Repository navigation
[v0.4] Release program: general formal programming, verified production compilation, and models/reasoning #15
Copy link
Copy link
Open
Milestone
Description
Objective
Deliver LexLean v0.4 as a major architectural expansion beyond v0.3 along three coordinated paths:
- General formal programming language — extend the closed semantic language so substantial total programs, compilers, reusable abstractions, and their proofs are authored natively in LexLean rather than through raw Lean/backend escapes.
- PrismPM production integration — make production compilation a LexLean-authored, Lean-verified program, with the existing
auser/lean4-prodused only as a differential validation oracle during transition. - Language and reasoning models — add closed, typed model/reasoning semantics that can be compiled as ordinary LexLean computational objects and consumed by PrismPM applications.
The release must preserve LexLean's defining invariants: closed semantics, one linked semantic source for Lean/LaTeX/snapshots, no raw backend payloads, deterministic identities, exact axiom policies, fail-closed diagnostics, and the established falsifiable just vv acceptance discipline.
Non-negotiable design rules
- Do not equate compiler verification, self-hosting, or oracle agreement with global optimality.
- Do not define the global candidate universe as “what the optimizer can generate.”
- UOR-GNAF/NAF optimality claims must use an independently defined complete-system universe, exact machine/accounting boundary, explicit objective/order, and either proof-complete comparison or a universal lower bound attained by the selected realization.
- Internal plan optimality is not complete-system optimality.
- Representation minimality/non-adjacency is not execution optimality without a proved representation-to-execution bridge.
lean4-prodis validation evidence only; it is not the normative compiler semantics or proof of optimality.- Existing language 1.0/1.1 projects and v0.3 artifacts must not silently change meaning.
Required issue discipline
Every child capability must follow the repository's standing R3 discipline:
- register normative capability IDs in
model/ids.tomland SPEC §31; - add exactly one matching scenario per ID;
- add exactly one named
conformance_<id>test; - implement positive and negative fixtures;
- plant and record a defect proving the relevant gate can fail;
- run the targeted gate while developing and the complete
just vvgate before completion.
No issue may close on prose/spec work alone if it introduces a normative capability.
Definition of done
- All v0.4 child issues are closed with their acceptance evidence.
SPEC.md, schemas, language data, model registers, generatedCONFORMANCE.md/ERRORS.md, README, CHANGELOG, and VERIFICATION evidence agree.- All new public failures are registered in the closed error model.
- Every new semantic variant is represented in semantic snapshots, canonical serialization, Lean lowering, LaTeX rendering, source maps, lexical/output coverage, and deterministic identities as applicable.
- Existing 1.0/1.1 examples remain byte-stable except where an explicitly versioned migration is part of the accepted v0.4 contract.
- New end-to-end v0.4 examples cover the formal-programming, production-compiler, model, and reasoning paths.
- Lean-backed examples elaborate under the pinned toolchain, replay through
leanchecker, and pass exact axiom audit. - Reproducibility/golden gates pass across the repository's supported host policy.
just vvpasses from a clean checkout.- The v0.4 release checklist contains no deferred capability, placeholder, disabled branch, or “future work” needed for any claimed v0.4 feature.
Acceptance criteria
- A fresh checkout can exercise all three paths without handwritten Lean or backend-specific semantic bypasses.
- A substantial compiler implementation is authored as LexLean source and verified as generated Lean.
- The production path emits canonical Rust with a machine-checkable semantic-preservation result and only makes a global-optimality claim when the GNAF completeness/lower-bound obligations are discharged.
lean4-prodoracle mismatches are fail-closed validation failures and cannot be used to expand the formal claim.- A nontrivial language-model realization and a nontrivial reasoning-model realization are represented by closed LexLean semantics and compile through the same production boundary as ordinary programs.
- All new claims are registered at the correct honesty level; no measured/oracle result is represented as a proof.
