Checker "lazylean"
Version: 0.3.0 · 📄 Declaration · 🔗 Source
lazylean — a Lean 4 kernel in C++ whose reduction engine is a lazy
abstract machine in the style of the Coq kernel's cClosure, rather than
Lean's substitution-based whnf.
- The type-checking algorithm is Lean's own (
is_def_eq, lazy delta reduction with reducibility hints, proof irrelevance, eta, K-like recursors,Nat/Stringliterals with GMP), cross-checked against lean4lean; recursors are re-derived from the inductive specification and compared with the exported ones. - Weak-head normalisation runs a Krivine machine: closures over environments, call-by-need thunks overwritten with their value when first forced, constant C++ stack, reference-counted memory proportional to the live data.
- Lean's compiled
match/brecOnwrapper chains are fused once per definition, and structurally recursive definitions get Coq-style fixpoint rules that the kernel verifies withis_def_eqbefore using them. Lean.reduceBool/reduceNat(native reduction) are declined.- Declarations are checked by worker processes forked after the export has been parsed, so the parse and the interned terms are shared rather than repeated; the export's declaration order is verified first, so that no worker can be shown a constant introduced after the one it is checking.
Written by Claude (Anthropic), directed by Chris Emery.
71 ✅ 0 ❌ 0 🚫
130 ✅ 0 ❌ 0 🚫
18 ✅ 0 🚫
| Test | Expected | Result | ⏱️ | 🧠 | |||
|---|---|---|---|---|---|---|---|
| cedar | 👍 | 👍 | 1.2 m | (-45%) | 978.0 MB | (-30%) | |
| con-leche | 👍 | 👍 | 1.3 m | (-31%) | 617.9 MB | (-28%) | |
| cslib | 👍 | 👍 | 3.5 m | (-49%) | 2.3 GB | (-24%) | |
| init | 👍 | 👍 | 35.5 s | (-42%) | 374.0 MB | (-30%) | |
| init-prelude | 👍 | 👍 | 101 ms | (÷3.6) | 29.9 MB | (÷2.5) | |
| mathlib | 👍 | 👍 | 15.4 m | (÷2.1) | 5.6 GB | (-26%) | |
| std | 👍 | 👍 | 58.5 s | (-43%) | 670.4 MB | (-23%) | |
| 18 | 59 ms | 23.4 MB | |||||
| constlevels | ✋ | ✋ | 2 ms | 21.2 MB | |||
| ctor-num-fields | ✋ | ✋ | 2 ms | 21.4 MB | |||
| k-rec-conv | ✋ | ✋ | 2 ms | 21.4 MB | |||
| large-elim-param | ✋ | ✋ | 1 ms | 21.3 MB | |||
| large-elim-prop-bool | ✋ | ✋ | 2 ms | 21.4 MB | |||
| level-imax-leq | ✋ | ✋ | 1 ms | 21.3 MB | |||
| level-imax-normalization | ✋ | ✋ | 1 ms | 21.4 MB | |||
| nat-rec-k-lie | ✋ | ✋ | 1 ms | 21.3 MB | |||
| nat-rec-rules | ✋ | ✋ | 1 ms | 21.5 MB | |||
| nested-unused-param | ✋ | ✋ | 3 ms | 21.8 MB | |||
| orphan-rec | ✋ | ✋ | 1 ms | 21.3 MB | |||
| proj-non-structure | ✋ | ✋ | 1 ms | 21.2 MB | |||
| proj-of-imax-prop | ✋ | ✋ | 2 ms | 21.2 MB | |||
| proj-of-stuck-prop | ✋ | ✋ | 9 ms | 23.3 MB | |||
| proj-of-subst-prop | ✋ | ✋ | 9 ms | 23.3 MB | |||
| rec-k-lie | ✋ | ✋ | 1 ms | 21.3 MB | |||
| rec-missing-ih | ✋ | ✋ | 10 ms | 23.2 MB | |||
| rec-of-subst-prop | ✋ | ✋ | 10 ms | 23.4 MB | |||
| 1 | 35 ms | 22.9 MB | |||||
| alg-conv-trans-acc | 🤷 | ✋ | 3 ms | 22.7 MB | |||
| alg-conv-trans-acc-left | 🤷 | 👍 | 3 ms | 22.1 MB | |||
| alg-conv-trans-acc-right | 🤷 | 👍 | 3 ms | 22.1 MB | |||
| alg-conv-trans-quot | 🤷 | ✋ | 1 ms | 21.3 MB | |||
| alg-conv-trans-quot-left | 🤷 | ✋ | 1 ms | 21.4 MB | |||
| alg-conv-trans-quot-left-def | 🤷 | 👍 | 1 ms | 21.2 MB | |||
| alg-conv-trans-quot-right | 🤷 | 👍 | 1 ms | 21.3 MB | |||
| eta-ctor | 🤷 | ✋ | 1 ms | 21.3 MB | |||
| eta-rule-k | 🤷 | ✋ | 1 ms | 21.2 MB | |||
| imax-right-successor | 🤷 | ✋ | 1 ms | 21.2 MB | |||
| let-value-type-mismatch | 🤷 | ✋ | 1 ms | 21.2 MB | |||
| nested-nonuniform-param | 🤷 | 👍 | 1 ms | 21.2 MB | |||
| positivity-whnf | 🤷 | ✋ | 1 ms | 21.2 MB | |||
| proj-maybe-prop | 🤷 | 👍 | 1 ms | 21.1 MB | |||
| proj-maybe-prop-past | 🤷 | 👍 | 1 ms | 21.2 MB | |||
| proof-param-ok | 👍 | 👍 | 1 ms | 21.3 MB | |||
| proof-param-swap | 🤷 | ✋ | 1 ms | 21.3 MB | |||
| subject-reduction-redex | 🤷 | 👍 | 3 ms | 22.1 MB | |||
| subject-reduction-reduct | 🤷 | ✋ | 3 ms | 22.9 MB | |||
| 9 | 13 ms | 21.5 MB | |||||
| extra-rec | ✋ | ✋ | 1 ms | 21.3 MB | |||
| level-index-out-of-order | 👍 | 👍 | 1 ms | 21.2 MB | |||
| nat-lit-add | 👍 | 👍 | 2 ms | 21.5 MB | |||
| nat-lit-add-bad | ✋ | ✋ | 2 ms | 21.5 MB | |||
| nat-lit-ble | 👍 | 👍 | 2 ms | 21.5 MB | |||
| nat-lit-sub | 👍 | 👍 | 2 ms | 21.4 MB | |||
| orphan-ctor | ✋ | ✋ | 1 ms | 21.3 MB | |||
| proj-of-prop | ✋ | ✋ | 1 ms | 21.3 MB | |||
| sparse-name-index | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 25 | 22.0 s | (÷3.3) | 1.3 GB | ||||
| app-lam | 👍 | 👍 | 2.4 s | (÷2.1) | 77.6 MB | (÷18) | |
| args-before-unfold | 👍 | 👍 | 6 ms | (÷6.3) | 24.5 MB | (÷2.7) | |
| beta-ladder | 👍 | 👍 | 668 ms | (÷2.5) | 46.6 MB | (÷11) | |
| church-numerals | 👍 | 👍 | 17 ms | (÷2.7) | 30.1 MB | (÷2.6) | |
| discarded-argument | 👍 | 👍 | 10 ms | (÷16) | 24.6 MB | (÷2.7) | |
| discarded-argument-match | 👍 | 👍 | 33 ms | (÷3.8) | 25.0 MB | (÷2.8) | |
| folded-constant-first | 👍 | 👍 | 5 ms | (÷8.1) | 24.6 MB | (÷2.8) | |
| folded-constant-last | 👍 | 👍 | 5 ms | (÷8.1) | 26.7 MB | (÷2.6) | |
| fueled-chain | 👍 | 👍 | 111 ms | (+10%) | 26.0 MB | (÷2.9) | |
| grind-ring-5 | 👍 | 👍 | 816 ms | (÷2.6) | 86.0 MB | (÷2.7) | |
| identical-nesting | 👍 | 👍 | 1 ms | (÷20) | 21.4 MB | (÷3.1) | |
| irrelevance-before-evaluation | 👍 | 👍 | 1 ms | (÷20) | 21.3 MB | (÷3.1) | |
| let-ladder | 👍 | 👍 | 366 ms | (÷2.8) | 36.5 MB | (÷8.8) | |
| magma-list-deep-n21 | 👍 | 👍 | 389 ms | (÷5.8) | 29.3 MB | (÷19) | |
| magma-list-deep-n36 | 👍 | 👍 | 5.2 s | (÷5.6) | 45.9 MB | (÷142) | |
| magma-list-pair-n21 | 👍 | 👍 | 6.0 s | (÷2.9) | 1.3 GB | (÷2.7) | |
| magma-list-pair-n7 | 👍 | 👍 | 512 ms | (÷3.0) | 128.4 MB | (÷3.0) | |
| magma-string-n4 | 👍 | 👍 | 1.9 s | (-46%) | 53.2 MB | (÷2.2) | |
| magma-string-pair-n9 | 👍 | 👍 | 3.5 s | (÷2.2) | 157.6 MB | (÷5.7) | |
| refute-cheap-first | ✋ | ✋ | 10 ms | (÷4.0) | 25.2 MB | (÷2.7) | |
| refute-cheap-last | ✋ | ✋ | 10 ms | (÷17) | 23.2 MB | (÷3.0) | |
| repeated-subproblem | 👍 | 👍 | 2 ms | (÷18) | 21.4 MB | (÷3.1) | |
| shared-subterm | 👍 | 👍 | 19 ms | (÷3.1) | 27.8 MB | (÷2.6) | |
| shift-cascade | 👍 | 👍 | 88 ms | (+93%) | 32.6 MB | (÷2.1) | |
| unroll-versus-evaluate | 👍 | 👍 | 2 ms | (÷20) | 21.3 MB | (÷3.1) | |
| 141 | 187 ms | 21.9 MB | |||||
| 001_basicDef | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 002_badDef | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 003_arrowType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 004_dependentType | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 005_constType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 006_betaReduction | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 007_betaReduction2 | 👍 | 👍 | 1 ms | 21.1 MB | |||
| 008_forallSortWhnf | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 009_forallSortBad | ✋ | ✋ | 1 ms | 21.4 MB | |||
| 010_nonTypeType | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 011_nonTypeAxiom | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 012_nonPropThm | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 013_thmProof | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 014_selfProof | ✋ | ✋ | 1 ms | 21.1 MB | |||
| 015_levelComp1 | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 016_levelComp2 | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 017_levelComp3 | 👍 | 👍 | 1 ms | 21.1 MB | |||
| 018_levelParams | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 019_tut06_bad01 | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 020_levelComp4 | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 021_levelComp5 | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 022_imax1 | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 023_imax2 | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 024_levelMaxComm | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 025_levelMaxAssoc | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 026_levelMaxIdem | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 027_levelMaxAbsorb | 👍 | 👍 | 1 ms | 21.4 MB | |||
| 028_inferVar | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 029_defEqLambda | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 030_peano1 | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 031_peano2 | 👍 | 👍 | 1 ms | 21.4 MB | |||
| 032_peano3 | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 033_letType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 034_letTypeDep | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 035_letRed | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 036_empty | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 037_boolType | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 038_twoBool | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 039_andType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 040_prodType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 041_pprodType | 👍 | 👍 | 1 ms | 21.1 MB | |||
| 042_pUnitType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 043_eqType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 044_natDef | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 045_rbTreeDef | 👍 | 👍 | 2 ms | 21.2 MB | |||
| 046_inductBadNonSort | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 047_inductBadNonSort2 | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 048_inductLevelParam | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 049_inductTooFewParams | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 050_inductWrongCtorParams | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 051_inductWrongCtorResParams | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 052_inductWrongCtorResLevel | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 053_inductInIndex | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 054_indNeg | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 055_reduceCtorParam.mk | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 056_reduceCtorType.mk | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 057_indNegReducible | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 058_predWithTypeField | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 059_typeWithTypeField | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 060_typeWithTypeFieldPoly | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 061_typeWithTooHighTypeField.mk | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 062_emptyRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 063_boolRec | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 064_twoBoolRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 065_andRec | 👍 | 👍 | 1 ms | 21.4 MB | |||
| 066_prodRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 067_pprodRec | 👍 | 👍 | 1 ms | 21.4 MB | |||
| 068_punitRec | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 069_eqRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 070_nRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 071_rbTreeRef | 👍 | 👍 | 2 ms | 21.1 MB | |||
| 072_boolPropRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 073_BogusRecursor | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 074_existsRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 075_typeSingletonRecReduction | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 076_sortElimPropRec | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 077_sortElimProp2Rec | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 078_boolRecEqns | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 079_prodRecEqns | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 080_nRecReduction | 👍 | 👍 | 1 ms | 21.4 MB | |||
| 081_listRecReduction | 👍 | 👍 | 2 ms | 21.3 MB | |||
| 082_RBTree.id_spec | 👍 | 👍 | 3 ms | 21.9 MB | |||
| 083_And.right | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 084_Prod.snd | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 085_PProd.snd | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 086_PSigma.snd | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 087_projOutOfRange | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 088_projNotStruct | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 089_projProp1 | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 090_projProp2 | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 091_projProp3 | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 092_projProp4 | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 093_projProp5 | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 094_projProp6 | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 095_projDataIndexRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 096_projIndexData | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 097_projIndexData2 | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 098_projRed | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 099_ruleK | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 100_ruleKbad | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 101_ruleKAcc | ✋ | ✋ | 2 ms | 21.3 MB | |||
| 102_aNatLit | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 103_natLitEq | 👍 | 👍 | 1 ms | 21.5 MB | |||
| 104_proofIrrelevance | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 105_proofIrrelevanceBad | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 106_proofIrrelevanceWhnf | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 107_proofIrrelevanceUnderBinder | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 108_unitEta1 | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 109_unitEta2 | 👍 | 👍 | 1 ms | 21.4 MB | |||
| 110_unitEta3 | 👍 | 👍 | 1 ms | 21.4 MB | |||
| 111_indexedUnitEta | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 112_structEta | 👍 | 👍 | 2 ms | 21.3 MB | |||
| 113_indexedStructEta | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 114_funEta | 👍 | 👍 | 1 ms | 21.1 MB | |||
| 115_funEtaDep | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 116_funEtaBad | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 117_reflOccLeft | ✋ | ✋ | 1 ms | 21.1 MB | |||
| 118_reflOccInIndex | ✋ | ✋ | 1 ms | 21.2 MB | |||
| 119_reduceCtorParamRefl.mk | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 120_reduceCtorParamRefl2.mk | 👍 | 👍 | 1 ms | 21.1 MB | |||
| 121_rTreeRec | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 122_rtreeRecReduction | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 123_accRecType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 124_accRecReduction | 👍 | 👍 | 2 ms | 21.3 MB | |||
| 125_accRecNoEta | ✋ | ✋ | 2 ms | 21.3 MB | |||
| 126_quotMkType | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 127_quotIndType | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 128_quotLiftType | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 129_quotSoundType | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 130_quotLiftReduction | 👍 | 👍 | 1 ms | 21.2 MB | |||
| 131_quotIndReduction | 👍 | 👍 | 1 ms | 21.3 MB | |||
| 132_dup_defs | ✋ | ✋ | 1 ms | 21.5 MB | |||
| 133_dup_ind_def | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 134_dup_ctor_def | ✋ | ✋ | 1 ms | 21.4 MB | |||
| 135_dup_rec_def | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 136_misnamed_rec_user | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 137_dup_rec_def2 | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 138_dup_ctor_rec | ✋ | ✋ | 1 ms | 21.4 MB | |||
| 139_DupConCon | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 140_falseFromUnsafe | ✋ | ✋ | 1 ms | 21.3 MB | |||
| 141_falseFromPartial | ✋ | ✋ | 1 ms | 21.3 MB |
Detailed results
Test "bugs/constlevels"
Expected: ✋ reject · Size: 15.3 KB · Lines: 283 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Regression test for undefined behavior in lazy_delta_reduction_step in the official kernel
In the function lazy_delta_reduction_step, the official kernel expects unfold_definition
to always succeed. However, if the constant has an incorrect number of level parameters, it
actually fails, which leads to memory corruption in lazy_delta_reduction_step.
This test is to check that the official kernel and also other kernels that closely follow the logic of the official kernel correctly handle this unfolding failure.
The issue in the official kernel was originally reported as https://github.com/leanprover/lean4/issues/10577.
Test result: ✋ rejected · exit code 1 · wall time: 52 ms · instructions: 9.1 M · max rss memory: 21.2 MB
stderr:
loaded 12 declarations, 204 exprs (204 unique), 63 names in 0.000485041s declaration order verified in 2.505e-06s environment built in 2.2271e-05s; checking with 4 worker processes FAIL _test (line 283): let value type mismatch for 'x' checked 11 declarations, 1 failed, in 0.002973s wall (2.09597e-06 core-hours over 4 workers); 4 reduction steps; peak 19 MB in one worker
Test "bugs/ctor-num-fields"
Expected: ✋ reject · Size: 34.1 KB · Lines: 622 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof of False via trusted numFields on a constructor.
Define a wrapper structure S with one field, and lie by saying it has 0 fields, making
it look unit-like. Then definitional eta means all inhabitants are equal.
Derive a contradiction from S.mk false = S.mk true.
Nanoda and its descendants accepted this until it was fixed.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 9.5 M · max rss memory: 21.4 MB
stderr:
loaded 25 declarations, 465 exprs (465 unique), 124 names in 0.000663312s declaration order verified in 4.99e-06s environment built in 2.2011e-05s; checking with 4 worker processes FAIL _private.Test.0.S (line 235): constructor field/parameter/index counts do not match: _private.Test.0.S.mk checked 9 declarations, 1 failed, in 0.00260207s wall (1.94149e-06 core-hours over 4 workers); 2 reduction steps; peak 20 MB in one worker
Test "bugs/k-rec-conv"
Expected: ✋ reject · Size: 13.0 KB · Lines: 243 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Bogus proof that tests for incorrectly implemented K-like reduction.
fun x => x and fun _ => y are not convertible, but a checker that does treat them
as convertible would accept the resulting theorem bad, which is true propositionally, but not definitionally.
Regression test for sokonanoda.
Test result: ✋ rejected · exit code 1 · wall time: 21 ms · instructions: 9.1 M · max rss memory: 21.4 MB
stderr:
loaded 10 declarations, 167 exprs (167 unique), 61 names in 0.000703808s
declaration order verified in 5.33e-06s
environment built in 3.3402e-05s; checking with 4 worker processes
FAIL bad (line 243): declaration type mismatch for 'bad'
inferred: (((Eq.{1} T) t1) t1)
declared: (((Eq.{1} T) t1) t2)
checked 9 declarations, 1 failed, in 0.00325667s wall (2.39722e-06 core-hours over 4 workers); 5 reduction steps; peak 20 MB in one worker
Test "bugs/large-elim-param"
Expected: ✋ reject · Size: 6.2 KB · Lines: 88 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False via incorrect large elimination restriction.
If the check for whether a level is surely not zero is implemented wrong, in particular if it incorrectly returns true for params, we can create a universe-polymorphic
inductive MyBool.{u} : Sort u | tt | ff
where the recursor MyBool.rec.{1,0} can do large elimination of a Prop.
Because of proof irrelevance we have tt = ff, so we can derive a
contradiction.
Found by Anthony Wang using Aristotle, breaking the mini checker for the
T-shirt bounty; it was
fixed the same day.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 8.2 M · max rss memory: 21.3 MB
stderr:
loaded 5 declarations, 58 exprs (58 unique), 21 names in 0.000307721s declaration order verified in 2.335e-06s environment built in 2.0618e-05s; checking with 4 worker processes FAIL MyBool (line 86): recursor 'MyBool.rec' should only eliminate into Prop checked 2 declarations, 1 failed, in 0.0020825s wall (1.20994e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "bugs/large-elim-prop-bool"
Expected: ✋ reject · Size: 22.6 KB · Lines: 438 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof of False by allowing a Prop inductive to have the same recursor
that the corresponding Type inductive would have.
Proof irrelevance makes .tt = .ff, but pick distinguishes between them.
Kiota accepted this until it was fixed.
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 9.3 M · max rss memory: 21.4 MB
stderr:
loaded 17 declarations, 318 exprs (318 unique), 95 names in 0.000678441s declaration order verified in 6.502e-06s environment built in 1.9417e-05s; checking with 4 worker processes FAIL NewBool (line 307): recursor 'NewBool.rec' should only eliminate into Prop checked 8 declarations, 1 failed, in 0.0029811s wall (2.25596e-06 core-hours over 4 workers); 28 reduction steps; peak 19 MB in one worker
Test "bugs/level-imax-leq"
Expected: ✋ reject · Size: 5.6 KB · Lines: 93 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False via incorrect universe level comparison for imax.
A correct kernel must reject leq(imax(u,v)+1, imax(u,v)), since at u=0, v=0 this becomes
leq(1, 0) which is false. However, a checker that only compares the imax arguments
structurally (without accounting for an accumulated successor offset) will incorrectly accept it.
This allows defining a universe-collapsing identity function
down.{u,v} : Sort (succ (imax u v)) → Sort (imax u v), which is used to cast between
True and False via Bool.rec at Sort (imax 0 0) = Prop.
Nanoda incorrectly accepted this proof until it was fixed.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.9 M · max rss memory: 21.3 MB
stderr:
loaded 5 declarations, 59 exprs (59 unique), 22 names in 0.000439085s declaration order verified in 1.894e-06s environment built in 1.3775e-05s; checking with 4 worker processes FAIL False (line 69): recursor 'False.rec' elimination universe is named 'u_1', expected 'u' checked 0 declarations, 1 failed, in 0.00193511s wall (1.15466e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "bugs/level-imax-normalization"
Expected: ✋ reject · Size: 5.8 KB · Lines: 96 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False via incorrect universe level normalization for imax.
A correct kernel must distinguish imax 0 v from succ(imax 0 v), since at v=0 these
evaluate to 0 and 1 respectively. However, a level normalization algorithm that drops an
accumulated successor offset when decomposing imax u (param v) will produce identical normal
forms for both, causing the equivalence check to incorrectly return true.
This allows defining a universe-collapsing identity function
down.{v} : Sort (succ (imax 0 v)) → Sort (imax 0 v), and then
myProp : Prop := down.{0} Bool (a Prop that is computationally Bool). Proof irrelevance on
myProp equates Bool.true and Bool.false, and Bool.rec maps this into False.
