Search may be probabilistic. Certification is not. Every Verified result is tied to the
exact claim, scope, assumptions, and revision that were checked.
01 / THE FINAL DECISION
Lean checks the proof.
Lean is a programming language and interactive theorem prover. Its small checking kernel
accepts a proof only when it follows from explicit rules and stated assumptions.
SEARCH Candidate proofPending verification
CHECK
LEAN
PROOF CHECKERAccept or reject
THE BOUNDARY
Search may fail to find a proof. It cannot make Lean accept one that does not check.
SCHEMATIC · VERIFICATION CERTIFICATE Verified
CLAIM Restricted actions require approval
VERIFICATION RECORD cert_a31 SEALED
Scope
All entry points
Revision
9f72c1
Assumptions
4 recorded
Checked by
Lean 4
Verification record sealed with certificate Audit trail preserved
The certificate binds the Verified result to the exact claim, scope, assumptions, and
software revision it covers. This preserves a controlled audit trail without exposing
proprietary implementation details.
02 / WHEN SOFTWARE CHANGESThe result never drifts away from the software.
Each certificate names the revision it covers. If relevant code or assumptions change,
Schematic re-establishes the claim for the new revision and issues a new certificate.
REVISION9f72c1 VERIFIED
→
CHANGEbc18e4RECHECK CLAIM
→
NEW CERTIFICATEcert_a31 VERIFIED
Evidence
Don’t take our word for it.
Real software, concrete counterexamples, and results you can inspect.
OPEN-SOURCE SUPERTEST STUDY
Nine libraries. 135 generalized laws.
Across pinned versions of open-source C, Rust, and Python libraries, repeated test
families were consolidated into stronger laws while boundary and regression tests stayed
explicit.