v0.4 work graph
Foundation / language
- [v0.4] Define language 1.2 and compatibility/migration contract #16 Language 1.2 compatibility and migration contract
- [v0.4] Generalize semantic types: recursive algebraic data, products/records, and parameterized inductives #17 Recursive/parameterized semantic data types
- [v0.4] Add first-class functions, lambdas, higher-order composition, and closure-safe semantics #18 First-class functions and higher-order semantics
- [v0.4] Generalize total recursion, mutual recursion, well-founded recursion, and termination evidence #19 General total and well-founded recursion
- [v0.4] Add finite maps, sets, sequences, graph data, and deterministic state-threading primitives #20 Deterministic maps/sets/sequences/graphs/state
- [v0.4] Define typed Lean compiler-frontend/LCNF authority interface and verified named-root extraction #35 Typed Lean compiler-frontend/LCNF authority interface
- [v0.4] Define production eligibility, root closure, and formal-only vs executable semantic boundary #36 Production eligibility and executable-root closure
Verified production compiler / GNAF / PrismPM
- [v0.4] Define the production realization calculus and exact Rust target semantics #21 Production realization calculus and Rust target semantics
- [v0.4] Define independent complete-system candidate universe, machine contract, and objective order for GNAF #22 Independent complete-system universe, machine contract, and objective order
- [v0.4] Implement LexLean-native GNAF certification and global lower-bound attainment framework #23 LexLean-native GNAF certification and global lower-bound attainment
- [v0.4] Implement canonical Rust AST/rendering backend from the production calculus #24 Canonical Rust AST/rendering backend
- [v0.4] Prove source→target→Rust semantic preservation for production-eligible LexLean #25 End-to-end semantic-preservation proof
- [v0.4] Integrate auser/lean4-prod strictly as a differential validation oracle #26 lean4-prod differential validation oracle
- [v0.4] Author the production compiler itself in LexLean and verify the generated Lean implementation #27 Production compiler authored in LexLean and verified as generated Lean
- [v0.4] Add PrismPM production export contract and stable compiler API #28 PrismPM production export contract and stable compiler API
Models and reasoning
- [v0.4] Introduce closed Model, Realization, Contract, and Evidence semantics #29 Model / Realization / Contract / Evidence semantics
- [v0.4] Add language-model semantic components and compositional text-processing pipeline #30 Language-model semantic components
- [v0.4] Add reasoning-machine semantics: state, rules, search, verification, iteration, and termination #31 Reasoning-machine semantics
- [v0.4] Build model/reasoning stdlib composition and PrismPM application fixture #32 Model/reasoning stdlib composition and PrismPM application fixture
Release verification and closure
- [v0.4] Extend vv for production compiler, GNAF certificates, Rust artifacts, and oracle falsification #33 Extend vv to all v0.4 production/model/reasoning claims
- [v0.4] End-to-end release closure, examples, documentation, packaging, and clean-checkout reproducibility #34 End-to-end examples, documentation, packaging, and release closure
Recommended dependency order
- [v0.4] Define language 1.2 and compatibility/migration contract #16
- [v0.4] Generalize semantic types: recursive algebraic data, products/records, and parameterized inductives #17, [v0.4] Add first-class functions, lambdas, higher-order composition, and closure-safe semantics #18, [v0.4] Generalize total recursion, mutual recursion, well-founded recursion, and termination evidence #19, [v0.4] Add finite maps, sets, sequences, graph data, and deterministic state-threading primitives #20
- [v0.4] Define typed Lean compiler-frontend/LCNF authority interface and verified named-root extraction #35, [v0.4] Define production eligibility, root closure, and formal-only vs executable semantic boundary #36
- [v0.4] Define the production realization calculus and exact Rust target semantics #21, [v0.4] Define independent complete-system candidate universe, machine contract, and objective order for GNAF #22
- [v0.4] Implement LexLean-native GNAF certification and global lower-bound attainment framework #23, [v0.4] Implement canonical Rust AST/rendering backend from the production calculus #24, [v0.4] Prove source→target→Rust semantic preservation for production-eligible LexLean #25
- [v0.4] Author the production compiler itself in LexLean and verify the generated Lean implementation #27 and [v0.4] Integrate auser/lean4-prod strictly as a differential validation oracle #26
- [v0.4] Add PrismPM production export contract and stable compiler API #28
- [v0.4] Introduce closed Model, Realization, Contract, and Evidence semantics #29, [v0.4] Add language-model semantic components and compositional text-processing pipeline #30, [v0.4] Add reasoning-machine semantics: state, rules, search, verification, iteration, and termination #31
- [v0.4] Build model/reasoning stdlib composition and PrismPM application fixture #32
- [v0.4] Extend vv for production compiler, GNAF certificates, Rust artifacts, and oracle falsification #33
- [v0.4] End-to-end release closure, examples, documentation, packaging, and clean-checkout reproducibility #34
Parallel work is acceptable only when the affected semantic contracts are already fixed. No downstream implementation should invent a local substitute for an unresolved upstream semantic boundary.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
- StatusShow more project fieldsTodo
Activity
afflom commentedon Oct 15, 2026
The completion plan for the 0.5.0 release, which continues this program, is #106.