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 8.2 M · max rss memory: 21.4 MB
stderr:
loaded 6 declarations, 60 exprs (60 unique), 24 names in 0.000942631s declaration order verified in 1.884e-06s environment built in 1.3806e-05s; checking with 4 worker processes FAIL down (line 77): declaration type mismatch for 'down' inferred: ((x : Sort((imax 0 v)+1)) -> Sort((imax 0 v)+1)) declared: ((x : Sort((imax 0 v)+1)) -> Sort((imax 0 v))) checked 5 declarations, 1 failed, in 0.00198743s wall (1.41216e-06 core-hours over 4 workers); 22 reduction steps; peak 19 MB in one worker
Test "bugs/nat-rec-k-lie"
Expected: ✋ reject · Size: 6.3 KB · Lines: 106 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False via trusted k on Nat.rec.
Lie by claiming Nat.rec is K-like. Then replace the major premise by Nat.zero,
but nat literals bypasses K-like reduction, so two reduction rules disagree.
∀ n, g n holds by the first, and g 1 is False by the second.
A variant of bugs/rec-k-lie, which nanoda and its descendants accepted until it
was fixed; at that time, nanoda
itself rejected this variant, as it had no literal path for Nat.rec.
Test result: ✋ rejected · exit code 1 · wall time: 20 ms · instructions: 8.0 M · max rss memory: 21.3 MB
stderr:
loaded 6 declarations, 67 exprs (67 unique), 30 names in 0.000385957s declaration order verified in 2.474e-06s environment built in 5.2016e-05s; checking with 4 worker processes FAIL Nat (line 59): recursor 'Nat.rec': parameter/index/motive/minor/K data differs from the derived recursor checked 2 declarations, 1 failed, in 0.00190771s wall (1.3905e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "bugs/nat-rec-rules"
Expected: ✋ reject · Size: 8.1 KB · Lines: 128 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False via incorrect recursor rule validation.
When processing an inductive type declaration, a correct kernel must verify that the generated recursor rules match the ones provided in the export data. A checker that accidentally compares the imported rules against themselves (instead of against independently constructed rules) will accept arbitrary recursor reduction behavior.
This test defines Nat with a wrong Nat.rec succ rule that always returns hzero (ignoring
the induction hypothesis). Combined with a nat literal extension that hardcodes correct
arithmetic for concrete nat literals but falls back to the wrong Nat.rec rules for symbolic
arguments, this creates an inconsistency that yields a proof of False.
Nanoda incorrectly accepted this proof until it was fixed.
Test result: ✋ rejected · exit code 1 · wall time: 20 ms · instructions: 8.1 M · max rss memory: 21.5 MB
stderr:
loaded 6 declarations, 92 exprs (92 unique), 27 names in 0.00097448s declaration order verified in 1.0079e-05s environment built in 1.9557e-05s; checking with 4 worker processes FAIL False (line 91): recursor 'False.rec' elimination universe is named 'u_1', expected 'u' checked 0 declarations, 1 failed, in 0.00188418s wall (1.08074e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "bugs/nested-unused-param"
Expected: ✋ reject · Size: 59.2 KB · Lines: 1.1 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Checks that the parameters of a nested inductive application are type-checked even when they do not appear in the auxiliary type generated during nested-inductive compilation.
When an inductive E has a constructor whose type contains a nested
application L (E w) b, the elaboration of nested inductives replaces that
occurrence with an auxiliary type. The argument b does not occur in the
auxiliary declaration, so a checker that only checks the auxiliary type never
sees b. A correct checker must still ensure b is well-typed; this test
rejects if it is not.
Here b is a malformed projection C.0 (C.0 w) (applying a C projection to
a value of the unrelated structure W), disguised by a hash collision. If the
parameter is not checked, the bogus projection slips through and the resulting
E can be used to build an axiom-free proof of False (boom). The
projection is merely the payload; the property under test is that the
nested-inductive parameter is checked.
Origin: reported as leanprover/lean4#14576 by @kiranandcode, with the original source recorded by @xrchz (https://github.com/xrchz/collatzlean); fixed in leanprover/lean4#14577.
Test result: ✋ rejected · exit code 1 · wall time: 21 ms · instructions: 15.6 M · max rss memory: 21.8 MB
stderr:
loaded 35 declarations, 811 exprs (811 unique), 202 names in 0.000804614s declaration order verified in 3.807e-06s environment built in 2.1259e-05s; checking with 4 worker processes FAIL e (line 1024): invalid projection C.0 FAIL bad (line 1050): invalid projection C.0 FAIL E (line 1012): invalid projection C.0 checked 31 declarations, 3 failed, in 0.00540135s wall (4.73705e-06 core-hours over 4 workers); 430 reduction steps; peak 21 MB in one worker
Test "bugs/orphan-rec"
Expected: ✋ reject · Size: 1.4 KB · Lines: 21 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False from a recursor that claims not to belong to any inductive
type.
The export contains False exactly as the prelude has it — an empty
Prop-valued inductive with no constructors — together with its ordinary
False.rec. Smuggled into the same inductive block is a second recursor,
named rogue, whose type is False itself, which has no motives, no minor
premises and no rules, and whose all field is the empty list. The theorem
inconsistent : False is then simply rogue.
This is the sibling of other/extra-rec, and it defeats the obvious fix for it. A
checker that associates each exported recursor with the inductive type named
in its all field, and then requires the recursors so associated with an
inductive type to be exactly the ones it derives from that declaration, still
accepts rogue: False is associated with False.rec and nothing else, and
rogue is associated with nothing at all, so no comparison ever looks at it —
yet it is added to the environment and inhabits the genuine empty type.
A checker must therefore reject any recursor it did not itself derive from an
inductive declaration, rather than only checking the recursors that point at
one. The same hole is reachable by pointing all at a name that has no
declaration in the export (that variant is what other/orphan-ctor does on the
constructor side).
Nanoda accepted this export until it was fixed.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 10 exprs (10 unique), 7 names in 0.000684782s declaration order verified in 3.497e-06s environment built in 1.5298e-05s; checking with 4 worker processes FAIL False (line 18): recursor count mismatch for 'False': export has 2, derived 1 checked 0 declarations, 1 failed, in 0.00195702s wall (1.33894e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "bugs/proj-non-structure"
Expected: ✋ reject · Size: 5.0 KB · Lines: 75 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Bad has two constructors, so projections should not be allowed.
Prove false by using the second constructor, then projecting, hoping that the
first constructor is used when inferring the type of the projection.
Nanoda and its descendants accepted this until it was fixed.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.9 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 48 exprs (48 unique), 21 names in 0.000288696s declaration order verified in 5.841e-06s environment built in 2.5477e-05s; checking with 4 worker processes FAIL bad (line 75): invalid projection Bad.0 checked 3 declarations, 1 failed, in 0.00197373s wall (1.17894e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "bugs/proj-of-imax-prop"
Expected: ✋ reject · Size: 19.3 KB · Lines: 321 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A closed proof of False, with no axioms, via a data projection out of a
proposition whose sort is Prop only up to universe level normalization.
ImaxProp : Sort (imax 1 0) is a proposition, since imax 1 0 normalizes to 0.
The exploit uses two definitionally equal spellings of that type. Proof
irrelevance is stated through ImaxAsProp : Prop := ImaxProp, whose type is the
literal Sort 0, so it is accepted; the data projection imaxProjBool is stated
on ImaxProp, whose type is the literal Sort (imax 1 0). A kernel that tests
sorts for Prop syntactically does not recognize the latter as a proposition and
wrongly allows projecting its Bool field out of a proof. Congruence on the
proof-irrelevance equation then equates false and true, giving False.
This is https://github.com/leanprover/lean4/pull/14613, a bug in the official kernel.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 9.2 M · max rss memory: 21.2 MB
stderr:
loaded 19 declarations, 217 exprs (217 unique), 80 names in 0.000378614s declaration order verified in 3.417e-06s environment built in 2.5748e-05s; checking with 4 worker processes FAIL imaxProjBool (line 245): invalid projection ImaxProp.0 checked 16 declarations, 1 failed, in 0.00243495s wall (2.01771e-06 core-hours over 4 workers); 7 reduction steps; peak 19 MB in one worker
Test "bugs/proj-of-stuck-prop"
Expected: ✋ reject · Size: 275.9 KB · Lines: 5.3 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof of False by projecting the Bool field out of a proposition, exploiting
that a kernel can disagree with itself about whether the structure lives in
Prop.
Same underlying defect as bugs/rec-missing-ih, but with a different consequence.
Mechanism
-
Definitional equality is not transitive here. Three functions
Bool → Boolare built fromAcc.recsuch that a kernel reportsrcA ≡ rcBandrcB ≡ rcC— both by proof irrelevance on theAccargument — whilercA ≢ rcC, because there the twoAccproofs have different types. -
In the affected kernels, the defeq cache closes that relation transitively, but only for hash-equal terms. Established equalities are kept in a union-find structure, and the comparison returns early, without consulting it, when the hashes differ:
~~~cpp if (is_eqp(a, b)) return true; if (m_use_hash && hash(a) != hash(b)) return false; // skips the union-find ... node_ref r1 = find(to_node(a)); node_ref r2 = find(to_node(b)); if (r1 == r2) return true; ~~~
So whether
rcA ≡ rcCholds depends on the hash of the surrounding term. The constants and paddings are chosen so that the hashes collide exactly when the argument is the free variable_kernel_fresh.0, and not for the closed instantiation used later. -
That comparison decides a result sort.
Native64ResultSortGateis a K-like inductive predicate, and its recursor is used as the result sort of the inductive familyNative64ResultSortOwner: the sortGate.rec x … Prop requested hreduces toProponly if the requested indices are definitionally equal to the ones ofGate.intro. HenceOwner x his a proposition in one context and a stuck sort in another:Native64ResultSort.asPropis checked against a constant standing for∀ x h, Prop, so the kernel introduces_kernel_fresh.0forx, the hashes collide,Owner x h : Propis accepted, andNative64ResultSortLeak.propositionis aPropfor every later declaration — including for proof irrelevance.Native64ResultSortLeak.observeprojects field 0 out of that proposition. There the sort of the closed termOwner false closedGateis needed, and that one is stuck — the affected kernels answerfalsewhen asked whether it is definitionally equal toProp— so they do not see a proposition and permit projecting out theBoolfield.
Proof irrelevance then identifies two Owner.mk applications carrying
different Bool fields, and observing them yields False. The affected
kernels rejected Native64ResultSortOwner with type expected as soon as the
hashes no longer collided.
This was accepted by the official kernel at v4.28.0, v4.29.1, v4.33.0 and
nightly-2026-08-01. Other kernels reject the export in one of two places:
either they refuse Native64ResultSortOwner because its result type does not
reduce to a sort, or they accept the type but refuse the projection of a data
field out of a proposition.
Both steps are ruled out now: the projection by
leanprover/lean4#14807, which
makes the kernel's is_prop check require the inferred type to reduce to a
sort, and the hash-gated transitivity of step 2 by
leanprover/lean4#14806, which
replaces the union-find defeq cache with an order-independent one. The same
projection, reached without any help from that cache, is bugs/proj-of-subst-prop.
Test result: ✋ rejected · exit code 1 · wall time: 26 ms · instructions: 55.3 M · max rss memory: 23.3 MB
stderr:
loaded 117 declarations, 4392 exprs (4392 unique), 744 names in 0.00160621s
declaration order verified in 1.4547e-05s
environment built in 4.7338e-05s; checking with 4 worker processes
FAIL Native64ResultSort.asProp (line 4750): application type mismatch in ((id.{1} Sort(0)) ((Native64ResultSortOwner $0) $2))
argument type: ((((((((Native64ResultSortGate.rec.{2} $0) (fun (index : Bool) => (fun (index : Bool) => (fun (index : Bool) => (fun (index : Bool) => (fun (proof : (((((Native64ResultSortGate $0) #3) #2) #1) #0)) => Sort(1))))))) Sort(0)) (Native64SortGateB.0.3766726852 ((fun (salt : Nat) => $0) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) (Native64SortGateA.1.2023879994 ((fun (salt : Nat) => $0) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) (Native64SortGateA.1.2023879994 ((fun (salt : Nat) => $0) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) (Native64SortGateA.1.2023879994 ((fun (salt : Nat) => $0) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) $2)
expected: Sort(0)
FAIL Native64ResultSortOwner (line 4742): type expected: ((((((((Native64ResultSortGate.rec.{2} $8) (fun (index : Bool) => (fun (index : Bool) => (fun (index : Bool) => (fun (index : Bool) => (fun (proof : (((((Native64ResultSortGate $8) #3) #2) #1) #0)) => Sort(1))))))) Sort(0)) (Native64SortGateB.0.3766726852 ((fun (salt : Nat) => $8) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) (Native64SortGateA.1.2023879994 ((fun (salt : Nat) => $8) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) (Native64SortGateA.1.2023879994 ((fun (salt : Nat) => $8) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) (Native64SortGateA.1.2023879994 ((fun (salt : Nat) => $8) (((OfNat.ofNat.{0} Nat) 125330) (instOfNatNat 125330))))) $9)
checked 104 declarations, 2 failed, in 0.00900685s wall (8.43274e-06 core-hours over 4 workers); 1666 reduction steps; peak 23 MB in one worker
Test "bugs/proj-of-subst-prop"
Expected: ✋ reject · Size: 255.6 KB · Lines: 4.9 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof of False by projecting the Bool field out of a proposition, reached by
substituting a proof of one proposition for a proof of a definitionally equal
one.
Mechanism
-
Definitional equality is not transitive here.
a,bandcare threeBools built fromAcc.recsuch that a kernel reportsa ≡ bandb ≡ c— both by proof irrelevance on theAccargument, the latter after some iota steps — whilea ≢ c, because there the twoAccproofs have different types (Acc (· < ·) 1vs.Acc (· < ·) 0). -
So
P := a = bandQ := a = care definitionally equal types whose proofs behave differently.gate h := Eq.rec (motive := fun _ _ => Type) Prop hK-reduces toPropforh : P, because that reduction only needs the type ofhto be definitionally equal to the typea = aofEq.refl a, i.e.b ≡ a. For the closedwitness : Qit stays stuck, since that would needc ≡ a. -
An inductive family is declared over the reducing side and used on the stuck one.
Owner : ∀ (h : P), gate his accepted as a family of propositions — its recursor only eliminates intoProp.Owner witnessis well-typed, sinceQ ≡ P, but its sort does not reduce toProp, so the projectionobserveis permitted to extract theBoolfield from an inhabitant.
Proof irrelevance then identifies two Owner.mk applications carrying
different Bool fields, and observing them yields False, with no axioms
involved.
Unlike bugs/rec-missing-ih and bugs/proj-of-stuck-prop, this needs no interference
from the definitional-equality cache: every comparison above comes out the same
way in a fresh type-checker session, so it is independent of whether, and how,
such a cache is keyed. What it does need is that the sort of an inductive
family is re-examined after a substitution that definitional equality permits.
The projection in the last step is ruled out by
leanprover/lean4#14807, which
makes the kernel's is_prop check require the inferred type to reduce to a
sort: a stuck sort then raises (kernel) type expected instead of answering
that the type is not a proposition.
Test result: ✋ rejected · exit code 1 · wall time: 26 ms · instructions: 56.8 M · max rss memory: 23.3 MB
stderr:
loaded 110 declarations, 4030 exprs (4030 unique), 708 names in 0.00188551s declaration order verified in 1.6361e-05s environment built in 4.2428e-05s; checking with 4 worker processes FAIL PR14806Subst.observe (line 4846): type expected: (PR14806Subst.Owner PR14806Subst.witness) checked 107 declarations, 1 failed, in 0.00962503s wall (9.44685e-06 core-hours over 4 workers); 2351 reduction steps; peak 23 MB in one worker
Test "bugs/rec-k-lie"
Expected: ✋ reject · Size: 5.3 KB · Lines: 87 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
False theorem via trusted k on a recursor.
Define MyBool with two constructors, and lie by claiming its recursor is K-like,
so the major premise is replaced by the first constructor without being examined.
disc MyBool.true is then True rather than False.
MyBool rather than Bool because a module that overwrites an imported constant
cannot be re-imported by the exporter.
Nanoda and its descendants accepted this until it was fixed.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 5 declarations, 49 exprs (49 unique), 30 names in 0.000650468s declaration order verified in 1.913e-06s environment built in 1.8434e-05s; checking with 4 worker processes FAIL MyBool (line 35): recursor 'MyBool.rec': parameter/index/motive/minor/K data differs from the derived recursor checked 0 declarations, 1 failed, in 0.0021252s wall (1.1428e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "bugs/rec-missing-ih"
Expected: ✋ reject · Size: 289.6 KB · Lines: 5.5 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False from a generated recursor whose reduction rule drops the
induction hypothesis.
Mechanism
-
Definitional equality is not transitive here. The test builds three functions
Bool → BoolfromAcc.recfor which a kernel reportsrcA ≡ rcBandrcB ≡ rcC— both by proof irrelevance on theAccargument, the latter after some iota steps — butrcA ≢ rcC, because there the twoAccproofs have different types (Acc (· < ·) 1vs.Acc (· < ·) 0). -
In the affected kernels, the defeq cache closes that relation transitively, but only for hash-equal terms. Established equalities are kept in a union-find structure, and the comparison returns early, without consulting it, when the hashes differ:
~~~cpp if (is_eqp(a, b)) return true; if (m_use_hash && hash(a) != hash(b)) return false; // skips the union-find ... node_ref r1 = find(to_node(a)); node_ref r2 = find(to_node(b)); if (r1 == r2) return true; ~~~
So whether
rcA ≡ rcCholds depends on the hash of the surrounding term. The three constants and the two paddings are picked so that the hashes collide for the free variables that the affected implementations create while building the minor premises of the recursor (_ind_fresh.3,_ind_fresh.9), but not for the pass that builds the recursor rules (_ind_fresh.14). -
A K-like reduction is made to depend on that comparison.
Native64TwoHashGateis a K-like inductive predicate (one parameter, fourBoolindices, one field-less constructor pinning the indices), so reducingGate.rec … hrequires the indices ofh's type to be definitionally equal to the ones ofGate.intro's result type.Native64TwoHashOwner.stephas a recursive argument whose type is such aGate.recapplication, which therefore reduces toOwnerin one pass but not in the other.
The resulting Native64TwoHashOwner.rec has a step minor premise expecting
four arguments (including the induction hypothesis) but a rule that applies it
to only three, so the ih binder swallows the next argument. That makes the
Prop-valued badProp reduce to Bool, and a Prop with two
distinguishable inhabitants gives False.
Affected kernels not only accept these declarations, they also re-derive the
same broken recursor when replaying the export data. This was the case for
the official kernel at v4.28.0, v4.29.1, v4.33.0 and nightly-2026-08-01.
Kernels that construct the recursor independently reject the export, mostly
with an error about Native64TwoHashOwner.step having an invalid occurrence of
the datatype being declared — which is also what the affected kernels reported
as soon as one of the hashes no longer collided.
Fixed by leanprover/lean4#14806, which replaces the union-find defeq cache with an order-independent one, so that a hash collision can no longer make a comparison succeed that fails on its own.
Test result: ✋ rejected · exit code 1 · wall time: 27 ms · instructions: 58.9 M · max rss memory: 23.2 MB
stderr:
loaded 118 declarations, 4596 exprs (4596 unique), 793 names in 0.00249052s declaration order verified in 1.6961e-05s environment built in 5.4281e-05s; checking with 4 worker processes FAIL Native64TwoHashOwner (line 4811): arg #3 of 'Native64TwoHashOwner.step' has a non valid occurrence of the datatypes being declared checked 111 declarations, 1 failed, in 0.00952624s wall (8.68616e-06 core-hours over 4 workers); 2124 reduction steps; peak 23 MB in one worker
Test "bugs/rec-of-subst-prop"
Expected: ✋ reject · Size: 270.3 KB · Lines: 5.1 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof of False from a Prop that carries a Type field, recovered through
the recursor instead of a projection.
A second variant of bugs/proj-of-subst-prop, sharing its first two steps:
-
Definitional equality is not transitive on three
Bools built fromAcc.rec—gateA ≡ gateBandgateB ≡ gateCby proof irrelevance on theAccargument, butgateA ≢ gateC— soGateP := gateA = gateBandGateQ := gateA = gateCare definitionally equal types whose proofs behave differently underEq.rec.resultSort hK-reduces toPropfor a variableh : GatePand stays stuck for the closedgateWitness : GateQ. -
Issue.Owner : ∀ (h : GateP), resultSort his therefore accepted as a family of propositions whose constructor carries a fieldA : Type, whileOwner gateWitness— well-typed, sinceGateQ ≡ GateP— has a sort that does not reduce toProp.
Where bugs/proj-of-subst-prop then projects the field out, this variant eliminates
Owner with its own Prop-only recursor into Fiber X := Acc emptyTypeRel X,
which is a proposition, and recovers the data from there: Acc.rec eliminates
Acc into Type, and propext transports an Acc proof between two Fiber
types. Proof irrelevance identifies Owner.mk gateWitness Empty with
Owner.mk gateWitness Unit, so the identity function of one type is applied to
a value of the other, and Empty becomes inhabited. The proof of False uses
propext and no other axiom.
Because no projection is involved, the guard that stops bugs/proj-of-subst-prop —
refusing to project a data field out of a proposition — never fires here. A
checker has to refuse the substitution, or the stuck result sort of
Issue.Owner, instead.
Both variants are ruled out by
leanprover/lean4#14807, which
makes the kernel's is_prop check require the inferred type to reduce to a
sort: Issue.Owner is then rejected with (kernel) type expected.
The exploit is by Daniel Selsam (OpenAI), generated with OpenAI's internal models, and is the regression test added in leanprover/lean4#14847.
