (.eq (.add t .zero) t, .empty) | .addSucc t s => some (.eq (.add t (.succ s)) (.succ (.add t s)), .empty) | .mulZero t => some (.eq (.mul t .zero) .zero, .empty) | .mulSucc t s => some (.eq (.mul t (.succ s)) (.add (.mul t s) t), .empty) | .ind φ d₀ dS => match check Γ d₀, check Γ dS with | some (c₀, o₁), some (cS, o₂) => if c₀ = φ.subst 0 .zero then if cS = DFormula.all (.impl φ φ.stepSucc) then -- Stratification: induction on a quantified formula posts the -- FULL-IND tier flag; on a QF formula it stays in the QF tier. -- Whether FULL-IND is "forced by initiality" or a strength step -- is the measured question the flag exists to answer. let base := o₁.union o₂ let o := if φ.isQF then base else base.union .ofIndFull some (.all φ, o) else none else none | _, _ => none | .implIntro φ d => match check (φ :: Γ) d with | some (ψ, o) => some (.impl φ ψ, o) | none => none | .implElim d₁ d₂ => match check Γ d₁, check Γ d₂ with | some (.impl φ ψ, o₁), some (φ', o₂) => if φ' = φ then some (ψ, o₁.union o₂) else none | _, _ => none | .conjIntro d₁ d₂ => match check Γ d₁, check Γ d₂ with | some (φ, o₁), some (ψ, o₂) => some (.conj φ ψ, o₁.union o₂) | _, _ => none | .conjElim1 d => match check Γ d with | some (.conj φ _, o) => some (φ, o) | _ => none | .conjElim2 d => match check Γ d with | some (.conj _ ψ, o) => some (ψ, o) | _ => none | .disjIntro1 ψ d => match check Γ d with | some (φ, o) => some (.disj φ ψ, o) | none => none | .disjIntro2 φ d => match check Γ d with | some (ψ, o) => some (.disj φ ψ, o) | none => none | .disjElim d dL dR => match check Γ d with | some (.disj φ ψ, o) => match check (φ :: Γ) dL, check (ψ :: Γ) dR with | some (χ₁, o₁), some (χ₂, o₂) => if χ₁ = χ₂ then some (χ₁, (o.union o₁).union o₂) else none | _, _ => none | _ => none | .flsElim φ d => match check Γ d with | some (.fls, o) => some (φ, o) | _ => none | .allIntro d => match check (Γ.map (DFormula.lift 1 0)) d with | some (φ, o) => some (.all φ, o) | none => none | .allElim t d => match check Γ d with | some (.all φ, o) => some (φ.subst 0 t, o) | _ => none | .exIntro φ t d => match check Γ d with | some (c, o) => if c = φ.subst 0 t then some (.ex φ, o) else none | none => none | .exElim ψ d dBody => match check Γ d with | some (.ex φ, o) => match check (φ :: Γ.map (DFormula.lift 1 0)) dBody with | some (ψ', o₂) => if ψ' = ψ.lift 1 0 then some (ψ, o.union o₂) else none | none => none | _ => none | .emPosit φ => some (.disj φ φ.neg, .ofEM) | .lpoPosit φ => some (.impl (.all (.disj φ φ.neg)) (.disj (.ex φ) (.all φ.neg)), .ofLPO) | .mpPosit φ => if φ.isQF then some (.impl (.neg (.neg (.ex φ))) (.ex φ), .ofMP) else noneThree posit rules, excluded middle, the limited principle of omniscience, and Markov's principle, are the only rules that post to the ledger. check · IndisputableMonolith/DeltaKernel/Check.leanTHEOREM check · IndisputableMonolith/DeltaKernel/Check.lean