Generated by Claude Code
afflom commentedon Oct 17, 2026
v0.4 status, 2026-10-17 03:00Z, from the maintainer.
mainisc3905e7c(register 393). Landed since the last update: #158 (integer order and fold laws, #117), #146 (certificate E as data, #89 stage 1), #159 (bddas parts of one run, #131), #153 (stdlib member 1, #92). Main's push runs on097b9b97andccd37ec7are green; the one onc3905e7cis running.Open v0.4 issues and what stands between each and close
claude/issue-89-certificate-b, no new library lemmas needed; stage 4 (audit module and the no-Lean-template gate) not startedItemproofs, stage 3 (loop, memory model), stage 4; a second session for the package-scaffolding slice is proposed on #91 and not answeredBS-01) is #160, ready, CI running; source packages (#161, PR #162, draft) is the missing mechanism for a project to import the stdlib; the effects boundary waits on #91 stage 4LM-01..LM-03,LM-13) is #82, CI running, moves the language-1.2 identity; context windows, generators, classifiers, adapters, composition followloopWhat limits the pace. Each landing is two hours of CI, and every PR that moves the language-1.2 identity (#82, #162, later #91 stage 2 and 3) makes every other PR with 1.2 records regenerate once. The org has 20 concurrent runner jobs, shared across repositories. The rules in force: a PR merges on a green head that contains main and carries a review from someone other than its author (the maintainer records one for sessions' PRs, and approves hh's formally); contributors push a draft PR at most about every 90 minutes; #159's
bddparts took therestleg from 111 to 23 minutes, so the longest path of a ready run is now the Atlas side.Not in the v0.4 path. #150 (#118), #151 (#114), #68 stay open as v0.5 or stale; I carry them after the wave above.
Generated by Claude Code
afflom commentedon Oct 17, 2026
v0.4 status, 2026-10-17 10:10Z, from the maintainer.
mainisea0a4eda(register 402). Since the 03:05Z update: #82 (tokenizers, slice 1 of #30:LM-01..LM-03,LM-13), #160 (the axiom-output parser as a certified production root,BS-01, step 4 of #92) and #162 (source packages,PK-01..PK-04, most of #161) are merged, each on a green head that contained main, with a review recorded; the main push runs onc3905e7c,d22266b3and8a844674are green (the one onea0a4edais next). Earlier today: #158, #146, #159, #153.isDefEq-equal, no library growth; it follows A. Stage 4 (audit module and the gate) is mine, after bothWhat costs time: every landing is about two hours of CI and every identity move (#82, #162, and #155 next) makes every other PR with language-1.2 records regenerate once. Both contributor sessions on #89 and the #161 session are merging main now; no more identity moves are planned before A and B land except #155's.
Generated by Claude Code
afflom commentedon Oct 17, 2026
v0.4 status and plan, 2026-10-17 17:00Z, from the maintainer.
mainis243f0c73(register 403: #165 merged, which closes #161). The owner's instruction today: complete the release asap; #68 is completed with the other pull requests and all v0.4 work; #131 (CI cost) is critical. What that changed:1. CI cost (#131), decided with the owner: the two-tier gate, #166. A merged PR cost about 1,450 runner-minutes on the 20 shared jobs: about 2.7 runs of about 500 (a draft push already paid the host matrix,
examplesand everybddrow, about 300) plus a full re-run onmainof a tree a PR run had just passed. #166 adds aplanjob: a draft runs therestleg only (about 23 runner-minutes), a ready PR and a push tomainrun the whole gate, and a push tomainthat merges a head whose tree it equals, when a PR run of that head passed every job, runs nothing and names the run. Estimated 1,450 to about 600 per merged PR. The draft run of #166 itself already shows the plan on a real runner (plan, then onlyrest). It lands right after #155 (a CI-only change merged on a verified local merge, announced, backstopped by the push run). Rule for all contributor sessions, from now: keep a PR a draft until its head is final and containsmain; mark it ready once; I merge only a head that containsmain.2. One train instead of five regenerations. Every PR that moves the language-1.2 ID makes every other regenerate (about three hours of writers plus two of CI each). I regenerated #155 on the combined identity myself at hh's request (
5a04afd1,63dd4c08…, register 404); its run is in progress. The identity-moving or record-moving PRs in flight ride in one integration branch, one regeneration, one CI run, after #155 lands: certificate A (#157) and B (#163), #151 (widening conversions, SM-32), #150 (dyadic decoding, MD-13), #68 (explicit byte literals, owner decision), and #91 slice 1 (package scaffolding as generated output, with #105 step 3b; hh agreed on #91). One contributor session each, hand-written work only; #150, #151 are pushed (train/dyadic,train/widening), the others report next. Each PR is still reviewed against its issue's DoD and merged as its commits land.5a04afd1; full gate runningissue-30-language-modelbranch holds the next slicesWhat bounds the date. Not CI any more, once #166 lands: the #91 chain (7 to 13 serial landings, each a regeneration and a gate run of about 90 minutes if the pool is free, after which #105 and #92's compiler components follow). I will state a date when hh posts the
ItemDefmeasurement and the stage 3 count; I will not guess one. What shortens it: (a) fewer, larger #91 PRs where the proofs allow (hh's low end is 7), (b) trains for everything else, as above, (c) the regeneration as one command, which I will make if a second landing needs it.Generated by Claude Code