Test result: ✋ rejected · exit code 1 · wall time: 31 ms · instructions: 58.1 M · max rss memory: 23.4 MB
stderr:
loaded 127 declarations, 4203 exprs (4203 unique), 776 names in 0.00221223s
declaration order verified in 2.3704e-05s
environment built in 5.0133e-05s; checking with 4 worker processes
FAIL Issue.opaqueEndpoint (line 4788): declaration type mismatch for 'Issue.opaqueEndpoint'
inferred: ((p : Issue.ModeP) -> (((Eq.{1} Nat) ((Nat.add (Issue.modeG Issue.modeQ)) 0)) ((Nat.add (Issue.modeG Issue.modeQ)) 0)))
declared: ((p : Issue.ModeP) -> (((Eq.{1} Nat) ((Nat.add (Issue.modeG #0)) 0)) ((Nat.add (Issue.modeG Issue.modeQ)) 0)))
checked 123 declarations, 1 failed, in 0.0112098s wall (1.04748e-05 core-hours over 4 workers); 2360 reduction steps; peak 23 MB in one worker
Test "cedar"
Expected: 👍 accept · Size: 790.9 MB · Lines: 14.6 M · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Lean formalization of, and proofs about, Cedar.
Auto-generated documentation is available at https://cedar-policy.github.io/cedar-spec/docs/.
This test case exports the whole Cedar module and as such contains even unused parts Init and
Batteries.
Test result: 👍 accepted · exit code 0 · wall time: 21.0 s · instructions: 442.1 G · max rss memory: 978.0 MB
stderr:
loaded 133828 declarations, 13461542 exprs (13461542 unique), 985525 names in 1.54873s declaration order verified in 0.0883237s environment built in 0.0464061s; checking with 4 worker processes checked 133828 declarations, 0 failed, in 19.3986s wall (0.0215362 core-hours over 4 workers); 86413667 reduction steps; peak 977 MB in one worker
Test "con-leche"
Expected: 👍 accept · Size: 525.9 MB · Lines: 10.0 M · lean4export: 3.1.0 · Lean: 4.33.0 · 📄 Declaration · 🔗 Source
The con-leche development's
three theorems: the consistency proof of its verified checker —
model_exists, every environment the checker accepts has a
set-theoretic model, and its corollary no_proof_of_False, no proof of
False is accepted — and the equivalence of its byte-level parser with
a naive reference (scanLineSpec_eq_scanLineFwd), each with its
dependency cone.
Test result: 👍 accepted · exit code 0 · wall time: 18.9 s · instructions: 456.7 G · max rss memory: 617.9 MB
stderr:
loaded 26819 declarations, 9679077 exprs (9679077 unique), 337090 names in 0.761307s declaration order verified in 0.0464964s environment built in 0.00561891s; checking with 4 worker processes checked 26819 declarations, 0 failed, in 18.0939s wall (0.0196966 core-hours over 4 workers); 79091265 reduction steps; peak 617 MB in one worker
Test "corner-cases/alg-conv-trans-acc"
Expected: 🤷 either · Size: 66.0 KB · Lines: 1.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
As Lean's type theory has undecidable conversion (a.k.a. definitional equality), there are bound to be gaps between so called "algorithmic" conversion (that which is implemented by a typechecker), and the "declarative" conversion.
In the official kernel, algorithmic conversion fails to be transitive. f 1 a
is a normal form: a is a variable, so Acc.rec cannot fire on it. Proof
irrelevance admits any other proof of Acc (· < ·) 1 in its place, and
Acc.intro 1 fun _ => Acc.inv a carries a constructor at the head, so it
reduces. left is that substitution, right the reduction it unblocks, and
trans chains the two.
acc asks for the endpoints on their own, which means inventing the middle
term: choosing, among the proofs of a proposition, the one that happens to
reduce the right way. The kernel has no reason to go looking, the left side
being normal already, and unfolding regardless does not terminate here, as
each step makes the term larger.
References:
- Mario Carneiro, The Type Theory of Lean, MSc thesis
Test result: ✋ rejected · exit code 1 · wall time: 22 ms · instructions: 18.8 M · max rss memory: 22.7 MB
stderr:
loaded 39 declarations, 917 exprs (917 unique), 199 names in 0.000818373s
declaration order verified in 1.2473e-05s
environment built in 2.5136e-05s; checking with 4 worker processes
FAIL trans (line 1171): declaration type mismatch for 'trans'
inferred: ((a : (((Acc.{1} Nat) (fun (x1._@.Test.1043551373._hygCtx._hyg.6 : Nat) => (fun (x2._@.Test.1043551373._hygCtx._hyg.6 : Nat) => ((((LT.lt.{0} Nat) instLTNat) #1) #0)))) (((OfNat.ofNat.{0} Nat) 1) (instOfNatNat 1)))) -> (((Eq.{1} Bool) ((f (((OfNat.ofNat.{0} Nat) 1) (instOfNatNat 1))) #0)) ((f (((OfNat.ofNat.{0} Nat) 1) (instOfNatNat 1))) #0)))
declared: ((a : (((Acc.{1} Nat) (fun (x1._@.Test.1043551373._hygCtx._hyg.6 : Nat) => (fun (x2._@.Test.1043551373._hygCtx._hyg.6 : Nat) => ((((LT.lt.{0} Nat) instLTNat) #1) #0)))) (((OfNat.ofNat.{0} Nat) 1) (instOfNatNat 1)))) -> (((Eq.{1} Bool) ((f (((OfNat.ofNat.{0} Nat) 1) (instOfNatNat 1))) #0)) ((f (((OfNat.ofNat.{0} Nat) 0) (instOfNatNat 0))) ((((((Acc.inv.{1} Nat) (fun (x1._@.Test.1043551373._hygCtx._hyg.6 : Nat) => (fun (x2._@.Test.1043551373._hygCtx._hyg.6 : Nat) => ((((LT.lt.{0} Nat) instLTNat) #1) #0)))) (((OfNat.ofNat.{0} Nat) 1) (instOfNatNat 1))) (((OfNat.ofNat.{0} Nat) 0) (instOfNatNat 0))) #0) (Nat.lt_succ_self (((OfNat.ofNat.{0} Nat) 0) (instOfNatNat 0)))))))
checked 38 declarations, 1 failed, in 0.00567659s wall (4.70047e-06 core-hours over 4 workers); 523 reduction steps; peak 22 MB in one worker
Test "corner-cases/alg-conv-trans-acc-left"
Expected: 🤷 either · Size: 67.0 KB · Lines: 1.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The creative half of corner-cases/alg-conv-trans-acc. Acc.rec is stuck
on the variable a, and proof irrelevance admits any other proof of
Acc (· < ·) 1 in its place, including one with a constructor at the head.
Given both sides, a checker verifies this immediately; producing the
right-hand side unprompted is the step no algorithm takes.
Test result: 👍 accepted · exit code 0 · wall time: 21 ms · instructions: 18.6 M · max rss memory: 22.1 MB
stderr:
loaded 40 declarations, 931 exprs (931 unique), 204 names in 0.000861563s declaration order verified in 5.36e-06s environment built in 2.6089e-05s; checking with 4 worker processes checked 40 declarations, 0 failed, in 0.0057135s wall (5.05084e-06 core-hours over 4 workers); 537 reduction steps; peak 21 MB in one worker
Test "corner-cases/alg-conv-trans-acc-right"
Expected: 🤷 either · Size: 67.3 KB · Lines: 1.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The mechanical half of corner-cases/alg-conv-trans-acc. With a
constructor in the major premise, Acc.rec fires and step descends to the
predecessor 0.
Test result: 👍 accepted · exit code 0 · wall time: 22 ms · instructions: 19.1 M · max rss memory: 22.1 MB
stderr:
loaded 40 declarations, 938 exprs (938 unique), 204 names in 0.000679464s declaration order verified in 1.1401e-05s environment built in 2.5658e-05s; checking with 4 worker processes checked 40 declarations, 0 failed, in 0.00638088s wall (5.60363e-06 core-hours over 4 workers); 674 reduction steps; peak 21 MB in one worker
Test "corner-cases/alg-conv-trans-quot"
Expected: 🤷 either · Size: 8.5 KB · Lines: 169 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
left composed with right. Quotients of propositions cause
algorithmic conversion transitivity to fail because the typechecker must
creatively synthesise the representative of the quotient, and
proof irrelevance is definitional.
References:
- Mario Carneiro, The Type Theory of Lean, MSc thesis
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 8.4 M · max rss memory: 21.3 MB
stderr:
loaded 6 declarations, 127 exprs (127 unique), 31 names in 0.000527832s
declaration order verified in 2.124e-06s
environment built in 1.8665e-05s; checking with 4 worker processes
FAIL trans (line 169): declaration type mismatch for 'trans'
inferred: ((P : Sort(0)) -> ((r : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((α : Sort(1)) -> ((f : ((a : #2) -> #1)) -> ((h : ((x : #3) -> ((y : #4) -> ((a._@._internal._hyg.0 : ((#4 #1) #0)) -> (((Eq.{1} #4) (#3 #2)) (#3 #1)))))) -> ((q : ((Quot.{0} #4) #3)) -> ((z : #5) -> (((Eq.{1} #4) ((((((Quot.lift.{0, 1} #6) #5) #4) #3) #2) #1)) ((((((Quot.lift.{0, 1} #6) #5) #4) #3) #2) #1)))))))))
declared: ((P : Sort(0)) -> ((r : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((α : Sort(1)) -> ((f : ((a : #2) -> #1)) -> ((h : ((x : #3) -> ((y : #4) -> ((a._@._internal._hyg.0 : ((#4 #1) #0)) -> (((Eq.{1} #4) (#3 #2)) (#3 #1)))))) -> ((q : ((Quot.{0} #4) #3)) -> ((z : #5) -> (((Eq.{1} #4) ((((((Quot.lift.{0, 1} #6) #5) #4) #3) #2) #1)) (#3 #0)))))))))
checked 5 declarations, 1 failed, in 0.00348948s wall (2.00961e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "corner-cases/alg-conv-trans-quot-left"
Expected: 🤷 either · Size: 8.6 KB · Lines: 173 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Quot r is a Prop, so proof irrelevance relates q and Quot.mk r z.
However the official kernel does WHNF first, reducing the right side to f z,
so congruence never compares the arguments.
Test result: ✋ rejected · exit code 1 · wall time: 21 ms · instructions: 8.5 M · max rss memory: 21.4 MB
stderr:
loaded 6 declarations, 131 exprs (131 unique), 31 names in 0.000602421s
declaration order verified in 2.405e-06s
environment built in 1.9456e-05s; checking with 4 worker processes
FAIL left (line 173): declaration type mismatch for 'left'
inferred: ((P : Sort(0)) -> ((r : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((α : Sort(1)) -> ((f : ((a : #2) -> #1)) -> ((h : ((x : #3) -> ((y : #4) -> ((a._@._internal._hyg.0 : ((#4 #1) #0)) -> (((Eq.{1} #4) (#3 #2)) (#3 #1)))))) -> ((q : ((Quot.{0} #4) #3)) -> ((z : #5) -> (((Eq.{1} #4) ((((((Quot.lift.{0, 1} #6) #5) #4) #3) #2) #1)) ((((((Quot.lift.{0, 1} #6) #5) #4) #3) #2) #1)))))))))
declared: ((P : Sort(0)) -> ((r : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((α : Sort(1)) -> ((f : ((a : #2) -> #1)) -> ((h : ((x : #3) -> ((y : #4) -> ((a._@._internal._hyg.0 : ((#4 #1) #0)) -> (((Eq.{1} #4) (#3 #2)) (#3 #1)))))) -> ((q : ((Quot.{0} #4) #3)) -> ((z : #5) -> (((Eq.{1} #4) ((((((Quot.lift.{0, 1} #6) #5) #4) #3) #2) #1)) ((((((Quot.lift.{0, 1} #6) #5) #4) #3) #2) (((Quot.mk.{0} #6) #5) #0))))))))))
checked 5 declarations, 1 failed, in 0.00332906s wall (1.97344e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "corner-cases/alg-conv-trans-quot-left-def"
Expected: 🤷 either · Size: 10.5 KB · Lines: 208 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
left with Quot.lift behind a definition. WHNF does not unfold lift, so
the arguments are compared and proof irrelevance applies.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 8.5 M · max rss memory: 21.2 MB
stderr:
loaded 8 declarations, 160 exprs (160 unique), 34 names in 0.000633849s declaration order verified in 2.735e-06s environment built in 1.7412e-05s; checking with 4 worker processes checked 8 declarations, 0 failed, in 0.00346952s wall (1.97998e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/alg-conv-trans-quot-right"
Expected: 🤷 either · Size: 9.0 KB · Lines: 180 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Quotient computation rule.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 8.4 M · max rss memory: 21.3 MB
stderr:
loaded 7 declarations, 136 exprs (136 unique), 32 names in 0.000647284s declaration order verified in 2.255e-06s environment built in 1.631e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00309618s wall (2.00264e-06 core-hours over 4 workers); 2 reduction steps; peak 20 MB in one worker
Test "corner-cases/eta-ctor"
Expected: 🤷 either · Size: 9.0 KB · Lines: 148 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Function eta between a partially applied constructor and a free variable. The official kernel does not trigger eta expansion here, but a checker may accept the equality by expanding the functions. See https://github.com/leanprover/lean4/issues/12520 for a discussion.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 8.4 M · max rss memory: 21.3 MB
stderr:
loaded 6 declarations, 104 exprs (104 unique), 34 names in 0.000565682s
declaration order verified in 2.304e-06s
environment built in 1.2383e-05s; checking with 4 worker processes
FAIL etaCtor (line 148): declaration type mismatch for 'etaCtor'
inferred: ((a : ((proof : True) -> T)) -> (((Eq.{1} ((proof : True) -> T)) #0) #0))
declared: ((x : ((proof : True) -> T)) -> (((Eq.{1} ((proof : True) -> T)) (T.mk (T.val (#0 True.intro)))) #0))
checked 5 declarations, 1 failed, in 0.00293787s wall (2.49144e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/eta-rule-k"
Expected: 🤷 either · Size: 6.5 KB · Lines: 121 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Function eta between a partially applied recursor with rule K and a free variable. The official kernel does not trigger eta expansion here, but a checker may accept the equality by expanding the functions. See https://github.com/leanprover/lean4/issues/12520 for a discussion.
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 8.2 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 85 exprs (85 unique), 29 names in 0.000501914s
declaration order verified in 2.344e-06s
environment built in 1.4677e-05s; checking with 4 worker processes
FAIL etaRuleK (line 121): declaration type mismatch for 'etaRuleK'
inferred: ((a : ((a._@._internal._hyg.0 : (((Eq.{1} Bool) Bool.true) Bool.true)) -> Bool)) -> (((Eq.{1} ((a._@._internal._hyg.0 : (((Eq.{1} Bool) Bool.true) Bool.true)) -> Bool)) #0) #0))
declared: ((a : ((a._@._internal._hyg.0 : (((Eq.{1} Bool) Bool.true) Bool.true)) -> Bool)) -> (((Eq.{1} ((a._@._internal._hyg.0 : (((Eq.{1} Bool) Bool.true) Bool.true)) -> Bool)) (((((Eq.rec.{1, 1} Bool) Bool.true) (fun (x._@.Test.1420384072._hygCtx._hyg.30 : Bool) => (fun (x._@.Test.1420384072._hygCtx._hyg.32 : (((Eq.{1} Bool) Bool.true) #0)) => Bool))) (#0 ((Eq.refl.{1} Bool) Bool.true))) Bool.true)) #0))
checked 2 declarations, 1 failed, in 0.00270783s wall (2.08246e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/imax-right-successor"
Expected: 🤷 either · Size: 806 B · Lines: 21 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Universe-level normalization corner cases. The declarations use imax u 1
and imax u (v + 1) where their declared types use the corresponding
max levels. A checker may reject these hand-crafted exports using a more
conservative normalization, or accept them by recognizing that the right
operand is nonzero.
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 4 exprs (4 unique), 4 names in 0.00038157s declaration order verified in 1.493e-06s environment built in 9.708e-06s; checking with 4 worker processes FAIL imaxRightOne (line 11): declaration type mismatch for 'imaxRightOne' inferred: Sort((imax u 1)+1) declared: Sort((max u 1)+1) FAIL imaxRightSucc (line 21): declaration type mismatch for 'imaxRightSucc' inferred: Sort((imax u v+1)+1) declared: Sort((max u v+1)+1) checked 0 declarations, 2 failed, in 0.0015947s wall (9.28586e-07 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/let-value-type-mismatch"
Expected: 🤷 either · Size: 601 B · Lines: 13 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
A let has a mismatched annotation, but substitution removes the mismatch.
In readable notation, the exported declaration is:
def EcosystemCase : Sort 2 := let u : Sort 1 := Sort 1; u
The value Sort 1 has type Sort 2, rather than the annotated Sort 1.
Checking the supplied let can therefore reject it. Substituting its value
for u gives def EcosystemCase : Sort 2 := Sort 1, whose types match.
This records the choice to check the supplied annotation or first simplify the let. The discussion of this exact example supports allowing either outcome as practical checker policy, while leaving a completely authoritative answer open. This is not a false-theorem example.
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 5 exprs (5 unique), 4 names in 0.000358677s declaration order verified in 1.433e-06s environment built in 1.057e-05s; checking with 4 worker processes FAIL EcosystemCase (line 13): let value type mismatch for 'u' checked 0 declarations, 1 failed, in 0.00158199s wall (8.9304e-07 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/nested-nonuniform-param"
Expected: 🤷 either · Size: 9.2 KB · Lines: 142 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Checks that a parameter supplied to a nested inductive occurrence really acts as the datatype's parameter, i.e. that it is the parameter itself and does not change between recursive occurrences (as is already enforced for non-nested occurrences).
The inductive E : W → Type has constructor
E.mk : (w : W) → L (E ⟨false⟩) → E w, where L (α : Type) is nested. The
occurrence E ⟨false⟩ inside the nested L uses the constant ⟨false⟩ in
the position of E's parameter, instead of the actual parameter w. That
argument is type-correct, so it is not caught by merely type-checking the
nested application (leanprover/lean4#14577); a correct checker must also
verify that it is the expected parameter.
This particular declaration is not known to yield a proof of False: here L
stores no value of type α, so the nested occurrence is phantom and E w is
isomorphic to Unit for every w. The variant where L actually stores an
α (so recursion would descend into an E ⟨false⟩ while the motive is fixed
at E w) is already rejected by the kernel's positivity check ("non valid
occurrence"). Since it is not a demonstrated unsoundness, it is not settled
whether a checker should accept or reject it, so the expected outcome is
either and the test does not count towards completeness or soundness.
Origin: raised by @arthur-adjedj on leanprover/lean4#14577 (https://github.com/leanprover/lean4/pull/14577#issuecomment-5101819377) as a case not covered by that PR's fix; related to leanprover/lean4#14576.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.7 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 108 exprs (108 unique), 27 names in 0.000480945s declaration order verified in 2.224e-06s environment built in 1.3976e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00346205s wall (2.00578e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/positivity-whnf"
Expected: 🤷 either · Size: 4.7 KB · Lines: 81 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
A recursive occurrence appears in an unused argument of a reducible definition in a constructor field.
The declaration has the following shape:
def Ignore (A B : Type) : Type := A
inductive T : Type where
| mk (f : Ignore Unit T -> T) : T
Ignore takes a second type argument but does not use it, so Ignore Unit T reduces to Unit. A checker that inspects the unreduced constructor field may reject the syntactic occurrence of T in the domain of the arrow. A checker that first weak-head-normalizes the field type may instead see (Unit -> T) -> T and accept it. The test therefore has outcome eithe r.
A checker may reject it syntactically or accept it after reducing the field type.
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.8 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 50 exprs (50 unique), 23 names in 0.000231331s declaration order verified in 3.567e-06s environment built in 9.978e-06s; checking with 4 worker processes FAIL LALReduciblePositivity (line 81): arg #1 of 'LALReduciblePositivity.mk' has a non positive occurrence of the datatypes being declared checked 3 declarations, 1 failed, in 0.00168931s wall (9.96751e-07 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/proj-maybe-prop"
Expected: 🤷 either · Size: 8.1 KB · Lines: 131 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out of a structure that may or may not be a proposition.
MaybeProp is a structure whose sort is a bare level parameter: a
proposition for u := 0 and a data type for every other u. Lean's
inductive command refuses to declare one ("the resulting universe is not
Prop, but it may be Prop for some parameter values"), but the kernel
accepts it. The exported definition projects out its first field,
field : PUnit.{u}.
The official kernel accepts this. The field is not a proof for every u,
but the projection is sound at every instantiation: MaybeProp.{u} is a
proposition only for u := 0, and there the field's type PUnit.{0} is a
proposition too. That is no coincidence. A structure that is not a Prop
had every constructor field's universe checked against its resulting
universe (see the tutorial's typeWithTooHighTypeField), here u ≤ u, and
such an inequality survives instantiation — so wherever the structure does
turn out to be a proposition, so do all of its fields.
At the same time, the official kernel here allows more projections than the
recursor allows: MaybeProp.rec eliminates into Prop only, so this
projection cannot be expressed through the recursor. The elaborator does not
currently rely on this extra power, so for now it is reasonable for a
checker to be more restrictive here and reject the projection — for example
by asking "could this be a proposition?" and then demanding that the field
be definitely a proof. See
https://github.com/leanprover/lean4/issues/7637 for discussion.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 8.3 M · max rss memory: 21.1 MB
stderr:
loaded 5 declarations, 92 exprs (92 unique), 31 names in 0.000457751s declaration order verified in 2.224e-06s environment built in 2.3013e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.00216815s wall (1.49695e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "corner-cases/proj-maybe-prop-past"
Expected: 🤷 either · Size: 8.1 KB · Lines: 131 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The same as corner-cases/proj-maybe-prop, for a projection that only has
to step over such a field.
MaybeProp.tail is a proof for every u, so the field asked for here is
unobjectionable even under the restrictive reading. But reaching it means
walking past field, which proof depends on, and that is where the check
on a genuine proposition (the tutorial's projProp6) fires. A checker that
rejects corner-cases/proj-maybe-prop therefore rejects this one as well,
at field 0 rather than at field 2, and that remains a reasonable choice for
the same reason. See https://github.com/leanprover/lean4/issues/7637 for
discussion.