/-- The kernel: audit a derivation tree in a context. Returns the proved formula and the exact posit ledger, or `none` if the tree is ill-formed. Total, structural, and `Prop`-free: the object logic never touches the host's propositions. -/ def check (Γ : Ctx) : Deriv → Option (DFormula × Ledger) | .hyp i => match Γ[i]? with | some φ => some (φ, .empty) | none => none | .eqRefl t => some (.eq t t, .empty) | .eqSubst φ t s dEq dT => match check Γ dEq, check Γ dT with | some (cEq, o₁), some (cT, o₂) => if cEq = DFormula.eq t s then if cT = φ.subst 0 t then some (φ.subst 0 s, o₁.union o₂) else none else none | _, _ => none | .succNeZero t => some (.neg (.eq (.succ t) .zero), .empty) | .succInj d => match check Γ d with | some (.eq (.succ t) (.succ s), o) => some (.eq t s, o) | _ => none | .addZero t => some (.eq (.add t .zero) t, .empty) | .addSucc t s => some (.eq (.add t (.succ s)) (.succ (.add t s)), .empty) | .mulZero t => some (.eq (.mul t .zero) .zero, .empty) | .mulSucc t s => some (.eq (.mul t (.succ s)) (.add (.mul t s) t), .empty) | .ind φ d₀ dS => match check Γ d₀, check Γ dS with | some (c₀, o₁), some (cS, o₂) => if c₀ = φ.subst 0 .zero then if cS = DFormula.all (.impl φ φ.stepSucc) then -- Stratification: induction on a quantified formula posts the -- FULL-IND tier flag; on a QF formula it stays in the QF tier. -- Whether FULL-IND is "forced by initiality" or a strength step -- is the measured question the flag exists to answer. let base := o₁.union o₂ let o := if φ.isQF then base else base.union .ofIndFull some (.all φ, o) else none else none | _, _ => none | .implIntro φ d => match check (φ :: Γ) d with | some (ψ, o) => some (.impl φ ψ, o) | none => none | .implElim d₁ d₂ => match check Γ d₁, check Γ d₂ with | some (.impl φ ψ, o₁), some (φ', o₂) => if φ' = φ then some (ψ, o₁.union o₂) else none | _, _ => none | .conjIntro d₁ d₂ => match check Γ d₁, check Γ d₂ with | some (φ, o₁), some (ψ, o₂) => some (.conj φ ψ, o₁.union o₂) | _, _ => none | .conjElim1 d => match check Γ d with | some (.conj φ _, o) => some (φ, o) | _ => none | .conjElim2 d => match check Γ d with | some (.conj _ ψ, o) => some (ψ, o) | _ => none | .disjIntro1 ψ d => match check Γ d with | some (φ, o) => some (.disj φ ψ, o) | none => none | .disjIntro2 φ d => match check Γ d with | some (ψ, o) => some (.disj φ ψ, o) | none => none | .disjElim d dL dR => match check Γ d with | some (.disj φ ψ, o) => match check (φ :: Γ) dL, check (ψ :: Γ) dR with | some (χ₁, o₁), some (χ₂, o₂) => if χ₁ = χ₂ then some (χ₁, (o.union o₁).union o₂) else none | _, _ => none | _ => none | .flsElim φ d => match check Γ d with | some (.fls, o) => some (φ, o) | _ => none | .allIntro d => match check (Γ.map (DFormula.lift 1 0)) d with | some (φ, o) => some (.all φ, o) | none => none | .allElim t d => match check Γ d with | some (.all φ, o) => some (φ.subst 0 t, o) | _ => none | .exIntro φ t d => match check Γ d with | some (c, o) => if c = φ.subst 0 t then some (.ex φ, o) else none | none => none | .exElim ψ d dBody => match check Γ d with | some (.ex φ, o) => match check (φ :: Γ.map (DFormula.lift 1 0)) dBody with | some (ψ', o₂) => if ψ' = ψ.lift 1 0 then some (ψ, o.union o₂) else none | none => none | _ => none | .emPosit φ => some (.disj φ φ.neg, .ofEM) | .lpoPosit φ => some (.impl (.all (.disj φ φ.neg)) (.disj (.ex φ) (.all φ.neg)), .ofLPO) | .mpPosit φ => if φ.isQF then some (.impl (.neg (.neg (.ex φ))) (.ex φ), .ofMP) else noneThere is no rule that closes a goal without a complete sub-tree, so an incomplete derivation is simply an ill-formed tree and the checker rejects it. check · IndisputableMonolith/DeltaKernel/Check.lean