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 8.3 M · max rss memory: 21.2 MB
stderr:
loaded 5 declarations, 92 exprs (92 unique), 31 names in 0.000692228s declaration order verified in 2.424e-06s environment built in 1.7613e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.00275576s wall (1.61967e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "corner-cases/proof-param-ok"
Expected: 👍 accept · Size: 2.9 KB · Lines: 53 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Keeps two proof parameters in their declared order in an inductive constructor result.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.7 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 39 exprs (39 unique), 10 names in 0.000339342s declaration order verified in 1.3976e-05s environment built in 2.0228e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.0022383s wall (1.7414e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "corner-cases/proof-param-swap"
Expected: 🤷 either · Size: 2.9 KB · Lines: 53 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Swaps two proof parameters in an inductive constructor result. Checkers may either reject the swap or accept it using proof irrelevance.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 39 exprs (39 unique), 10 names in 0.000175176s declaration order verified in 5.731e-06s environment built in 1.0239e-05s; checking with 4 worker processes FAIL LALProofParameterSwap (line 53): invalid return type for 'LALProofParameterSwap.mk' checked 0 declarations, 1 failed, in 0.00194999s wall (1.03113e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "corner-cases/subject-reduction-redex"
Expected: 🤷 either · Size: 66.2 KB · Lines: 1.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Test for subject reduction, as in Carneiro's thesis.
The annotation on the lambda writes the middle term of
corner-cases/alg-conv-trans-acc down by hand, sparing the kernel from
having to invent it. The body checks against right, the argument against
left, and the two endpoints are never compared.
References:
- Mario Carneiro, The Type Theory of Lean, MSc thesis
Test result: 👍 accepted · exit code 0 · wall time: 22 ms · instructions: 19.1 M · max rss memory: 22.1 MB
stderr:
loaded 41 declarations, 921 exprs (921 unique), 205 names in 0.000687489s declaration order verified in 8.776e-06s environment built in 3.6809e-05s; checking with 4 worker processes checked 41 declarations, 0 failed, in 0.0066796s wall (5.95391e-06 core-hours over 4 workers); 716 reduction steps; peak 21 MB in one worker
Test "corner-cases/subject-reduction-reduct"
Expected: 🤷 either · Size: 65.2 KB · Lines: 1.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Beta erases the annotation of corner-cases/subject-reduction-redex, and
with it the middle term, leaving the two endpoints to compare: the conversion
of corner-cases/alg-conv-trans-acc. A term the kernel accepts thus
reduces to one it rejects.
References:
- Mario Carneiro, The Type Theory of Lean, MSc thesis
Test result: ✋ rejected · exit code 1 · wall time: 25 ms · instructions: 18.6 M · max rss memory: 22.9 MB
stderr:
loaded 40 declarations, 903 exprs (903 unique), 201 names in 0.000985443s
declaration order verified in 1.088e-05s
environment built in 2.9044e-05s; checking with 4 worker processes
FAIL reduct (line 1160): application type mismatch in ($11 $12)
argument type: ($9 ((f (((OfNat.ofNat.{0} Nat) 1) (instOfNatNat 1))) $8))
expected: ($9 ((f (((OfNat.ofNat.{0} Nat) 0) (instOfNatNat 0))) (redex._proof_1 $8)))
checked 39 declarations, 1 failed, in 0.00762992s wall (6.17708e-06 core-hours over 4 workers); 557 reduction steps; peak 22 MB in one worker
Test "cslib"
Expected: 👍 accept · Size: 2.0 GB · Lines: 37.5 M · lean4export: 3.1.0 · Lean: 4.30.0 · 📄 Declaration · 🔗 Source
The Lean Computer Science Library (CSLib).
Test result: 👍 accepted · exit code 0 · wall time: 1.1 m · instructions: 1.2 T · max rss memory: 2.3 GB
stderr:
loaded 370939 declarations, 34998459 exprs (34998459 unique), 2155654 names in 4.53151s declaration order verified in 0.285133s environment built in 0.182052s; checking with 4 worker processes checked 370939 declarations, 0 failed, in 59.0824s wall (0.0656081 core-hours over 4 workers); 182612243 reduction steps; peak 2382 MB in one worker
Test "init"
Expected: 👍 accept · Size: 309.5 MB · Lines: 6.1 M · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The Init module export from Lean 4 core.
This test contains the fundamental building blocks of Lean 4, including:
- Basic data types (Nat, List, Array, String, etc.)
- Core tactics and syntax
- Foundational mathematical structures
- Essential metaprogramming infrastructure
This is one of the smallest meaningful test cases, making it ideal for initial checker validation and debugging.
Test result: 👍 accepted · exit code 0 · wall time: 9.5 s · instructions: 212.9 G · max rss memory: 374.0 MB
stderr:
loaded 53093 declarations, 5726477 exprs (5726477 unique), 278268 names in 0.562277s declaration order verified in 0.0339655s environment built in 0.0138079s; checking with 4 worker processes checked 53093 declarations, 0 failed, in 8.93201s wall (0.00991444 core-hours over 4 workers); 49519537 reduction steps; peak 373 MB in one worker
Test "init-prelude"
Expected: 👍 accept · Size: 3.5 MB · Lines: 63.7 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The Init.Prelude module export.
Test result: 👍 accepted · exit code 0 · wall time: 60 ms · instructions: 606.4 M · max rss memory: 29.9 MB
stderr:
loaded 1777 declarations, 54535 exprs (54535 unique), 7297 names in 0.0132059s declaration order verified in 0.000392161s environment built in 0.000455861s; checking with 4 worker processes checked 1777 declarations, 0 failed, in 0.0302226s wall (3.14958e-05 core-hours over 4 workers); 33541 reduction steps; peak 27 MB in one worker
Test "mathlib"
Expected: 👍 accept · Size: 5.2 GB · Lines: 100.0 M · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The complete Mathlib library export.
This test contains all the mathematical definitions, theorems, and proofs from Mathlib, representing the largest and most comprehensive test case in the Lean kernel arena.
Test result: 👍 accepted · exit code 0 · wall time: 5.4 m · instructions: 5.5 T · max rss memory: 5.6 GB
stderr:
loaded 654504 declarations, 95334373 exprs (95334373 unique), 3971928 names in 14.4939s declaration order verified in 0.875799s environment built in 0.341208s; checking with 4 worker processes checked 654504 declarations, 0 failed, in 308.629s wall (0.342833 core-hours over 4 workers); 687645772 reduction steps; peak 5732 MB in one worker
Test "other/extra-rec"
Expected: ✋ reject · Size: 1.4 KB · Lines: 21 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False from an extra recursor that no inductive declaration could
produce.
The export contains False exactly as the prelude has it — an empty
Prop-valued inductive with no constructors — together with its ordinary
False.rec. Smuggled into the same inductive group is a second recursor,
named rogue, whose type is False itself and which has no motives, no minor
premises and no rules. The theorem inconsistent : False is then simply
rogue.
A checker must derive the recursors of an inductive group from the inductive
declaration and reject any exported recursor that is not one of them; here that
fails on the name (rogue is not False.rec) as well as on the type. A
checker that instead registers exported recursors as given ends up with an
inhabitant of the genuine empty type.
This is a different gap from bugs/nat-rec-rules, which perturbs the rules of a
legitimate recursor: here an entire recursor constant is fabricated, so
validating only the rules of the recursors one expects does not catch it.
Test result: ✋ rejected · exit code 1 · wall time: 32 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 10 exprs (10 unique), 7 names in 0.000192732s declaration order verified in 7.955e-06s environment built in 3.178e-05s; checking with 4 worker processes FAIL False (line 18): recursor count mismatch for 'False': export has 2, derived 1 checked 0 declarations, 1 failed, in 0.00273007s wall (1.88117e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "other/level-index-out-of-order"
Expected: 👍 accept · Size: 328 B · Lines: 6 · lean4export: 0.1.0 · Lean: 4.29.1 · 📄 Declaration
Lean4export will create internalization-table references contiguously in
order: in references for names, il references for levels, and ie
references for expressions all work this way.
However, the spec merely requires that these are integers. It's reasonable for an implementation to assume these are approximately dense (and to treat them as array indices instead of hashtable entries), but a kernel should handle skipped indices or out-of-order indices.
This test checks that the kernel doesn't require internaliation-table
references to be presented in ascending order. If the level referenes 2 and
1 were swapped, this would be the expected encoding of axiom foo : Sort 2.
This encoding should be equivalent.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 1 exprs (1 unique), 1 names in 9.8023e-05s declaration order verified in 1.653e-06s environment built in 1.048e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00191218s wall (1.35907e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "other/nat-lit-add"
Expected: 👍 accept · Size: 25.7 KB · Lines: 473 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The kernel's Nat extension reduces Nat.add applied to two literals to a
literal, instead of unfolding the numerals to Nat.succ chains. The
arguments here are large enough that unfolding is not a practical
alternative, so a checker that only implements natLitEq-style
literal↔succ conversion will not get this for free.
Exported as natAddLit : Nat.add 123456789 987654321 = 1111111110 := rfl.
The application is Nat.add on .lits (not HAdd/OfNat).
Test result: 👍 accepted · exit code 0 · wall time: 24 ms · instructions: 10.5 M · max rss memory: 21.5 MB
stderr:
loaded 15 declarations, 360 exprs (360 unique), 89 names in 0.00119185s declaration order verified in 1.1621e-05s environment built in 2.3775e-05s; checking with 4 worker processes checked 15 declarations, 0 failed, in 0.00470443s wall (3.79337e-06 core-hours over 4 workers); 106 reduction steps; peak 20 MB in one worker
Test "other/nat-lit-add-bad"
Expected: ✋ reject · Size: 25.0 KB · Lines: 460 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The claimed result of Nat.add on two literals does not match the
kernel's literal arithmetic:
natAddLitBad : Nat.add 123456789 987654321 = 1111111111
:= Eq.refl (Nat.add 123456789 987654321)
The value is well-typed as @Eq Nat (Nat.add …) (Nat.add …) and is
injected with debug.skipKernelTC. A sound checker must reject the
declaration type mismatch against the claimed = 1111111111.
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 10.5 M · max rss memory: 21.5 MB
stderr:
loaded 14 declarations, 349 exprs (349 unique), 88 names in 0.000705974s
declaration order verified in 7.124e-06s
environment built in 2.0429e-05s; checking with 4 worker processes
FAIL natAddLitBad (line 460): declaration type mismatch for 'natAddLitBad'
inferred: (((Eq.{1} Nat) ((Nat.add (((OfNat.ofNat.{0} Nat) 123456789) (instOfNatNat 123456789))) (((OfNat.ofNat.{0} Nat) 987654321) (instOfNatNat 987654321)))) ((Nat.add (((OfNat.ofNat.{0} Nat) 123456789) (instOfNatNat 123456789))) (((OfNat.ofNat.{0} Nat) 987654321) (instOfNatNat 987654321))))
declared: (((Eq.{1} Nat) ((Nat.add (((OfNat.ofNat.{0} Nat) 123456789) (instOfNatNat 123456789))) (((OfNat.ofNat.{0} Nat) 987654321) (instOfNatNat 987654321)))) (((OfNat.ofNat.{0} Nat) 1111111111) (instOfNatNat 1111111111)))
checked 13 declarations, 1 failed, in 0.00382302s wall (3.15513e-06 core-hours over 4 workers); 62 reduction steps; peak 20 MB in one worker
Test "other/nat-lit-ble"
Expected: 👍 accept · Size: 28.5 KB · Lines: 515 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Nat.ble on two literals reduces to a Bool constructor:
Nat.ble 1000000 1000001 = true. Same Nat-literal extension as
nat-lit-add; the result is Bool rather than Nat.
Test result: 👍 accepted · exit code 0 · wall time: 21 ms · instructions: 10.8 M · max rss memory: 21.5 MB
stderr:
loaded 16 declarations, 391 exprs (391 unique), 99 names in 0.000750688s declaration order verified in 7.314e-06s environment built in 3.0868e-05s; checking with 4 worker processes checked 16 declarations, 0 failed, in 0.00456229s wall (3.58723e-06 core-hours over 4 workers); 105 reduction steps; peak 20 MB in one worker
Test "other/nat-lit-sub"
Expected: 👍 accept · Size: 29.7 KB · Lines: 556 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Nat.sub on two literals truncates at zero: Nat.sub 1000000 1000001 = 0.
Same Nat-literal extension as nat-lit-add; the numerals are large enough
that unfolding Nat.sub to a Nat.succ recursor is not a practical path.
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 11.0 M · max rss memory: 21.4 MB
stderr:
loaded 19 declarations, 390 exprs (390 unique), 138 names in 0.00086381s declaration order verified in 5.761e-06s environment built in 1.7513e-05s; checking with 4 worker processes checked 19 declarations, 0 failed, in 0.0037966s wall (3.29449e-06 core-hours over 4 workers); 129 reduction steps; peak 20 MB in one worker
Test "other/orphan-ctor"
Expected: ✋ reject · Size: 1.4 KB · Lines: 22 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration
Proof of False from a constructor of an inductive type that does not exist.
The export contains False exactly as the prelude has it — an empty
Prop-valued inductive with no constructors, its ctors field is the empty
list — together with its ordinary False.rec. Smuggled into the same
inductive block is a constructor named rogue, of type False, with no
parameters and no fields, whose induct field names Orphan, a name for
which the export has no declaration at all. The theorem inconsistent : False
is then simply rogue.
A checker must derive the constructors of an inductive group from the
inductive declarations and reject any exported constructor that is not one of
them; here that fails because False has no constructors, and the inductive
type rogue claims to come from does not exist. A checker that instead
registers exported constructors as given — or that only checks constructors
whose induct field points at a declaration it knows — ends up with an
inhabitant of the genuine empty type.
This is the constructor-side counterpart of bugs/orphan-rec: in both cases the
bogus declaration escapes by not being attached to any inductive declaration
that the checker verifies, rather than by disagreeing with one.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 10 exprs (10 unique), 8 names in 0.000123472s declaration order verified in 3.928e-06s environment built in 1.4467e-05s; checking with 4 worker processes FAIL False (line 19): constructor count mismatch in inductive block checked 0 declarations, 1 failed, in 0.00248776s wall (1.38031e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "other/proj-of-prop"
Expected: ✋ reject · Size: 3.9 KB · Lines: 56 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A proof of False via a projection from a Prop-typed structure whose
constructor was applied to an ill-typed argument. The exported term is
badFalse : False := (Wrapper.mk True.intro).p
where Wrapper : Prop has a single field p : False, so Wrapper.mk
expects a proof of False but is given True.intro : True.
A sound checker must reject this. A checker that types a projection by
inferring (rather than checking) its structure argument — i.e. that
trusts the structure to be well-typed instead of verifying the
constructor's argument types against its binders — will accept it,
because Wrapper.mk True.intro still formally inhabits Wrapper at
the structural level, and the p projection is then read back out at
the declared field type False.
Test result: ✋ rejected · exit code 1 · wall time: 20 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 35 exprs (35 unique), 15 names in 0.000504477s declaration order verified in 3.377e-06s environment built in 2.6209e-05s; checking with 4 worker processes FAIL badFalse (line 56): application type mismatch in (Wrapper.mk True.intro) argument type: True expected: False checked 3 declarations, 1 failed, in 0.00258086s wall (1.65499e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "other/sparse-name-index"
Expected: 👍 accept · Size: 292 B · Lines: 4 · lean4export: 0.1.0 · Lean: 4.29.1 · 📄 Declaration
Lean4export will create internalization-table references contiguously in
order: in references for names, il references for levels, and ie
references for expressions all work this way.
However, the spec merely requires that these are integers. It's reasonable for an implementation to assume these are approximately dense (and to treat them as array indices instead of hashtable entries), but a kernel should handle skipped indices or out-of-order indices.
This test checks that a kernel doesn't require internalization-table
references to be assigned sequentially starting from 1. If the "2" and "4"
were replaced by "1" and "0", respectively, this would be the expected
encoding of axiom foo : Prop. This encoding should be equivalent.
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 1 exprs (1 unique), 1 names in 9.6731e-05s declaration order verified in 1.533e-06s environment built in 1.053e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00185934s wall (1.17858e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "perf/app-lam"
Expected: 👍 accept · Size: 1.2 MB · Lines: 28.6 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A synthetically generated term with n levels of alternating applications and lambdas, with DAG sharing.
At each level, a constant is applied to two identical lambda arguments. The export format records these as a single shared expression (DAG). Each lambda body grows with the nesting depth, referencing all enclosing binders.
This tests two aspects of checker performance:
Infer cache: Since both arguments at each level are the same expression, a checker without an infer cache re-infers the type of each shared subterm, doubling work at every level — O(2ⁿ) total.
Substitution cost: Even with a cache, type-inferring each lambda requires substituting into its body (size O(n)) at each of the n levels, giving O(n²) total. Whether this cost arises depends on the checker's binder representation.
Test result: 👍 accepted · exit code 0 · wall time: 1.2 s · instructions: 14.2 G · max rss memory: 77.6 MB
stderr:
loaded 21 declarations, 24427 exprs (24427 unique), 4109 names in 0.00557066s declaration order verified in 5.3921e-05s environment built in 2.5518e-05s; checking with 4 worker processes checked 21 declarations, 0 failed, in 1.17738s wall (0.000327766 core-hours over 4 workers); 72 reduction steps; peak 77 MB in one worker
Test "perf/args-before-unfold"
Expected: 👍 accept · Size: 44.5 KB · Lines: 1.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
count #n and count (N.add #(n-1) #1)
where #k is the numeral with k successors, and count #k evaluates to #k
in Θ(k²) reductions.
N.add #(n-1) #1 reduces to #n in n steps, so the two arguments agree for
Θ(n), and the applications agree with them without count ever being
unfolded. Evaluating both applications costs Θ(n²). The test asks whether
a checker tries the arguments of a shared head constant before unfolding it.
N=1000 in the Lean source. From Courant and Leroy, POPL 2026, §10.
Test result: 👍 accepted · exit code 0 · wall time: 27 ms · instructions: 34.0 M · max rss memory: 24.5 MB
stderr:
loaded 5 declarations, 1106 exprs (1106 unique), 43 names in 0.000866145s declaration order verified in 3.777e-06s environment built in 1.4428e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.0110104s wall (4.24282e-06 core-hours over 4 workers); 3006 reduction steps; peak 24 MB in one worker
Test "perf/beta-ladder"
Expected: 👍 accept · Size: 450.2 KB · Lines: 10.4 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check reduces
(fun x₁ => … (fun xₙ => x₁ + (x₂ + (… + (xₙ + 0)))) 0 …) 0
to 0, through n beta redexes over a body that reads every binder.
Reducing the ladder takes n beta steps whatever a checker does, so the test is what one step costs. Substituting into the body on entry to binder k copies the n − k redexes still below it, and those copies sum to Θ(n²). Carrying the substitution in an environment leaves the body untouched, for Θ(n).
N=2000 in the Lean source.
Test result: 👍 accepted · exit code 0 · wall time: 350 ms · instructions: 4.0 G · max rss memory: 46.6 MB
stderr:
loaded 11 declarations, 10281 exprs (10281 unique), 77 names in 0.00222404s declaration order verified in 1.7533e-05s environment built in 1.4077e-05s; checking with 4 worker processes checked 11 declarations, 0 failed, in 0.333401s wall (9.39905e-05 core-hours over 4 workers); 16057 reduction steps; peak 46 MB in one worker
Test "perf/church-numerals"
Expected: 👍 accept · Size: 9.6 KB · Lines: 227 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
cmul (cnum n) (cnum (n+1)) and cmul (cnum (n+1)) (cnum n)
where cnum k is the Church numeral fun X s z => s (s (... z)) and
cmul a b iterates b as many times as a counts.
Both sides have the normal form with n(n+1) applications of the bound s.
Unfolding cmul on the left leaves cnum n X (cnum (n+1) X s), where each of
the n occurrences of the bound function copies the redex cnum (n+1) X s, so
the normal form takes n(n+1) beta steps and shares nothing. No other delta
step is available, so the Θ(n²) measured is beta reduction under binders
and little else.
N=120 in the Lean source, giving a reduction depth of 14520. From the
conv_eval benchmark of András Kovács' smalltt.
Test result: 👍 accepted · exit code 0 · wall time: 30 ms · instructions: 103.0 M · max rss memory: 30.1 MB
stderr:
loaded 4 declarations, 197 exprs (197 unique), 21 names in 0.000270267s declaration order verified in 2.024e-06s environment built in 1.1412e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.0156412s wall (4.84011e-06 core-hours over 4 workers); 253 reduction steps; peak 30 MB in one worker
Test "perf/discarded-argument"
Expected: 👍 accept · Size: 15.9 KB · Lines: 367 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
dropArg (count #n) and dropArg (count #(n+1))
where count #k evaluates to the numeral #k in Θ(k²) reductions, and
dropArg maps every numeral to N.O.
Unfolding dropArg leaves N.O against N.O, for Θ(1). Comparing the
arguments first evaluates two numerals of different value, for Θ(n²), and
then throws that answer away. The test asks whether a checker unfolds a
constant before looking at an argument the constant never uses.
N=200 in the Lean source. From Courant and Leroy, POPL 2026, §10.
Test result: 👍 accepted · exit code 0 · wall time: 23 ms · instructions: 60.4 M · max rss memory: 24.6 MB
stderr:
loaded 6 declarations, 309 exprs (309 unique), 48 names in 0.000674295s declaration order verified in 2.154e-06s environment built in 1.0339e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.00941516s wall (3.39776e-06 core-hours over 4 workers); 14803 reduction steps; peak 24 MB in one worker
Test "perf/discarded-argument-match"
Expected: 👍 accept · Size: 28.6 KB · Lines: 596 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
discarded-argument.lean with count and N.add written by structural
recursion, so the declaration to check is the same
dropArg (count #n) and dropArg (count #(n+1))
over definitions that unfold through brecOn rather than through N.rec.
brecOn reduces via the course-of-values table
N.below #k = m #(k-1) ×' (m #(k-2) ×' (… ×' PUnit)), a k-deep tuple holding
the result at every predecessor. The compiled count reads only x.1, so
the rest of the table is built and never read, and typing each projection
forces N.below to the depth of that projection.
N=200 in the Lean source, matching its pair.
Test result: 👍 accepted · exit code 0 · wall time: 38 ms · instructions: 196.1 M · max rss memory: 25.0 MB
stderr:
loaded 15 declarations, 490 exprs (490 unique), 83 names in 0.000310783s declaration order verified in 4.418e-06s environment built in 1.5429e-05s; checking with 4 worker processes checked 15 declarations, 0 failed, in 0.0232683s wall (7.96959e-06 core-hours over 4 workers); 46978 reduction steps; peak 24 MB in one worker
Test "perf/folded-constant-first"
Expected: 👍 accept · Size: 52.0 KB · Lines: 1.3 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
tagged (count #n) and (false, count #n)
where tagged m = (isZero m, m), so unfolding the left side leaves the same
application count #n in both components, forced by isZero in one and
plain in the other.
The plain occurrences are identical, for Θ(1); the forced one evaluates
count #n once. The order matters for a checker that leaves a constant
unfolded once it reduces it: reducing the forced component first replaces
count #n by its value on one side, and the plain comparison then faces a
folded application against an evaluated one. Here the forcing component
comes first; folded-constant-last.lean swaps them, and the ratio between
the two files is what that costs.
N=1000 in the Lean source. From Courant and Leroy, POPL 2026, §10, where the two orders cost Rocq 3 × 10⁻⁵ s and 0.078 s.
Test result: 👍 accepted · exit code 0 · wall time: 24 ms · instructions: 30.2 M · max rss memory: 24.6 MB
stderr:
loaded 9 declarations, 1180 exprs (1180 unique), 65 names in 0.000691668s declaration order verified in 1.6832e-05s environment built in 2.4867e-05s; checking with 4 worker processes checked 9 declarations, 0 failed, in 0.00887257s wall (3.66656e-06 core-hours over 4 workers); 20033 reduction steps; peak 24 MB in one worker
Test "perf/folded-constant-last"
Expected: 👍 accept · Size: 51.0 KB · Lines: 1.3 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
tagged (count #n) and (count #n, false)
where tagged m = (m, isZero m): folded-constant-first.lean with the
components swapped, so the plain occurrences of count #n are compared
before anything forces the application.
N=1000 in the Lean source. From Courant and Leroy, POPL 2026, §10.
Test result: 👍 accepted · exit code 0 · wall time: 25 ms · instructions: 30.2 M · max rss memory: 26.7 MB
stderr:
loaded 9 declarations, 1180 exprs (1180 unique), 65 names in 0.000453231s declaration order verified in 4.919e-06s environment built in 1.592e-05s; checking with 4 worker processes checked 9 declarations, 0 failed, in 0.0102838s wall (4.03482e-06 core-hours over 4 workers); 20033 reduction steps; peak 26 MB in one worker
Test "perf/fueled-chain"
Expected: 👍 accept · Size: 476.7 KB · Lines: 9.3 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Distilled from con-leche's fuel-bridge (_datF) lemmas, the declarations on
which nanobruijn times out on the con-leche test.
Fueled α packages a fuel-indexed family p : Nat → Except Unit α with a
proof whose type mentions p twice under binders. A _datF lemma states that
running a monadic function in Fueled and extracting at fuel F equals
running it in Except Unit, proved by unfolding and rewriting with the atF
lemmas for bind/pure/throw/ite. What is left for the kernel is a
definitional equality between two monadic programs that differ only in the
monad instance, under one binder per bind and a do-notation join point
per unless … throw guard.
chainN (N = 6, 9, 12) has N binds, each followed by a guard. A checker
that recognises the unfolded and the literal program as equal outright is
fast (nanoda: 2 ms, 18 ms, 32 ms); one that compares them structurally
unfolds bind to Subtype.mk p h and, through proof irrelevance on the
hs, re-compares the rest of the program twice per guard
(nanobruijn: 19 ms, 4.1 s, 256 s). Without the guards it is cheap for both.
Test result: 👍 accepted · exit code 0 · wall time: 65 ms · instructions: 666.5 M · max rss memory: 26.0 MB
stderr:
loaded 137 declarations, 8205 exprs (8205 unique), 918 names in 0.0015672s declaration order verified in 2.0669e-05s environment built in 5.8009e-05s; checking with 4 worker processes checked 137 declarations, 0 failed, in 0.0478614s wall (2.93934e-05 core-hours over 4 workers); 14869 reduction steps; peak 25 MB in one worker
Test "perf/grind-ring-5"
Expected: 👍 accept · Size: 9.7 MB · Lines: 199.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A grind tactic test from the Lean 4 test suite.
This produces a theorem with a rather large proof term that needs fast reduction.
Test result: 👍 accepted · exit code 0 · wall time: 491 ms · instructions: 4.9 G · max rss memory: 86.0 MB
stderr:
loaded 2185 declarations, 180991 exprs (180991 unique), 15962 names in 0.0283303s declaration order verified in 0.000648246s environment built in 0.000499597s; checking with 4 worker processes checked 2185 declarations, 0 failed, in 0.445195s wall (0.000220865 core-hours over 4 workers); 2383683 reduction steps; peak 86 MB in one worker
Test "perf/identical-nesting"
Expected: 👍 accept · Size: 8.7 KB · Lines: 172 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
f4 (f4 (... (f4 N.O) ...)) and f4 (f4 (... (f4 N.O) ...))
n applications of f4 on each side, the same term twice, where f0 is the
identity on N and each of f1, f2, f3, f4 applies its predecessor
twice, so the nesting expands into 16n applications of f0.
The test asks whether a checker compares the two sides before it starts unfolding, which answers in Θ(n). Unfolding one side at a time offers 16n applications to choose from per side, and the reachable pairs of partially unfolded sides grow exponentially in n.
N=30 in the Lean source. From Courant and Leroy, POPL 2026, §10.
Test result: 👍 accepted · exit code 0 · wall time: 21 ms · instructions: 8.2 M · max rss memory: 21.4 MB
stderr:
loaded 8 declarations, 128 exprs (128 unique), 32 names in 0.000360156s declaration order verified in 2.194e-06s environment built in 2.119e-05s; checking with 4 worker processes checked 8 declarations, 0 failed, in 0.00281857s wall (2.09463e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "perf/irrelevance-before-evaluation"
Expected: 👍 accept · Size: 17.5 KB · Lines: 389 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check is
slowTriv (count #n) = True.intro
proved by Eq.refl, where slowTriv m : True recurses over m, so forcing
it to a constructor evaluates the numeral in Θ(n²) reductions.
Checking compares the two proofs as arguments of Eq, whose head is rigid:
nothing can be unfolded instead. Proof irrelevance settles the proofs by
their type for Θ(1); evaluating the left one to a constructor costs
Θ(n²) and yields the answer irrelevance already gave. The test asks
whether a checker consults proof irrelevance before it reduces.
N=200 in the Lean source.
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 8.6 M · max rss memory: 21.3 MB
stderr:
loaded 7 declarations, 325 exprs (325 unique), 53 names in 0.000953829s declaration order verified in 4.298e-06s environment built in 2.3204e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00341334s wall (2.79532e-06 core-hours over 4 workers); 8 reduction steps; peak 18 MB in one worker
Test "perf/let-ladder"
Expected: 👍 accept · Size: 457.3 KB · Lines: 10.4 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check has type Nat and value
let x₃ := 0; x₃ + (let x₂ := 0; x₂ + (let x₁ := 0; x₁ + (x₃ + (x₂ + (x₁ + 0)))))
shown at n=3: n let bindings, each separated from the next by an addition,
over an innermost sum that names every binding.
Substituting a binding into the body before checking it traverses O(n) nodes at each of the n bindings, for Θ(n²) in time and in allocated nodes. Recording the binding and reading it where the body names it costs O(1) per binding, for Θ(n).
The additions are what keep the bindings apart: a run of adjacent lets could
be opened by a single substitution; not so here.
Nat.add is the only application head, so no beta reduction is involved.
N=2000 in the Lean source.
Test result: 👍 accepted · exit code 0 · wall time: 185 ms · instructions: 2.2 G · max rss memory: 36.5 MB
stderr:
loaded 13 declarations, 10292 exprs (10292 unique), 84 names in 0.00453854s declaration order verified in 1.9507e-05s environment built in 2.0839e-05s; checking with 4 worker processes checked 13 declarations, 0 failed, in 0.164129s wall (4.7394e-05 core-hours over 4 workers); 2062 reduction steps; peak 36 MB in one worker
Test "perf/magma-list-deep-n21"
Expected: 👍 accept · Size: 1.1 MB · Lines: 21.6 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Countermodel certificate for an equational-theories implication, closed by
decide. A magma on Fin 21 with an inline List operation table satisfies
x = (x ◇ x) ◇ (x ◇ (y ◇ y)) but not x = x ◇ (x ◇ x). The search space is
only 21^2 tuples, but each equation nests the operation several deep, so
every tuple expands into a chain of linear list lookups.
From a corpus of certificates generated for the SAIR math distillation
challenge (equational theories track). The small end of the deep-nesting
family; magma-list-deep-n36 is the same workload at a larger scale.
Test result: 👍 accepted · exit code 0 · wall time: 193 ms · instructions: 2.3 G · max rss memory: 29.3 MB
stderr:
loaded 479 declarations, 17728 exprs (17728 unique), 3395 names in 0.00374852s declaration order verified in 0.000121277s environment built in 0.000118101s; checking with 4 worker processes checked 479 declarations, 0 failed, in 0.173509s wall (5.98e-05 core-hours over 4 workers); 2804197 reduction steps; peak 29 MB in one worker
Test "perf/magma-list-deep-n36"
Expected: 👍 accept · Size: 1.2 MB · Lines: 22.8 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Countermodel certificate for an equational-theories implication, closed by
decide. A magma on Fin 36 with an inline List operation table satisfies
x = y ◇ (y ◇ (x ◇ (y ◇ x))) but not x = x ◇ (x ◇ x). The search space is
only 36^2 tuples, but each side of the equation nests the operation five
deep, so every tuple expands into a long chain of linear list lookups. The
heaviest test of the magma family.
From a corpus of certificates generated for the SAIR math distillation
challenge (equational theories track). magma-list-deep-n21 is the same
workload at a smaller scale.
Test result: 👍 accepted · exit code 0 · wall time: 1.9 s · instructions: 31.2 G · max rss memory: 45.9 MB
stderr:
loaded 479 declarations, 18849 exprs (18849 unique), 3467 names in 0.0067358s declaration order verified in 0.000116749s environment built in 0.000144471s; checking with 4 worker processes checked 479 declarations, 0 failed, in 1.87851s wall (0.000535513 core-hours over 4 workers); 47639472 reduction steps; peak 45 MB in one worker
Test "perf/magma-list-pair-n21"
Expected: 👍 accept · Size: 581.8 KB · Lines: 11.0 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Countermodel certificate for an equational-theories implication, closed by
decide. A magma on Fin 21 with an inline List operation table satisfies
x ◇ y = z ◇ w but not x = x ◇ x. Checking the certificate evaluates the
decidable instance over all 21^4 ≈ 195k four-tuples; every ◇ unfolds to a
linear lookup into the list. The widest search space of the magma family.
From a corpus of certificates generated for the SAIR math distillation
challenge (equational theories track). magma-list-pair-n7 is the same
workload at a smaller scale.
Test result: 👍 accepted · exit code 0 · wall time: 7.7 s · instructions: 36.0 G · max rss memory: 1.3 GB
stderr:
loaded 263 declarations, 8858 exprs (8858 unique), 1887 names in 0.00336951s declaration order verified in 2.631e-05s environment built in 9.8955e-05s; checking with 4 worker processes checked 263 declarations, 0 failed, in 7.66069s wall (0.00210662 core-hours over 4 workers); 33691152 reduction steps; peak 1364 MB in one worker
Test "perf/magma-list-pair-n7"
Expected: 👍 accept · Size: 582.4 KB · Lines: 11.0 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Countermodel certificate for an equational-theories implication, closed by
decide. A magma on Fin 7 with an inline List operation table satisfies
x ◇ y = z ◇ (w ◇ u) but not x = x ◇ x. Checking the certificate evaluates
the decidable instance over all 7^5 ≈ 17k five-tuples; every ◇ unfolds to
a linear lookup into the list.
From a corpus of certificates generated for the SAIR math distillation
challenge (equational theories track). The small end of the list-table
family; magma-list-pair-n21 is the same workload at a larger scale.
Test result: 👍 accepted · exit code 0 · wall time: 492 ms · instructions: 3.1 G · max rss memory: 128.4 MB
stderr:
loaded 263 declarations, 8868 exprs (8868 unique), 1887 names in 0.00268459s declaration order verified in 3.1499e-05s environment built in 7.7695e-05s; checking with 4 worker processes checked 263 declarations, 0 failed, in 0.474075s wall (0.000139177 core-hours over 4 workers); 2520320 reduction steps; peak 128 MB in one worker
Test "perf/magma-string-n4"
Expected: 👍 accept · Size: 16.4 MB · Lines: 342.4 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Countermodel certificate for an equational-theories implication, closed by
decide. A magma on Fin 4 with the operation table encoded as a String
satisfies x ◇ x = y ◇ ((x ◇ (y ◇ z)) ◇ z) but not
x ◇ x = x ◇ (((y ◇ x) ◇ y) ◇ z). The smallest magma of the family (4^3
tuples); the cost is dominated by decoding each table entry out of the
string on every lookup.
From a corpus of certificates generated for the SAIR math distillation
challenge (equational theories track). The small end of the string-table
family; magma-string-pair-n9 is the same workload at a larger scale.
Test result: 👍 accepted · exit code 0 · wall time: 557 ms · instructions: 11.4 G · max rss memory: 53.2 MB
stderr:
loaded 3173 declarations, 319701 exprs (319701 unique), 19463 names in 0.0371949s declaration order verified in 0.00113265s environment built in 0.000495249s; checking with 4 worker processes checked 3173 declarations, 0 failed, in 0.505196s wall (0.000533056 core-hours over 4 workers); 3333772 reduction steps; peak 52 MB in one worker
Test "perf/magma-string-pair-n9"
Expected: 👍 accept · Size: 16.5 MB · Lines: 342.4 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Countermodel certificate for an equational-theories implication, closed by
decide. A magma on Fin 9 with the operation table encoded as a String
satisfies x ◇ y = (((z ◇ w) ◇ y) ◇ x) ◇ y but not
x ◇ y = ((z ◇ (z ◇ y)) ◇ x) ◇ y. Checking the certificate evaluates the
decidable instance over all 9^4 ≈ 6.5k four-tuples, decoding each table
entry out of the string on every lookup. The heaviest of the string-table
tests.
From a corpus of certificates generated for the SAIR math distillation
challenge (equational theories track). magma-string-n4 is the same
workload at a smaller scale.
Test result: 👍 accepted · exit code 0 · wall time: 1.6 s · instructions: 20.9 G · max rss memory: 157.6 MB
stderr:
loaded 3173 declarations, 319722 exprs (319722 unique), 19463 names in 0.0480809s declaration order verified in 0.00130701s environment built in 0.000582413s; checking with 4 worker processes checked 3173 declarations, 0 failed, in 1.56357s wall (0.000826958 core-hours over 4 workers); 14207475 reduction steps; peak 157 MB in one worker
Test "perf/refute-cheap-first"
Expected: ✋ reject · Size: 20.7 KB · Lines: 439 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check claims
(false, count #n) = (true, count #(n+1))
and must be rejected. Both sides are constructor applications, so comparing
components is the only route, and either component refutes on its own:
false against true for Θ(1), the numerals for Θ(n²) (count #k
evaluates to #k in Θ(k²) reductions). The test asks in which order a
checker visits the components. refute-cheap-last.lean swaps them, and the
ratio between the two files is what that order costs.
N=200 in the Lean source. From Courant and Leroy, POPL 2026, §10, where the two orders cost Rocq 4 × 10⁻⁶ s and 0.61 s.
Test result: ✋ rejected · exit code 1 · wall time: 27 ms · instructions: 61.9 M · max rss memory: 25.2 MB
stderr:
loaded 7 declarations, 367 exprs (367 unique), 57 names in 0.000752171s
declaration order verified in 3.947e-06s
environment built in 2.0528e-05s; checking with 4 worker processes
FAIL kernel_refute_cheap_first (line 439): declaration type mismatch for 'kernel_refute_cheap_first'
inferred: (((Eq.{1} ((Prod.{0, 0} Bool) N)) ((((Prod.mk.{0, 0} Bool) N) Bool.false) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ((((Prod.mk.{0, 0} Bool) N) Bool.false) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
declared: (((Eq.{1} ((Prod.{0, 0} Bool) N)) ((((Prod.mk.{0, 0} Bool) N) Bool.false) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) ((((Prod.mk.{0, 0} Bool) N) Bool.true) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
checked 6 declarations, 1 failed, in 0.0117944s wall (4.46544e-06 core-hours over 4 workers); 6 reduction steps; peak 25 MB in one worker
Test "perf/refute-cheap-last"
Expected: ✋ reject · Size: 20.5 KB · Lines: 439 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check claims
(count #n, false) = (count #(n+1), true)
and must be rejected: refute-cheap-first.lean with the components swapped,
so the cheap refutation sits behind the expensive one for a checker that
visits components left to right.
N=200 in the Lean source. From Courant and Leroy, POPL 2026, §10.
Test result: ✋ rejected · exit code 1 · wall time: 26 ms · instructions: 62.2 M · max rss memory: 23.2 MB
stderr:
loaded 7 declarations, 367 exprs (367 unique), 57 names in 0.000311555s
declaration order verified in 2.726e-06s
environment built in 1.9487e-05s; checking with 4 worker processes
FAIL kernel_refute_cheap_last (line 439): declaration type mismatch for 'kernel_refute_cheap_last'
inferred: (((Eq.{1} ((Prod.{0, 0} N) Bool)) ((((Prod.mk.{0, 0} N) Bool) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) Bool.false)) ((((Prod.mk.{0, 0} N) Bool) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) Bool.false))
declared: (((Eq.{1} ((Prod.{0, 0} N) Bool)) ((((Prod.mk.{0, 0} N) Bool) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) Bool.false)) ((((Prod.mk.{0, 0} N) Bool) (count (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S (N.S N.O))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))) Bool.true))
checked 6 declarations, 1 failed, in 0.0109908s wall (4.06379e-06 core-hours over 4 workers); 6 reduction steps; peak 23 MB in one worker
Test "perf/repeated-subproblem"
Expected: 👍 accept · Size: 11.4 KB · Lines: 214 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
perfect #n leaf and perfect #(n-1) (node leaf leaf)
where perfect #k t builds the perfect binary tree of depth k with leaves
t, in k steps that each duplicate the tree so far into both arguments of
Tr.node.
Both sides reduce to the perfect tree of depth n. Descending them meets
Tr.node u u against Tr.node v v at every level, where both argument
positions pose the same subproblem, so the recursion reaches 2^n pairs of
nodes of which n are distinct. The test asks whether a checker records the
pairs it has proved convertible: Θ(n) if it does, Θ(2ⁿ) if not.
N=20 in the Lean source, stepped up by one rather than doubled. From Courant and Leroy, POPL 2026, §10.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 9.3 M · max rss memory: 21.4 MB
stderr:
loaded 5 declarations, 162 exprs (162 unique), 43 names in 0.000557526s declaration order verified in 2.264e-06s environment built in 2.142e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.00383981s wall (2.42894e-06 core-hours over 4 workers); 132 reduction steps; peak 19 MB in one worker
Test "perf/shared-subterm"
Expected: 👍 accept · Size: 50.1 KB · Lines: 1.3 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
ldepth (perfect #n leaf) and ldepth2 (perfect #n leaf)
where perfect #n leaf builds the perfect binary tree of depth n in n steps
that each duplicate the tree so far, and ldepth and ldepth2 both return
the length of the leftmost path.
The head constants differ, so both sides are evaluated, and neither traversal
looks beyond the leftmost path: ldepth walks n nodes for Θ(n), ldepth2
folds n additions over growing numerals for Θ(n²). The test asks whether a
checker consumes the tree through its representation, for Θ(n²), or
expands it into the 2ⁿ nodes of its normal form.
N=1000 in the Lean source. From Courant and Leroy, POPL 2026, §10.
Test result: 👍 accepted · exit code 0 · wall time: 35 ms · instructions: 112.6 M · max rss memory: 27.8 MB
stderr:
loaded 8 declarations, 1175 exprs (1175 unique), 65 names in 0.000795903s declaration order verified in 4.899e-06s environment built in 1.5159e-05s; checking with 4 worker processes checked 8 declarations, 0 failed, in 0.0194502s wall (6.1452e-06 core-hours over 4 workers); 50009 reduction steps; peak 27 MB in one worker
Test "perf/shift-cascade"
Expected: 👍 accept · Size: 256.3 KB · Lines: 5.1 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Stress test for cascading substitution overhead in kernel let processing.
N nested let bindings inside a lambda, where each value references the
outer lambda parameter and the previous binding:
fun (a : Nat → Nat) => let f₁ := fun x => a x let f₂ := fun x => a (f₁ x) ... let fₙ := fun x => a (fₙ₋₁ x) fₙ 0
The kernel processes each let by substituting the value into the body.
Each value has a free bvar (references a), so substitution under inner
binders creates shifted copies. In a de Bruijn kernel with deferred shifts,
these Shift(val, offset) wrappers accumulate: step k must traverse
through O(k) wrappers from previous steps, giving O(N²) total work.
A locally-nameless kernel substitutes fvars that need no shifting, giving O(N) total.
N=1000 in the Lean source. Increase to stress further.
Test result: 👍 accepted · exit code 0 · wall time: 73 ms · instructions: 529.7 M · max rss memory: 32.6 MB
stderr:
loaded 5 declarations, 4089 exprs (4089 unique), 1032 names in 0.00135441s declaration order verified in 7.524e-06s environment built in 1.2202e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.05552s wall (1.61716e-05 core-hours over 4 workers); 1000 reduction steps; peak 32 MB in one worker
Test "perf/unroll-versus-evaluate"
Expected: 👍 accept · Size: 44.6 KB · Lines: 1.2 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The declaration to check compares
count #(n+1) and N.add (count #n) #1
where #k is the numeral with k successors, and count #k evaluates to #k
in Θ(k²) reductions.
The head constants differ. Unrolling count once turns the left side into the
right side, leaving a traversal of the shared numeral #n, for Θ(n);
evaluating both sides costs Θ(n²). The test asks which of two differing
head constants a checker chooses to unfold.
N=1000 in the Lean source. From Courant and Leroy, POPL 2026, §2.
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 9.5 M · max rss memory: 21.3 MB
stderr:
loaded 5 declarations, 1107 exprs (1107 unique), 43 names in 0.000432151s declaration order verified in 2.986e-06s environment built in 1.5149e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.00233907s wall (1.71119e-06 core-hours over 4 workers); 17 reduction steps; peak 18 MB in one worker
Test "std"
Expected: 👍 accept · Size: 526.1 MB · Lines: 10.0 M · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The complete Std library export from Lean 4.
This test contains the standard library extensions beyond core Lean 4, including:
- Enhanced data structures (HashMap, RBTree, etc.)
- Additional mathematical operations
- Extended list and array operations
- Utility functions and theorems
This represents a medium-sized test case, larger than core modules but smaller than Mathlib, making it useful for performance testing.
Test result: 👍 accepted · exit code 0 · wall time: 18.2 s · instructions: 351.1 G · max rss memory: 670.4 MB
stderr:
loaded 90778 declarations, 9396483 exprs (9396483 unique), 535158 names in 1.52589s declaration order verified in 0.0636212s environment built in 0.0309619s; checking with 4 worker processes checked 90778 declarations, 0 failed, in 16.6258s wall (0.0184496 core-hours over 4 workers); 69377453 reduction steps; peak 670 MB in one worker
Test "tutorial/001_basicDef"
Expected: 👍 accept · Size: 367 B · Lines: 6 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Basic definition
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 1 names in 0.000249759s declaration order verified in 1.994e-06s environment built in 1.1732e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00214464s wall (1.48017e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/002_badDef"
Expected: ✋ reject · Size: 365 B · Lines: 6 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Mismatched types
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 1 names in 9.3916e-05s declaration order verified in 1.823e-06s environment built in 1.3946e-05s; checking with 4 worker processes FAIL badDef (line 6): declaration type mismatch for 'badDef' inferred: Sort(2) declared: Sort(0) checked 0 declarations, 1 failed, in 0.00188177s wall (1.30937e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/003_arrowType"
Expected: 👍 accept · Size: 622 B · Lines: 12 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Arrow type (function type)
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 3 exprs (3 unique), 6 names in 0.00012787s declaration order verified in 2.154e-06s environment built in 1.3486e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00183071s wall (1.2949e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/004_dependentType"
Expected: 👍 accept · Size: 460 B · Lines: 7 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Dependent type (forall)
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 3 exprs (3 unique), 2 names in 0.00010671s declaration order verified in 1.743e-06s environment built in 1.1151e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00245381s wall (1.55449e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/005_constType"
Expected: 👍 accept · Size: 897 B · Lines: 17 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Lambda expression
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 6 exprs (6 unique), 8 names in 0.000111509s declaration order verified in 1.613e-06s environment built in 1.6661e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00262545s wall (1.49512e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/006_betaReduction"
Expected: 👍 accept · Size: 1.3 KB · Lines: 27 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Lambda reduction
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 13 exprs (13 unique), 10 names in 0.000114846s declaration order verified in 4.639e-06s environment built in 1.4898e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00348624s wall (1.69192e-06 core-hours over 4 workers); 1 reduction steps; peak 17 MB in one worker
Test "tutorial/007_betaReduction2"
Expected: 👍 accept · Size: 1.4 KB · Lines: 28 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Lambda reduction under binder
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.5 M · max rss memory: 21.1 MB
stderr:
loaded 2 declarations, 14 exprs (14 unique), 10 names in 0.000114805s declaration order verified in 5.189e-06s environment built in 1.3786e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00252167s wall (1.68069e-06 core-hours over 4 workers); 1 reduction steps; peak 18 MB in one worker
Test "tutorial/008_forallSortWhnf"
Expected: 👍 accept · Size: 1.2 KB · Lines: 25 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The binding domain of a forall may need to be reduce before it is a sort
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 13 exprs (13 unique), 6 names in 0.000115246s declaration order verified in 3.126e-06s environment built in 2.146e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00212375s wall (1.45197e-06 core-hours over 4 workers); 8 reduction steps; peak 18 MB in one worker
Test "tutorial/009_forallSortBad"
Expected: ✋ reject · Size: 1.2 KB · Lines: 26 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The binding domain of a forall has to be a sort
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.5 M · max rss memory: 21.4 MB
stderr:
loaded 2 declarations, 14 exprs (14 unique), 6 names in 0.000121248s declaration order verified in 1.833e-06s environment built in 1.563e-05s; checking with 4 worker processes FAIL forallSortBad (line 26): type expected: $1 checked 1 declarations, 1 failed, in 0.00250111s wall (1.50722e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/010_nonTypeType"
Expected: ✋ reject · Size: 1.1 KB · Lines: 21 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The type of a declaration has to be a type, not some other expression
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 8 exprs (8 unique), 9 names in 0.000106459s declaration order verified in 1.723e-06s environment built in 1.1392e-05s; checking with 4 worker processes FAIL nonTypeType (line 21): type expected: constType checked 1 declarations, 1 failed, in 0.00262293s wall (1.55315e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/011_nonTypeAxiom"
Expected: ✋ reject · Size: 1.0 KB · Lines: 20 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
This applies to axioms as well, which are easy to overlook because they have no value to check the type against. Letting one through is not merely untidy: an axiom whose type is an arbitrary term inhabits whatever that term is later found definitionally equal to, and the eta and proof irrelevance rules are happy to equate a term like this with a great many things.
Test result: ✋ rejected · exit code 1 · wall time: 21 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 7 exprs (7 unique), 9 names in 0.000134472s declaration order verified in 2.254e-06s environment built in 1.4457e-05s; checking with 4 worker processes FAIL nonTypeAxiom (line 20): type expected: constType checked 1 declarations, 1 failed, in 0.00299153s wall (1.96548e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/012_nonPropThm"
Expected: ✋ reject · Size: 424 B · Lines: 7 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The type of a theorem has to be a proposition
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 3 exprs (3 unique), 2 names in 0.000124824s declaration order verified in 2.284e-06s environment built in 1.9737e-05s; checking with 4 worker processes FAIL nonPropThm (line 7): theorem type is not a proposition: nonPropThm checked 0 declarations, 1 failed, in 0.0024616s wall (1.39142e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/013_thmProof"
Expected: 👍 accept · Size: 1.3 KB · Lines: 26 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A theorem can refer to another theorem
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 14 exprs (14 unique), 9 names in 0.000115687s declaration order verified in 5.049e-06s environment built in 1.8084e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00256794s wall (1.45881e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/014_selfProof"
Expected: ✋ reject · Size: 459 B · Lines: 8 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A theorem cannot refer to itself
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.5 M · max rss memory: 21.1 MB
stderr:
loaded 1 declarations, 4 exprs (4 unique), 2 names in 0.00014922s declaration order verified in 1.613e-06s environment built in 1.3615e-05s; checking with 4 worker processes FAIL selfProof (line 8): unknown constant 'selfProof' checked 0 declarations, 1 failed, in 0.0021544s wall (1.56181e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/015_levelComp1"
Expected: 👍 accept · Size: 391 B · Lines: 7 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Some level computation
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 1 names in 7.3628e-05s declaration order verified in 1.603e-06s environment built in 1.1331e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00160983s wall (1.07369e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/016_levelComp2"
Expected: 👍 accept · Size: 409 B · Lines: 8 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Some level computation
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 1 names in 0.00010658s declaration order verified in 1.793e-06s environment built in 1.1521e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00191242s wall (1.37082e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/017_levelComp3"
Expected: 👍 accept · Size: 427 B · Lines: 9 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Some level computation
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.1 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 1 names in 0.000136767s declaration order verified in 1.803e-06s environment built in 1.075e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00195285s wall (1.32858e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/018_levelParams"
Expected: 👍 accept · Size: 1.4 KB · Lines: 29 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Level parameters
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 13 exprs (13 unique), 11 names in 0.00012814s declaration order verified in 5.21e-06s environment built in 1.3846e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00259969s wall (1.51729e-06 core-hours over 4 workers); 1 reduction steps; peak 18 MB in one worker
Test "tutorial/019_tut06_bad01"
Expected: ✋ reject · Size: 427 B · Lines: 8 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Duplicate universe parameters
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 2 names in 6.8038e-05s declaration order verified in 1.754e-06s environment built in 1.066e-05s; checking with 4 worker processes FAIL tut06_bad01 (line 8): duplicate universe level parameter 'u' checked 0 declarations, 1 failed, in 0.00167427s wall (9.78252e-07 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/020_levelComp4"
Expected: 👍 accept · Size: 424 B · Lines: 8 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Some level computation
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 2 names in 0.00012231s declaration order verified in 2.084e-06s environment built in 1.2534e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00196152s wall (1.37696e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/021_levelComp5"
Expected: 👍 accept · Size: 424 B · Lines: 8 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Some level computation
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 2 names in 0.000129313s declaration order verified in 1.623e-06s environment built in 1.6932e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00170422s wall (1.20583e-06 core-hours over 4 workers); 0 reduction steps; peak 17 MB in one worker
Test "tutorial/022_imax1"
Expected: 👍 accept · Size: 809 B · Lines: 16 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type inference for forall using imax
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 6 exprs (6 unique), 7 names in 0.000132719s declaration order verified in 7.774e-06s environment built in 1.9217e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00225728s wall (1.50839e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/023_imax2"
Expected: 👍 accept · Size: 828 B · Lines: 17 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type inference for forall using imax
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 6 exprs (6 unique), 7 names in 0.000112371s declaration order verified in 5.13e-06s environment built in 1.3055e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00228427s wall (1.63062e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/024_levelMaxComm"
Expected: 👍 accept · Size: 524 B · Lines: 12 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Level equality: max is commutative (max u v ≈ max v u).
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 3 names in 0.000129614s declaration order verified in 2.796e-06s environment built in 1.8214e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00178771s wall (1.15712e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/025_levelMaxAssoc"
Expected: 👍 accept · Size: 623 B · Lines: 16 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Level equality: max is associative (max (max u v) w ≈ max u (max v w)).
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 4 names in 0.000125616s declaration order verified in 1.883e-06s environment built in 1.4888e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00155017s wall (1.07496e-06 core-hours over 4 workers); 0 reduction steps; peak 17 MB in one worker
Test "tutorial/026_levelMaxIdem"
Expected: 👍 accept · Size: 447 B · Lines: 9 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Level equality: max is idempotent (max u u ≈ u).
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 2 names in 0.000124754s declaration order verified in 3.937e-06s environment built in 1.4227e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.0020433s wall (1.39674e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/027_levelMaxAbsorb"
Expected: 👍 accept · Size: 526 B · Lines: 12 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Level equality: max absorption (max u (max u v) ≈ max u v).
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.4 M · max rss memory: 21.4 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 3 names in 0.00010658s declaration order verified in 1.724e-06s environment built in 1.6511e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.0016747s wall (1.1697e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/028_inferVar"
Expected: 👍 accept · Size: 713 B · Lines: 12 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type inference of local variables
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 7 exprs (7 unique), 3 names in 0.000130345s declaration order verified in 1.773e-06s environment built in 1.3094e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.0019251s wall (1.40533e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/029_defEqLambda"
Expected: 👍 accept · Size: 1.4 KB · Lines: 26 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Definitional equality between lambdas
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 15 exprs (15 unique), 9 names in 0.000116869s declaration order verified in 3.947e-06s environment built in 1.1201e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00227038s wall (1.68653e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/030_peano1"
Expected: 👍 accept · Size: 3.6 KB · Lines: 73 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Peano arithmetic: 2 = 2
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.7 M · max rss memory: 21.3 MB
stderr:
loaded 7 declarations, 41 exprs (41 unique), 20 names in 0.000121138s declaration order verified in 3.637e-06s environment built in 1.056e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00187224s wall (1.40662e-06 core-hours over 4 workers); 5 reduction steps; peak 18 MB in one worker
Test "tutorial/031_peano2"
Expected: 👍 accept · Size: 4.5 KB · Lines: 90 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Peano arithmetic: 1 + 1 = 2
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.9 M · max rss memory: 21.4 MB
stderr:
loaded 8 declarations, 55 exprs (55 unique), 22 names in 0.000120817s declaration order verified in 3.446e-06s environment built in 1.5278e-05s; checking with 4 worker processes checked 8 declarations, 0 failed, in 0.0025116s wall (1.82324e-06 core-hours over 4 workers); 23 reduction steps; peak 18 MB in one worker
Test "tutorial/032_peano3"
Expected: 👍 accept · Size: 4.9 KB · Lines: 98 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Peano arithmetic: 2 * 2 = 4
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 8.1 M · max rss memory: 21.3 MB
stderr:
loaded 10 declarations, 59 exprs (59 unique), 24 names in 0.000137568s declaration order verified in 3.576e-06s environment built in 1.4628e-05s; checking with 4 worker processes checked 10 declarations, 0 failed, in 0.00211213s wall (1.37982e-06 core-hours over 4 workers); 37 reduction steps; peak 18 MB in one worker
Test "tutorial/033_letType"
Expected: 👍 accept · Size: 489 B · Lines: 9 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type checking a non-dependent let
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.4 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 4 exprs (4 unique), 2 names in 0.000107712s declaration order verified in 1.964e-06s environment built in 1.3295e-05s; checking with 4 worker processes checked 1 declarations, 0 failed, in 0.00203959s wall (1.41041e-06 core-hours over 4 workers); 1 reduction steps; peak 18 MB in one worker
Test "tutorial/034_letTypeDep"
Expected: 👍 accept · Size: 1.2 KB · Lines: 26 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type checking a dependent let
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 11 exprs (11 unique), 10 names in 0.000115607s declaration order verified in 2.034e-06s environment built in 2.0018e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.002674s wall (1.53608e-06 core-hours over 4 workers); 1 reduction steps; peak 18 MB in one worker
Test "tutorial/035_letRed"
Expected: 👍 accept · Size: 627 B · Lines: 12 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reducing a let
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 5 exprs (5 unique), 3 names in 0.000108794s declaration order verified in 3.887e-06s environment built in 1.046e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.0027109s wall (1.85783e-06 core-hours over 4 workers); 4 reduction steps; peak 18 MB in one worker
Test "tutorial/036_empty"
Expected: 👍 accept · Size: 1.2 KB · Lines: 20 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A simple empty inductive type
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 9 exprs (9 unique), 6 names in 0.000133982s declaration order verified in 1.843e-06s environment built in 1.4658e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00273162s wall (1.61427e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/037_boolType"
Expected: 👍 accept · Size: 2.3 KB · Lines: 37 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A simple enumeration inductive type
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 22 exprs (22 unique), 10 names in 0.000146786s declaration order verified in 1.633e-06s environment built in 1.5068e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00208593s wall (1.48165e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/038_twoBool"
Expected: 👍 accept · Size: 4.2 KB · Lines: 65 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A simple product type
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 43 exprs (43 unique), 16 names in 0.000143849s declaration order verified in 4.108e-06s environment built in 1.4407e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00299171s wall (1.78487e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/039_andType"
Expected: 👍 accept · Size: 3.2 KB · Lines: 57 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A parametrized product type (no level parameters)
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 41 exprs (41 unique), 12 names in 0.000109005s declaration order verified in 4.448e-06s environment built in 1.0921e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00196105s wall (1.5313e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/040_prodType"
Expected: 👍 accept · Size: 3.8 KB · Lines: 76 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A parametrized product type (with level parameters)
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 47 exprs (47 unique), 19 names in 0.000141275s declaration order verified in 3.526e-06s environment built in 1.5108e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00211096s wall (1.58952e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/041_pprodType"
Expected: 👍 accept · Size: 3.8 KB · Lines: 75 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A parametrized product type (with more general level parameters)
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.8 M · max rss memory: 21.1 MB
stderr:
loaded 2 declarations, 47 exprs (47 unique), 19 names in 0.00012791s declaration order verified in 3.607e-06s environment built in 1.4387e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.0021246s wall (1.66887e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/042_pUnitType"
Expected: 👍 accept · Size: 1.8 KB · Lines: 31 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Level-polymorphic unit type
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 16 exprs (16 unique), 9 names in 0.000107171s declaration order verified in 4.629e-06s environment built in 1.3776e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00209154s wall (1.27768e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/043_eqType"
Expected: 👍 accept · Size: 3.2 KB · Lines: 62 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Equality, as an important indexed non-recursive data type
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 42 exprs (42 unique), 15 names in 0.000136826s declaration order verified in 3.516e-06s environment built in 2.2382e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00231167s wall (1.86474e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/044_natDef"
Expected: 👍 accept · Size: 3.3 KB · Lines: 61 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A recursive inductive data type
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.7 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 36 exprs (36 unique), 20 names in 0.000384712s declaration order verified in 3.407e-06s environment built in 1.6642e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00189765s wall (1.45264e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/045_rbTreeDef"
Expected: 👍 accept · Size: 15.7 KB · Lines: 296 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A recursive indexed data type
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 10.1 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 248 exprs (248 unique), 39 names in 0.000729709s declaration order verified in 2.885e-06s environment built in 2.1771e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00480069s wall (2.28138e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "tutorial/046_inductBadNonSort"
Expected: ✋ reject · Size: 1.2 KB · Lines: 20 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive type with a non-sort type
Test result: ✋ rejected · exit code 1 · wall time: 20 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 7 exprs (7 unique), 9 names in 0.000139051s declaration order verified in 9.749e-06s environment built in 1.4487e-05s; checking with 4 worker processes FAIL inductBadNonSort (line 20): type expected: constType checked 1 declarations, 1 failed, in 0.00285997s wall (1.89809e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/047_inductBadNonSort2"
Expected: ✋ reject · Size: 598 B · Lines: 8 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Another inductive type with a non-sort type
Test result: ✋ rejected · exit code 1 · wall time: 58 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 2 exprs (2 unique), 2 names in 0.000120195s declaration order verified in 2.134e-06s environment built in 1.6701e-05s; checking with 4 worker processes FAIL inductBadNonSort2 (line 8): type expected: aType checked 1 declarations, 1 failed, in 0.00198111s wall (1.36347e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/048_inductLevelParam"
Expected: ✋ reject · Size: 515 B · Lines: 7 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive with duplicate level params
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 1 exprs (1 unique), 2 names in 0.000160722s declaration order verified in 1.964e-06s environment built in 1.4627e-05s; checking with 4 worker processes FAIL inductLevelParam (line 7): duplicate universe level parameter 'u' checked 0 declarations, 1 failed, in 0.00206045s wall (1.50287e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/049_inductTooFewParams"
Expected: ✋ reject · Size: 548 B · Lines: 6 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive with too few parameters in the type
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 2 exprs (2 unique), 2 names in 0.000188364s declaration order verified in 3.927e-06s environment built in 2.5428e-05s; checking with 4 worker processes FAIL inductTooFewParams (line 6): invalid inductive datatype declaration, incorrect number of parameters checked 0 declarations, 1 failed, in 0.00291568s wall (2.10332e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/050_inductWrongCtorParams"
Expected: ✋ reject · Size: 1.2 KB · Lines: 16 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive with a constructor with wrong parameters
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 7 exprs (7 unique), 5 names in 0.000152607s declaration order verified in 2.896e-06s environment built in 1.2713e-05s; checking with 4 worker processes FAIL inductWrongCtorParams (line 16): arg #1 of 'inductWrongCtorParams.mk' does not match inductive datatype parameters checked 1 declarations, 1 failed, in 0.00180181s wall (1.31652e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/051_inductWrongCtorResParams"
Expected: ✋ reject · Size: 1.3 KB · Lines: 19 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive with a constructor with wrong parameters in result (they are swapped)
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 11 exprs (11 unique), 5 names in 0.000143729s declaration order verified in 1.773e-06s environment built in 1.1822e-05s; checking with 4 worker processes FAIL inductWrongCtorResParams (line 19): invalid return type for 'inductWrongCtorResParams.mk' checked 0 declarations, 1 failed, in 0.00175119s wall (1.27045e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/052_inductWrongCtorResLevel"
Expected: ✋ reject · Size: 1.4 KB · Lines: 23 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive with a constructor with wrong level parameters in result (they are swapped)
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 11 exprs (11 unique), 7 names in 0.000144371s declaration order verified in 1.773e-06s environment built in 1.6331e-05s; checking with 4 worker processes FAIL inductWrongCtorResLevel (line 23): invalid return type for 'inductWrongCtorResLevel.mk' checked 0 declarations, 1 failed, in 0.00252025s wall (1.91763e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/053_inductInIndex"
Expected: ✋ reject · Size: 1.1 KB · Lines: 14 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A constructor with an unexpected occurrence of the type in index position of a return type.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 6 exprs (6 unique), 5 names in 0.000132569s declaration order verified in 2.114e-06s environment built in 1.9757e-05s; checking with 4 worker processes FAIL inductInIndex (line 14): invalid return type for 'inductInIndex.mk' checked 1 declarations, 1 failed, in 0.00236647s wall (1.68978e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/054_indNeg"
Expected: ✋ reject · Size: 996 B · Lines: 12 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The classic example of an inductive with negative recursive occurrence
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 1 declarations, 5 exprs (5 unique), 4 names in 0.000103454s declaration order verified in 2.394e-06s environment built in 1.4818e-05s; checking with 4 worker processes FAIL indNeg (line 12): arg #1 of 'indNeg.mk' has a non positive occurrence of the datatypes being declared checked 0 declarations, 1 failed, in 0.00206227s wall (1.46085e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/055_reduceCtorParam.mk"
Expected: 👍 accept · Size: 4.1 KB · Lines: 80 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
When checking inductives, we expect the kernel to reduce the types of constructor arguments.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.9 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 54 exprs (54 unique), 18 names in 0.000153147s declaration order verified in 3.577e-06s environment built in 2.0849e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00178126s wall (1.3714e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/056_reduceCtorType.mk"
Expected: ✋ reject · Size: 1.5 KB · Lines: 26 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
When checking inductives, we expect the kernel to not reduce the type of the constructor itself;
that should be all manifest foralls
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 13 exprs (13 unique), 7 names in 0.000140404s declaration order verified in 2.665e-06s environment built in 1.7182e-05s; checking with 4 worker processes FAIL reduceCtorType (line 26): invalid return type for 'reduceCtorType.mk' checked 1 declarations, 1 failed, in 0.00209946s wall (1.58946e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/057_indNegReducible"
Expected: ✋ reject · Size: 1.9 KB · Lines: 31 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
When checking inductives, we expect the kernel to not reduce the type of the constructor parameters further than head normal form. Recursive occurrences nested inside the head normal form are considered negative occurrences, even if they could be reduced to disappear.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 14 exprs (14 unique), 12 names in 0.000145473s declaration order verified in 1.853e-06s environment built in 1.9887e-05s; checking with 4 worker processes FAIL indNegReducible (line 31): arg #1 of 'indNegReducible.mk' has a non positive occurrence of the datatypes being declared checked 2 declarations, 1 failed, in 0.00267378s wall (1.41581e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/058_predWithTypeField"
Expected: 👍 accept · Size: 2.0 KB · Lines: 32 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive proposition can have constructors with fields of arbitrary level.
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 20 exprs (20 unique), 8 names in 0.000144461s declaration order verified in 2.154e-06s environment built in 1.589e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00193507s wall (1.45413e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/059_typeWithTypeField"
Expected: 👍 accept · Size: 2.1 KB · Lines: 36 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive type can have fields of level up to that of the inductive.
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 21 exprs (21 unique), 9 names in 0.000125145s declaration order verified in 1.783e-06s environment built in 1.1332e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00205991s wall (1.50632e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/060_typeWithTypeFieldPoly"
Expected: 👍 accept · Size: 2.1 KB · Lines: 38 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive type can have fields of level up to that of the inductive (polymorphic variant).
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 21 exprs (21 unique), 10 names in 0.000149431s declaration order verified in 1.904e-06s environment built in 2.2562e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00241742s wall (1.46758e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/061_typeWithTooHighTypeField.mk"
Expected: ✋ reject · Size: 943 B · Lines: 11 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive type can have fields of from higher universes.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 4 exprs (4 unique), 4 names in 0.000188844s declaration order verified in 1.944e-06s environment built in 1.0911e-05s; checking with 4 worker processes FAIL typeWithTooHighTypeField (line 11): universe level of type_of(arg #1) of 'typeWithTooHighTypeField.mk' is too big for the corresponding inductive datatype checked 0 declarations, 1 failed, in 0.00160353s wall (1.12808e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/062_emptyRec"
Expected: 👍 accept · Size: 1.2 KB · Lines: 21 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 10 exprs (10 unique), 6 names in 0.000119614s declaration order verified in 2.235e-06s environment built in 1.8484e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.0022408s wall (1.62861e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/063_boolRec"
Expected: 👍 accept · Size: 3.0 KB · Lines: 53 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 32 exprs (32 unique), 16 names in 0.000140794s declaration order verified in 3.597e-06s environment built in 2.5548e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.0026353s wall (1.64527e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/064_twoBoolRec"
Expected: 👍 accept · Size: 4.8 KB · Lines: 78 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 50 exprs (50 unique), 22 names in 0.000130685s declaration order verified in 3.988e-06s environment built in 1.1752e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00189823s wall (1.43158e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/065_andRec"
Expected: 👍 accept · Size: 3.2 KB · Lines: 58 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.8 M · max rss memory: 21.4 MB
stderr:
loaded 2 declarations, 42 exprs (42 unique), 12 names in 0.000115927s declaration order verified in 3.567e-06s environment built in 2.0037e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00205643s wall (1.68928e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/066_prodRec"
Expected: 👍 accept · Size: 4.0 KB · Lines: 79 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 7.9 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 49 exprs (49 unique), 20 names in 0.000146745s declaration order verified in 4.167e-06s environment built in 1.5669e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00247121s wall (1.72811e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/067_pprodRec"
Expected: 👍 accept · Size: 4.0 KB · Lines: 78 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.9 M · max rss memory: 21.4 MB
stderr:
loaded 2 declarations, 48 exprs (48 unique), 20 names in 0.000142998s declaration order verified in 4.738e-06s environment built in 1.584e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00212896s wall (1.31988e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/068_punitRec"
Expected: 👍 accept · Size: 2.2 KB · Lines: 39 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.6 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 18 exprs (18 unique), 15 names in 9.8575e-05s declaration order verified in 4.298e-06s environment built in 1.1552e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00210765s wall (1.11342e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/069_eqRec"
Expected: 👍 accept · Size: 3.3 KB · Lines: 63 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.8 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 43 exprs (43 unique), 15 names in 0.000108914s declaration order verified in 6.372e-06s environment built in 1.3996e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00161123s wall (1.22753e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/070_nRec"
Expected: 👍 accept · Size: 3.3 KB · Lines: 61 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.7 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 36 exprs (36 unique), 20 names in 0.000104687s declaration order verified in 3.256e-06s environment built in 1.6832e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00162448s wall (1.05619e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/071_rbTreeRef"
Expected: 👍 accept · Size: 16.2 KB · Lines: 303 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor
Test result: 👍 accepted · exit code 0 · wall time: 67 ms · instructions: 10.4 M · max rss memory: 21.1 MB
stderr:
loaded 4 declarations, 254 exprs (254 unique), 40 names in 0.000277591s declaration order verified in 2.575e-06s environment built in 1.3174e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00468243s wall (2.25602e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "tutorial/072_boolPropRec"
Expected: 👍 accept · Size: 2.3 KB · Lines: 34 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Inductive predicates eliminate into Prop if they have more than one constructor.
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 22 exprs (22 unique), 9 names in 8.9909e-05s declaration order verified in 4.408e-06s environment built in 1.3626e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00189164s wall (1.12815e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/073_BogusRecursor"
Expected: ✋ reject · Size: 1.8 KB · Lines: 27 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A kernel must not blindly trust the recursors it is handed. If we write
inductive BogusRecursor : Type where
| mk : BogusRecursor
then the recursor BogusRecursor.rec will be correctly derived with type
{motive : BogusRecursor → Sort u} → motive .mk → (t : BogusRecursor) → motive t.
This test instead claims that the recursor is a constant of type False, and
then uses it to prove bogusRecursorFalse : False. A kernel that validates
the recursors it is handed rejects the bogus recursor itself; a kernel that
ignores them and derives the recursors anew rejects the proof of False
(the derived recursor neither has type False nor zero universe parameters).
Either way, this test must be rejected.
Test result: ✋ rejected · exit code 1 · wall time: 15 ms · instructions: 7.7 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 12 exprs (12 unique), 9 names in 8.0992e-05s declaration order verified in 1.953e-06s environment built in 1.7744e-05s; checking with 4 worker processes FAIL BogusRecursor (line 24): recursor 'BogusRecursor.rec': parameter/index/motive/minor/K data differs from the derived recursor checked 1 declarations, 1 failed, in 0.00168776s wall (1.18727e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/074_existsRec"
Expected: 👍 accept · Size: 3.6 KB · Lines: 66 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Inductive predicates eliminate into Prop if they have one constructors and it carries data.
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 7.9 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 45 exprs (45 unique), 17 names in 8.8707e-05s declaration order verified in 3.858e-06s environment built in 1.1842e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00194439s wall (1.40022e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/075_typeSingletonRecReduction"
Expected: 👍 accept · Size: 7.9 KB · Lines: 138 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Because NewSingleton is a singleton, NewSingleton.rec true x reduces to
true even though x is a variable.
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 8.2 M · max rss memory: 21.2 MB
stderr:
loaded 5 declarations, 95 exprs (95 unique), 34 names in 0.000143189s declaration order verified in 2.014e-06s environment built in 1.587e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.00172106s wall (1.3727e-06 core-hours over 4 workers); 5 reduction steps; peak 18 MB in one worker
Test "tutorial/076_sortElimPropRec"
Expected: 👍 accept · Size: 5.6 KB · Lines: 97 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Inductive predicates eliminate into Sort if they have one constructors and it carries data, but the data is known from the type, e.g. a parameter or an index
Test result: 👍 accepted · exit code 0 · wall time: 15 ms · instructions: 8.1 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 69 exprs (69 unique), 22 names in 0.000101129s declaration order verified in 1.974e-06s environment built in 1.1312e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00192041s wall (1.37187e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/077_sortElimProp2Rec"
Expected: 👍 accept · Size: 6.6 KB · Lines: 114 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Inductive predicates eliminate into Sort if they have one constructors and it carries data, but the data is known from the type, e.g. a parameter or an index. However, it must occur directly in the result type, with no intervening reduction.
Test result: 👍 accepted · exit code 0 · wall time: 15 ms · instructions: 8.3 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 83 exprs (83 unique), 24 names in 0.00010139s declaration order verified in 1.893e-06s environment built in 1.3986e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00207215s wall (1.48113e-06 core-hours over 4 workers); 2 reduction steps; peak 19 MB in one worker
Test "tutorial/078_boolRecEqns"
Expected: 👍 accept · Size: 10.8 KB · Lines: 199 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reduction behavior of Bool.rec
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 8.6 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 133 exprs (133 unique), 58 names in 0.000284524s declaration order verified in 2.565e-06s environment built in 1.2263e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00272343s wall (1.84773e-06 core-hours over 4 workers); 16 reduction steps; peak 19 MB in one worker
Test "tutorial/079_prodRecEqns"
Expected: 👍 accept · Size: 10.1 KB · Lines: 205 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reduction behavior of Prod.rec
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 8.6 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 127 exprs (127 unique), 67 names in 0.000198101s declaration order verified in 2.325e-06s environment built in 1.1261e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.003248s wall (1.84572e-06 core-hours over 4 workers); 6 reduction steps; peak 19 MB in one worker
Test "tutorial/080_nRecReduction"
Expected: 👍 accept · Size: 12.7 KB · Lines: 238 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A proof relying on the reduction behavior of N.rec
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 8.9 M · max rss memory: 21.4 MB
stderr:
loaded 6 declarations, 170 exprs (170 unique), 58 names in 0.000262903s declaration order verified in 2.224e-06s environment built in 1.4016e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.00298094s wall (2.06227e-06 core-hours over 4 workers); 43 reduction steps; peak 19 MB in one worker
Test "tutorial/081_listRecReduction"
Expected: 👍 accept · Size: 17.5 KB · Lines: 335 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reduction behavior of List.rec
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 10.1 M · max rss memory: 21.3 MB
stderr:
loaded 7 declarations, 256 exprs (256 unique), 67 names in 0.000238828s declaration order verified in 2.324e-06s environment built in 1.4276e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00438007s wall (2.65008e-06 core-hours over 4 workers); 44 reduction steps; peak 20 MB in one worker
Test "tutorial/082_RBTree.id_spec"
Expected: 👍 accept · Size: 47.9 KB · Lines: 1.0 k · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reduction behavior of RBTree.rec
Test result: 👍 accepted · exit code 0 · wall time: 23 ms · instructions: 16.7 M · max rss memory: 21.9 MB
stderr:
loaded 7 declarations, 878 exprs (878 unique), 116 names in 0.000404949s declaration order verified in 7.845e-06s environment built in 1.6591e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00728475s wall (4.45176e-06 core-hours over 4 workers); 46 reduction steps; peak 21 MB in one worker
Test "tutorial/083_And.right"
Expected: 👍 accept · Size: 4.3 KB · Lines: 74 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type-checking simple projection functions
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 7.9 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 55 exprs (55 unique), 14 names in 0.000154881s declaration order verified in 1.1612e-05s environment built in 2.2081e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00325549s wall (2.20736e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/084_Prod.snd"
Expected: 👍 accept · Size: 4.5 KB · Lines: 83 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type-checking projection functions with parameters
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.9 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 57 exprs (57 unique), 16 names in 0.000128181s declaration order verified in 6.983e-06s environment built in 1.3545e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00240805s wall (1.54403e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/085_PProd.snd"
Expected: 👍 accept · Size: 4.5 KB · Lines: 83 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type-checking projection functions
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.9 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 57 exprs (57 unique), 16 names in 0.000144982s declaration order verified in 3.998e-06s environment built in 2.2072e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00194653s wall (1.52209e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/086_PSigma.snd"
Expected: 👍 accept · Size: 5.1 KB · Lines: 96 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type-checking dependent projection functions
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.1 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 65 exprs (65 unique), 21 names in 0.000112581s declaration order verified in 1.733e-06s environment built in 2.0278e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00239306s wall (1.56444e-06 core-hours over 4 workers); 1 reduction steps; peak 18 MB in one worker
Test "tutorial/087_projOutOfRange"
Expected: ✋ reject · Size: 3.8 KB · Lines: 67 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Out of range projection
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.9 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 48 exprs (48 unique), 15 names in 0.000110047s declaration order verified in 4.889e-06s environment built in 1.3996e-05s; checking with 4 worker processes FAIL projOutOfRange (line 67): invalid projection And.2 checked 1 declarations, 1 failed, in 0.00212775s wall (1.64603e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/088_projNotStruct"
Expected: ✋ reject · Size: 3.5 KB · Lines: 64 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projection out something that is not a structure
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.8 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 38 exprs (38 unique), 21 names in 0.000150022s declaration order verified in 4.629e-06s environment built in 2.2241e-05s; checking with 4 worker processes FAIL projNotStruct (line 64): invalid projection N.0 checked 1 declarations, 1 failed, in 0.00196182s wall (1.40637e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/089_projProp1"
Expected: 👍 accept · Size: 8.2 KB · Lines: 143 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out of a proposition
The lean kernel allows projections out of propositions if they precede all dependent data fields.
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 8.3 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 103 exprs (103 unique), 31 names in 0.000427523s declaration order verified in 3.125e-06s environment built in 1.6701e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00247654s wall (1.67691e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/090_projProp2"
Expected: ✋ reject · Size: 8.2 KB · Lines: 143 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out of a proposition
The lean kernel disallows data projections out of propositional structures.
Test result: ✋ rejected · exit code 1 · wall time: 20 ms · instructions: 8.4 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 103 exprs (103 unique), 31 names in 0.000247123s declaration order verified in 2.695e-06s environment built in 1.3545e-05s; checking with 4 worker processes FAIL projProp2 (line 143): invalid projection PropStructure.1 checked 3 declarations, 1 failed, in 0.00261292s wall (1.75459e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/091_projProp3"
Expected: 👍 accept · Size: 8.2 KB · Lines: 143 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out of a proposition
The lean kernel allows projections out of propositions if they precede all dependent data fields. Non-dependent data fields are not relevant.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 8.3 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 103 exprs (103 unique), 31 names in 0.000365806s declaration order verified in 2.555e-06s environment built in 3.716e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00257641s wall (1.71566e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/092_projProp4"
Expected: ✋ reject · Size: 8.2 KB · Lines: 143 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out of a proposition
The lean kernel disallows data projections out of propositional structures.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 8.4 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 103 exprs (103 unique), 31 names in 0.000224291s declaration order verified in 2.324e-06s environment built in 1.3956e-05s; checking with 4 worker processes FAIL projProp4 (line 143): invalid projection PropStructure.3 checked 3 declarations, 1 failed, in 0.00239263s wall (1.50927e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/093_projProp5"
Expected: ✋ reject · Size: 8.4 KB · Lines: 148 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out of a proposition
The lean kernel disallows proof projections out of propositional structures that depend on data.
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 8.4 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 108 exprs (108 unique), 31 names in 0.000393999s declaration order verified in 2.896e-06s environment built in 2.114e-05s; checking with 4 worker processes FAIL projProp5 (line 148): invalid projection PropStructure.3 checked 3 declarations, 1 failed, in 0.00259811s wall (1.92821e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/094_projProp6"
Expected: ✋ reject · Size: 8.2 KB · Lines: 143 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out of a proposition.
The lean kernel rejects any projections out of a proposition that come after a dependent data field, even if that is not used by the present projection.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 8.4 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 103 exprs (103 unique), 31 names in 0.000372679s declaration order verified in 3.256e-06s environment built in 1.8174e-05s; checking with 4 worker processes FAIL projProp6 (line 143): invalid projection PropStructure.5 checked 3 declarations, 1 failed, in 0.00273133s wall (1.83571e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/095_projDataIndexRec"
Expected: 👍 accept · Size: 6.8 KB · Lines: 111 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The recursor for ProjDataIndex allows elimination into sort.
Test result: 👍 accepted · exit code 0 · wall time: 30 ms · instructions: 8.1 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 72 exprs (72 unique), 31 names in 0.000101791s declaration order verified in 4.368e-06s environment built in 1.7954e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00194826s wall (1.10503e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/096_projIndexData"
Expected: ✋ reject · Size: 6.8 KB · Lines: 111 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out data is not allowed, even if this data appears as an index and the recursor would allow it.
Test result: ✋ rejected · exit code 1 · wall time: 28 ms · instructions: 8.1 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 72 exprs (72 unique), 32 names in 0.000146495s declaration order verified in 2.495e-06s environment built in 2.5919e-05s; checking with 4 worker processes FAIL projIndexData (line 111): invalid projection PropStructure.0 checked 3 declarations, 1 failed, in 0.00191556s wall (1.46699e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/097_projIndexData2"
Expected: ✋ reject · Size: 6.8 KB · Lines: 111 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projecting out data is not allowed, even if this data appears as an index and the recursor would allow it.
This also forbids projecting out proofs that follow such fields.
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 8.1 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 72 exprs (72 unique), 32 names in 0.000158898s declaration order verified in 3.987e-06s environment built in 2.2762e-05s; checking with 4 worker processes FAIL projIndexData2 (line 111): invalid projection PropStructure.1 checked 3 declarations, 1 failed, in 0.00236834s wall (1.53953e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/098_projRed"
Expected: 👍 accept · Size: 9.9 KB · Lines: 177 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Projection reductions
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 8.6 M · max rss memory: 21.2 MB
stderr:
loaded 6 declarations, 131 exprs (131 unique), 32 names in 0.000322104s declaration order verified in 4.529e-06s environment built in 1.7813e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.00282381s wall (2.06796e-06 core-hours over 4 workers); 2 reduction steps; peak 19 MB in one worker
Test "tutorial/099_ruleK"
Expected: 👍 accept · Size: 6.5 KB · Lines: 121 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Rule k for Eq:
The recursor reduces even if the major argument is not a constructor,
as long replacing the major argument with a constructor is type correct.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.1 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 83 exprs (83 unique), 31 names in 0.000125155s declaration order verified in 3.977e-06s environment built in 1.7684e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00249793s wall (1.65278e-06 core-hours over 4 workers); 4 reduction steps; peak 18 MB in one worker
Test "tutorial/100_ruleKbad"
Expected: ✋ reject · Size: 6.5 KB · Lines: 121 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Rule k for Eq should not fire if the types of the major argument
do not match that of the constructor.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 8.2 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 83 exprs (83 unique), 31 names in 0.000130495s
declaration order verified in 1.843e-06s
environment built in 1.1061e-05s; checking with 4 worker processes
FAIL ruleKbad (line 121): declaration type mismatch for 'ruleKbad'
inferred: ((x._@.Tutorial.3161876795._hygCtx._hyg.27 : (((Eq.{1} Bool) Bool.true) Bool.false)) -> ((a : Bool) -> (((Eq.{1} Bool) #0) #0)))
declared: ((h : (((Eq.{1} Bool) Bool.true) Bool.false)) -> ((a : Bool) -> (((Eq.{1} Bool) ((((((Eq.rec.{1, 1} Bool) Bool.true) (fun (x._@.Tutorial.3161876795._hygCtx._hyg.17 : Bool) => (fun (x._@.Tutorial.3161876795._hygCtx._hyg.19 : (((Eq.{1} Bool) Bool.true) #0)) => Bool))) #0) Bool.false) #1)) #0)))
checked 2 declarations, 1 failed, in 0.00269578s wall (1.63778e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "tutorial/101_ruleKAcc"
Expected: ✋ reject · Size: 12.8 KB · Lines: 238 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Rule k should not fire for Acc.
Test result: ✋ rejected · exit code 1 · wall time: 20 ms · instructions: 9.4 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 189 exprs (189 unique), 41 names in 0.00028248s
declaration order verified in 2.334e-06s
environment built in 1.7813e-05s; checking with 4 worker processes
FAIL ruleKAcc (line 238): declaration type mismatch for 'ruleKAcc'
inferred: ((α : Sort(u)) -> ((p : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((x : #1) -> ((h : (((Acc.{u} #2) #1) #0)) -> ((a : Bool) -> (((Eq.{1} Bool) #0) #0))))))
declared: ((α : Sort(u)) -> ((p : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((x : #1) -> ((h : (((Acc.{u} #2) #1) #0)) -> ((a : Bool) -> (((Eq.{1} Bool) ((((((Acc.rec.{1, u} #4) #3) (fun (x._@.Tutorial.4255978773._hygCtx._hyg.22 : #4) => (fun (x._@.Tutorial.4255978773._hygCtx._hyg.24 : (((Acc.{u} #5) #4) #0)) => Bool))) (fun (x._@.Tutorial.4255978773._hygCtx._hyg.31 : #4) => (fun (x._@.Tutorial.4255978773._hygCtx._hyg.33 : ((y : #5) -> ((a._@._internal._hyg.0 : ((#5 #0) #1)) -> (((Acc.{u} #7) #6) #1)))) => (fun (x._@.Tutorial.4255978773._hygCtx._hyg.35 : ((y : #6) -> ((a._@._internal._hyg.0 : ((#6 #0) #2)) -> (((fun (x._@.Tutorial.4255978773._hygCtx._hyg.22 : #8) => (fun (x._@.Tutorial.4255978773._hygCtx._hyg.24 : (((Acc.{u} #9) #8) #0)) => Bool)) #1) ((#2 #1) #0))))) => #3)))) #2) #1)) #0))))))
checked 3 declarations, 1 failed, in 0.00433879s wall (2.7528e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "tutorial/102_aNatLit"
Expected: 👍 accept · Size: 3.0 KB · Lines: 54 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Type checking Nat literals
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.7 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 37 exprs (37 unique), 12 names in 0.000161843s declaration order verified in 4.729e-06s environment built in 2.4777e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00285571s wall (2.43491e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/103_natLitEq"
Expected: 👍 accept · Size: 6.1 KB · Lines: 114 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reducing Nat literals
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 8.1 M · max rss memory: 21.5 MB
stderr:
loaded 3 declarations, 84 exprs (84 unique), 23 names in 0.000124955s declaration order verified in 2.124e-06s environment built in 1.9607e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00275189s wall (2.14927e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/104_proofIrrelevance"
Expected: 👍 accept · Size: 5.0 KB · Lines: 100 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof irrelevance: every Prop is a subsingleton, if p : Prop then all elements of p
are definitionally equal.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 7.9 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 66 exprs (66 unique), 28 names in 0.000108002s declaration order verified in 7.233e-06s environment built in 1.5609e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00238668s wall (1.57398e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/105_proofIrrelevanceBad"
Expected: ✋ reject · Size: 4.7 KB · Lines: 93 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof irrelevance is limited to Prop: if p : Type, then all elements of p are not
definitionally equal.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 8.0 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 67 exprs (67 unique), 19 names in 0.000125326s
declaration order verified in 2.705e-06s
environment built in 1.7633e-05s; checking with 4 worker processes
FAIL proofIrrelevanceBad (line 93): declaration type mismatch for 'proofIrrelevanceBad'
inferred: ((p : Sort(1)) -> ((h1 : #0) -> ((h2 : #1) -> (((Eq.{1} #2) #1) #1))))
declared: ((p : Sort(1)) -> ((h1 : #0) -> ((h2 : #1) -> (((Eq.{1} #2) #1) #0))))
checked 2 declarations, 1 failed, in 0.00250828s wall (1.62053e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/106_proofIrrelevanceWhnf"
Expected: 👍 accept · Size: 5.6 KB · Lines: 112 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof irrelevance: if p : A and A is definitionally equal to Prop, then all elements of p
are still definitionally equal. Just applying proof irrelevance at Sort 0 isn't sufficient.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.0 M · max rss memory: 21.2 MB
stderr:
loaded 4 declarations, 74 exprs (74 unique), 29 names in 0.000118022s declaration order verified in 2.224e-06s environment built in 1.1511e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00275351s wall (1.77149e-06 core-hours over 4 workers); 10 reduction steps; peak 18 MB in one worker
Test "tutorial/107_proofIrrelevanceUnderBinder"
Expected: 👍 accept · Size: 1.9 KB · Lines: 39 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Proof irrelevance applies to any two terms of a proposition, not just to variables.
Checking this definition needs aPropFamily (h anElem) ≡ aPropFamily (h anotherElem),
i.e. h anElem ≡ h anotherElem. Both are proofs of aProp, since h : aType → aProp,
so they are definitionally equal even though their arguments are not. A checker that
compares the two applications structurally, without first noticing that they are
proofs, wrongly rejects this.
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.2 MB
stderr:
loaded 7 declarations, 17 exprs (17 unique), 13 names in 0.000116348s declaration order verified in 1.904e-06s environment built in 1.7583e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00215183s wall (1.3293e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/108_unitEta1"
Expected: 👍 accept · Size: 6.2 KB · Lines: 116 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Unit eta
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 8.1 M · max rss memory: 21.3 MB
stderr:
loaded 5 declarations, 77 exprs (77 unique), 30 names in 0.000161022s declaration order verified in 1.085e-05s environment built in 2.2131e-05s; checking with 4 worker processes checked 5 declarations, 0 failed, in 0.00265788s wall (1.75953e-06 core-hours over 4 workers); 4 reduction steps; peak 18 MB in one worker
Test "tutorial/109_unitEta2"
Expected: 👍 accept · Size: 5.9 KB · Lines: 109 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Unit eta
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.0 M · max rss memory: 21.4 MB
stderr:
loaded 4 declarations, 73 exprs (73 unique), 29 names in 0.000141625s declaration order verified in 2.094e-06s environment built in 1.8935e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00198967s wall (1.5703e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/110_unitEta3"
Expected: 👍 accept · Size: 6.0 KB · Lines: 111 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Unit eta
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 8.0 M · max rss memory: 21.4 MB
stderr:
loaded 4 declarations, 75 exprs (75 unique), 29 names in 0.000160501s declaration order verified in 3.286e-06s environment built in 2.0779e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.00204749s wall (1.6786e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/111_indexedUnitEta"
Expected: ✋ reject · Size: 7.2 KB · Lines: 121 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The unit-like rule, which makes any two elements of a single-constructor type with
no fields definitionally equal, is also restricted to non-recursive structures
without indices (is_def_eq_unit_like goes through is_non_rec_structure), so it
does not fire for IndexedUnit.
Test result: ✋ rejected · exit code 1 · wall time: 19 ms · instructions: 8.2 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 86 exprs (86 unique), 27 names in 0.000135223s
declaration order verified in 2.265e-06s
environment built in 1.7163e-05s; checking with 4 worker processes
FAIL indexedUnitEta (line 121): declaration type mismatch for 'indexedUnitEta'
inferred: ((x : (IndexedUnit Bool.true)) -> ((y : (IndexedUnit Bool.true)) -> (((Eq.{1} (IndexedUnit Bool.true)) #1) #1)))
declared: ((x : (IndexedUnit Bool.true)) -> ((y : (IndexedUnit Bool.true)) -> (((Eq.{1} (IndexedUnit Bool.true)) #1) #0)))
checked 3 declarations, 1 failed, in 0.00265678s wall (2.04416e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/112_structEta"
Expected: 👍 accept · Size: 12.5 KB · Lines: 230 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Structure eta
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 9.0 M · max rss memory: 21.3 MB
stderr:
loaded 7 declarations, 173 exprs (173 unique), 43 names in 0.000965912s declaration order verified in 4.899e-06s environment built in 2.6169e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00325447s wall (2.45624e-06 core-hours over 4 workers); 4 reduction steps; peak 19 MB in one worker
Test "tutorial/113_indexedStructEta"
Expected: ✋ reject · Size: 8.5 KB · Lines: 138 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Structure eta applies only to non-recursive structures without indices: the
official kernel's is_non_rec_structure requires nindices == 0, so it does not
fire for IndexedSingleton even though that has a single constructor.
Every field of IndexedSingleton.mk is a proof, so a kernel that checks only
"has a single constructor" and then compares the fields against projections
would have proof irrelevance discharge the remaining goals, and would wrongly
accept this.
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 8.4 M · max rss memory: 21.2 MB
stderr:
loaded 5 declarations, 99 exprs (99 unique), 30 names in 0.000293922s
declaration order verified in 3.146e-06s
environment built in 1.8554e-05s; checking with 4 worker processes
FAIL indexedStructEta (line 138): declaration type mismatch for 'indexedStructEta'
inferred: ((a : (IndexedSingleton Bool.true)) -> (((Eq.{1} (IndexedSingleton Bool.true)) #0) #0))
declared: ((x : (IndexedSingleton Bool.true)) -> (((Eq.{1} (IndexedSingleton Bool.true)) (IndexedSingleton.mk True.intro)) #0))
checked 4 declarations, 1 failed, in 0.0026401s wall (1.71445e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/114_funEta"
Expected: 👍 accept · Size: 5.2 KB · Lines: 104 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Function eta for non-dependent functions.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.0 M · max rss memory: 21.1 MB
stderr:
loaded 3 declarations, 71 exprs (71 unique), 26 names in 0.000118583s declaration order verified in 1.954e-06s environment built in 1.6381e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00267775s wall (1.70662e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/115_funEtaDep"
Expected: 👍 accept · Size: 5.3 KB · Lines: 106 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Function eta for dependent functions (pi types).
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.0 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 73 exprs (73 unique), 26 names in 0.000117361s declaration order verified in 2.435e-06s environment built in 1.2122e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00285903s wall (1.78461e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/116_funEtaBad"
Expected: ✋ reject · Size: 4.9 KB · Lines: 97 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Eta should not identify functions with different bodies.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 8.0 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 64 exprs (64 unique), 27 names in 0.00011178s
declaration order verified in 3.807e-06s
environment built in 2.8895e-05s; checking with 4 worker processes
FAIL funEtaBad (line 97): declaration type mismatch for 'funEtaBad'
inferred: ((x._@.Tutorial.4249243883._hygCtx._hyg.28 : Sort(1)) -> ((x._@.Tutorial.4249243883._hygCtx._hyg.30 : Sort(1)) -> ((x._@.Tutorial.4249243883._hygCtx._hyg.32 : ((a._@._internal._hyg.0 : #1) -> #2)) -> ((f : ((a._@._internal._hyg.0 : #2) -> #2)) -> (((Eq.{1} ((x : #3) -> #3)) #0) #0)))))
declared: ((α : Sort(1)) -> ((β : Sort(1)) -> ((g : ((a._@._internal._hyg.0 : #1) -> #2)) -> ((f : ((a._@._internal._hyg.0 : #2) -> #2)) -> (((Eq.{1} ((x : #3) -> #3)) (fun (x : #3) => (#1 (#2 #0)))) #0)))))
checked 1 declarations, 1 failed, in 0.00224155s wall (1.71358e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/117_reflOccLeft"
Expected: ✋ reject · Size: 3.7 KB · Lines: 61 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Rejection: recursive occurrence on the left of an arrow, behind further arrows inside a constructor argument.
The constructor argument is a function type Nat → (I → Nat).
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.8 M · max rss memory: 21.1 MB
stderr:
loaded 2 declarations, 41 exprs (41 unique), 15 names in 0.00011196s declaration order verified in 4.118e-06s environment built in 1.2142e-05s; checking with 4 worker processes FAIL reflOccLeft (line 61): arg #1 of 'reflOccLeft.mk' has a non positive occurrence of the datatypes being declared checked 1 declarations, 1 failed, in 0.00264778s wall (1.79665e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/118_reflOccInIndex"
Expected: ✋ reject · Size: 3.9 KB · Lines: 66 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Rejection: recursive occurrence in index position, behind a further arrow.
We build an indexed inductive I : Type → Type with a constructor argument
Nat → I (I α), so the recursive occurrence appears as an index argument.
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.9 M · max rss memory: 21.2 MB
stderr:
loaded 2 declarations, 45 exprs (45 unique), 16 names in 9.566e-05s declaration order verified in 3.777e-06s environment built in 1.9106e-05s; checking with 4 worker processes FAIL reflOccInIndex (line 66): application type mismatch in (reflOccInIndex $3) argument type: Nat expected: Sort(1) checked 1 declarations, 1 failed, in 0.00196592s wall (1.20211e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/119_reduceCtorParamRefl.mk"
Expected: 👍 accept · Size: 4.5 KB · Lines: 88 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
When checking inductives, we expect the kernel to reduce the types of constructor arguments in all positive positions.
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 8.0 M · max rss memory: 21.2 MB
stderr:
loaded 3 declarations, 62 exprs (62 unique), 18 names in 9.4618e-05s declaration order verified in 3.687e-06s environment built in 1.4116e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00252552s wall (1.5524e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/120_reduceCtorParamRefl2.mk"
Expected: 👍 accept · Size: 4.5 KB · Lines: 88 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
When checking inductives, we expect the kernel to reduce the types of constructor arguments in all positive positions.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 8.0 M · max rss memory: 21.1 MB
stderr:
loaded 3 declarations, 62 exprs (62 unique), 18 names in 0.000120176s declaration order verified in 4.779e-06s environment built in 1.4968e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00239431s wall (1.92735e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/121_rTreeRec"
Expected: 👍 accept · Size: 5.5 KB · Lines: 91 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of the generated recursor.
Test result: 👍 accepted · exit code 0 · wall time: 16 ms · instructions: 8.0 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 60 exprs (60 unique), 24 names in 0.000123461s declaration order verified in 1.873e-06s environment built in 1.4057e-05s; checking with 4 worker processes checked 3 declarations, 0 failed, in 0.00169455s wall (1.22851e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/122_rtreeRecReduction"
Expected: 👍 accept · Size: 10.8 KB · Lines: 193 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reduction behavior of RTree.rec on RTree.mk.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 8.6 M · max rss memory: 21.2 MB
stderr:
loaded 6 declarations, 136 exprs (136 unique), 47 names in 0.000229742s declaration order verified in 2.575e-06s environment built in 1.2754e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.00295229s wall (1.73901e-06 core-hours over 4 workers); 13 reduction steps; peak 19 MB in one worker
Test "tutorial/123_accRecType"
Expected: 👍 accept · Size: 7.5 KB · Lines: 151 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of Acc.rec.
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 8.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 124 exprs (124 unique), 21 names in 0.000118643s declaration order verified in 2.204e-06s environment built in 1.3595e-05s; checking with 4 worker processes checked 2 declarations, 0 failed, in 0.00420995s wall (2.66954e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "tutorial/124_accRecReduction"
Expected: 👍 accept · Size: 13.4 KB · Lines: 252 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Acc.rec reduces on Acc.intro.
Test result: 👍 accepted · exit code 0 · wall time: 20 ms · instructions: 9.7 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 202 exprs (202 unique), 42 names in 0.000329127s declaration order verified in 5.481e-06s environment built in 2.0719e-05s; checking with 4 worker processes checked 4 declarations, 0 failed, in 0.0045801s wall (2.9894e-06 core-hours over 4 workers); 7 reduction steps; peak 20 MB in one worker
Test "tutorial/125_accRecNoEta"
Expected: ✋ reject · Size: 13.0 KB · Lines: 244 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Acc.rec does not have structure eta.
Test result: ✋ rejected · exit code 1 · wall time: 22 ms · instructions: 9.4 M · max rss memory: 21.3 MB
stderr:
loaded 4 declarations, 195 exprs (195 unique), 41 names in 0.000290525s
declaration order verified in 2.295e-06s
environment built in 2.0088e-05s; checking with 4 worker processes
FAIL accRecNoEta (line 244): declaration type mismatch for 'accRecNoEta'
inferred: ((α : Sort(1)) -> ((r : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((a : #1) -> ((h : (((Acc.{1} #2) #1) #0)) -> ((a : Bool) -> (((Eq.{1} Bool) #0) #0))))))
declared: ((α : Sort(1)) -> ((r : ((a._@._internal._hyg.0 : #0) -> ((a._@._internal._hyg.0 : #1) -> Sort(0)))) -> ((a : #1) -> ((h : (((Acc.{1} #2) #1) #0)) -> ((p : Bool) -> (((Eq.{1} Bool) ((((((Acc.rec.{1, 1} #4) #3) (fun (x._@.Tutorial.4017164079._hygCtx._hyg.22 : #4) => (fun (x._@.Tutorial.4017164079._hygCtx._hyg.24 : (((Acc.{1} #5) #4) #0)) => Bool))) (fun (x._@.Tutorial.4017164079._hygCtx._hyg.31 : #4) => (fun (x._@.Tutorial.4017164079._hygCtx._hyg.33 : ((y : #5) -> ((a._@._internal._hyg.0 : ((#5 #0) #1)) -> (((Acc.{1} #7) #6) #1)))) => (fun (x._@.Tutorial.4017164079._hygCtx._hyg.35 : ((y : #6) -> ((a._@._internal._hyg.0 : ((#6 #0) #2)) -> (((fun (x._@.Tutorial.4017164079._hygCtx._hyg.22 : #8) => (fun (x._@.Tutorial.4017164079._hygCtx._hyg.24 : (((Acc.{1} #9) #8) #0)) => Bool)) #1) ((#2 #1) #0))))) => #3)))) #2) #1)) #0))))))
checked 3 declarations, 1 failed, in 0.00450191s wall (2.84929e-06 core-hours over 4 workers); 0 reduction steps; peak 20 MB in one worker
Test "tutorial/126_quotMkType"
Expected: 👍 accept · Size: 6.3 KB · Lines: 123 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of Quot.mk.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 7.9 M · max rss memory: 21.2 MB
stderr:
loaded 6 declarations, 87 exprs (87 unique), 26 names in 0.000121698s declaration order verified in 2.685e-06s environment built in 1.3555e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.00279985s wall (1.89881e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/127_quotIndType"
Expected: 👍 accept · Size: 6.3 KB · Lines: 124 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of Quot.ind.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.0 M · max rss memory: 21.2 MB
stderr:
loaded 6 declarations, 88 exprs (88 unique), 26 names in 0.000103294s declaration order verified in 4.869e-06s environment built in 1.559e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.00266038s wall (1.51673e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/128_quotLiftType"
Expected: 👍 accept · Size: 6.3 KB · Lines: 124 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of Quot.lift.
Test result: 👍 accepted · exit code 0 · wall time: 17 ms · instructions: 8.0 M · max rss memory: 21.3 MB
stderr:
loaded 6 declarations, 88 exprs (88 unique), 26 names in 0.000132038s declaration order verified in 2.244e-06s environment built in 1.581e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.0023149s wall (1.98148e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/129_quotSoundType"
Expected: 👍 accept · Size: 7.2 KB · Lines: 141 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Asserting the type of Quot.sound.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.1 M · max rss memory: 21.2 MB
stderr:
loaded 7 declarations, 103 exprs (103 unique), 27 names in 0.000128201s declaration order verified in 2.264e-06s environment built in 2.153e-05s; checking with 4 worker processes checked 7 declarations, 0 failed, in 0.00263849s wall (1.82966e-06 core-hours over 4 workers); 0 reduction steps; peak 18 MB in one worker
Test "tutorial/130_quotLiftReduction"
Expected: 👍 accept · Size: 7.8 KB · Lines: 153 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reduction behavior of Quot.lift on Quot.mk.
Test result: 👍 accepted · exit code 0 · wall time: 18 ms · instructions: 8.3 M · max rss memory: 21.2 MB
stderr:
loaded 6 declarations, 116 exprs (116 unique), 27 names in 0.000254398s declaration order verified in 2.264e-06s environment built in 1.4818e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.00343259s wall (1.99276e-06 core-hours over 4 workers); 2 reduction steps; peak 19 MB in one worker
Test "tutorial/131_quotIndReduction"
Expected: 👍 accept · Size: 7.6 KB · Lines: 151 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Reduction behavior of Quot.ind on Quot.mk.
Test result: 👍 accepted · exit code 0 · wall time: 19 ms · instructions: 8.3 M · max rss memory: 21.3 MB
stderr:
loaded 6 declarations, 115 exprs (115 unique), 26 names in 0.000140092s declaration order verified in 2.896e-06s environment built in 1.6742e-05s; checking with 4 worker processes checked 6 declarations, 0 failed, in 0.0034246s wall (2.16852e-06 core-hours over 4 workers); 2 reduction steps; peak 19 MB in one worker
Test "tutorial/132_dup_defs"
Expected: ✋ reject · Size: 475 B · Lines: 7 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Two definitions with the same name
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.4 M · max rss memory: 21.5 MB
stderr:
loaded 2 declarations, 2 exprs (2 unique), 1 names in 8.1113e-05s declaration order verified in 4.589e-06s error: constant already declared: dup_defs
Test "tutorial/133_dup_ind_def"
Expected: ✋ reject · Size: 1.7 KB · Lines: 27 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A definition and a constructor with the same name
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 15 exprs (15 unique), 7 names in 0.000123191s declaration order verified in 2.815e-06s error: constant already declared: dup_ind_def
Test "tutorial/134_dup_ctor_def"
Expected: ✋ reject · Size: 1.7 KB · Lines: 27 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A definition and a constructor with the same name
Test result: ✋ rejected · exit code 1 · wall time: 15 ms · instructions: 7.5 M · max rss memory: 21.4 MB
stderr:
loaded 2 declarations, 15 exprs (15 unique), 7 names in 0.000109035s declaration order verified in 1.993e-06s error: constant already declared: dup_ctor_def.mk
Test "tutorial/135_dup_rec_def"
Expected: ✋ reject · Size: 1.7 KB · Lines: 27 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A definition and a recursor with the same name
Test result: ✋ rejected · exit code 1 · wall time: 15 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 15 exprs (15 unique), 7 names in 0.000105979s declaration order verified in 1.753e-06s error: constant already declared: dup_rec_def.rec
Test "tutorial/136_misnamed_rec_user"
Expected: ✋ reject · Size: 2.0 KB · Lines: 33 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
The name of the recursor for misnamed_rec must be misnamed_rec.rec:
another name (like misnamed_rec.not_rec) should be rejected.
dupRecUser is included so that checkers that recreate the recursor (as misnamed_rec.rec)
rather than validating it still fail, because misnamed_rec_user references misnamed_rec.not_rec.
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 18 exprs (18 unique), 9 names in 9.6271e-05s declaration order verified in 1.843e-06s environment built in 1.4207e-05s; checking with 4 worker processes FAIL misnamed_rec (line 25): recursor 'misnamed_rec.rec' missing from the export checked 0 declarations, 1 failed, in 0.00237283s wall (1.37315e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/137_dup_rec_def2"
Expected: ✋ reject · Size: 1.7 KB · Lines: 28 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Even if a kernel doesn't catch a recursor for dup_rec_def2 that is misnamed
as dup_rec_def2.not_rec, it should catch some other constant being given
the name dup_rec_def2.rec that is reserved for the recursor.
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 2 declarations, 15 exprs (15 unique), 8 names in 0.000102923s declaration order verified in 1.854e-06s environment built in 1.6541e-05s; checking with 4 worker processes FAIL dup_rec_def2 (line 28): recursor 'dup_rec_def2.rec' missing from the export checked 1 declarations, 1 failed, in 0.00175152s wall (1.15322e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/138_dup_ctor_rec"
Expected: ✋ reject · Size: 1.5 KB · Lines: 24 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
A constructor and a recursor with the same name
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.5 M · max rss memory: 21.4 MB
stderr:
loaded 1 declarations, 14 exprs (14 unique), 6 names in 0.000116038s declaration order verified in 2.415e-06s error: constant already declared: dup_ctor_rec.rec
Test "tutorial/139_DupConCon"
Expected: ✋ reject · Size: 2.2 KB · Lines: 34 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
An inductive with two constructors with the same name
Test result: ✋ rejected · exit code 1 · wall time: 16 ms · instructions: 7.5 M · max rss memory: 21.3 MB
stderr:
loaded 1 declarations, 21 exprs (21 unique), 9 names in 0.000113493s declaration order verified in 1.683e-06s error: constant already declared: dup_ind_con_con.mk
Test "tutorial/140_falseFromUnsafe"
Expected: ✋ reject · Size: 1.3 KB · Lines: 22 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Unsafe definitions cannot be used in theorems
Test result: ✋ rejected · exit code 1 · wall time: 18 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 10 exprs (10 unique), 7 names in 8.1803e-05s declaration order verified in 1.984e-06s environment built in 1.4287e-05s; checking with 4 worker processes FAIL falseFromUnsafe (line 22): invalid declaration, it uses unsafe declaration 'unsafeLoop' checked 2 declarations, 1 failed, in 0.00210595s wall (1.35046e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker
Test "tutorial/141_falseFromPartial"
Expected: ✋ reject · Size: 1.3 KB · Lines: 22 · lean4export: 3.1.0 · Lean: 4.29.1 · 📄 Declaration · 🔗 Source
Partial definitions cannot be used in theorems
Test result: ✋ rejected · exit code 1 · wall time: 17 ms · instructions: 7.6 M · max rss memory: 21.3 MB
stderr:
loaded 3 declarations, 10 exprs (10 unique), 7 names in 0.000118453s declaration order verified in 2.034e-06s environment built in 1.3786e-05s; checking with 4 worker processes FAIL partialLoop (line 20): invalid declaration, it uses unsafe declaration 'partialLoop' checked 1 declarations, 1 failed, in 0.0024795s wall (1.56622e-06 core-hours over 4 workers); 0 reduction steps; peak 19 MB in one worker