Vincent Gonzalez

Verified Software Assumes What Its Arithmetic Requires: An Axiom Census of Four Rocq Developments

A machine-checked proof of a program's correctness is conditional on whatever the development assumes, and for deployed software that condition is the whole point. Four Rocq developments are censused with one source-level instrument: the CompCert verified C compiler, fiat-crypto,...

Interface Assumptions Are Not Mathematical Assumptions: An Axiom Census of Five Libraries Across Four Proof Systems

A formal library's axiom count is routinely reported as a single number. This paper argues that the number conflates two populations which behave differently and answer different questions, and that the conflation is only visible from outside a single library. Five libraries are...

Interface Assumptions Are Not Mathematical Assumptions: An Axiom Census of Five Libraries Across Four Proof Systems

A formal library's axiom count is routinely reported as a single number. This paper argues that the number conflates two populations which behave differently and answer different questions, and that the conflation is only visible from outside a single library. Five libraries are...

Filtering and Generating: Two Roles for Method-Specification in Epistemic-Possibility Anti-Luck Conditions

Method-relative modal conditions on knowledge are standardly assessed against a similarity ordering over possible worlds fixed independently of the method: the specification restricts which worlds are quantified over, while the metric is given by the world-space. I distinguish th...

Filtering and Generating: Two Roles for Method-Specification in Epistemic-Possibility Anti-Luck Conditions

Method-relative modal conditions on knowledge are standardly assessed against a similarity ordering over possible worlds fixed independently of the method: the specification restricts which worlds are quantified over, while the metric is given by the world-space. I distinguish th...

Filtering and Generating: Two Roles for Method-Specification in Epistemic-Possibility Anti-Luck Conditions

Method-relative modal conditions on knowledge are standardly assessed against a similarity ordering over possible worlds fixed independently of the method: the specification restricts which worlds are quantified over, while the metric is given by the world-space. I distinguish th...

Eligibility Discriminates Among Theorems and Not Among the Constants They Rest On

Separating a theorem's statement dependencies from its proof dependencies bounds how much classical dependence a formal library could shed. Across Mathlib, 13.1% of theorems have a choice-free statement and a choice-dependent proof; nothing outside that band can be removed under...

Eligibility Discriminates Among Theorems and Not Among the Constants They Rest On

Separating a theorem's statement dependencies from its proof dependencies bounds how much classical dependence a formal library could shed. Across Mathlib, 13.1% of theorems have a choice-free statement and a choice-dependent proof; nothing outside that band can be removed under...

Which Constant Is Responsible? Dominator Analysis of Classical Dependence in Mathlib

61.2% of Mathlib's theorems depend on Classical.choice. Asking which constant is responsible for that dependence is a different question from asking which constants a proof touches, and the two answers differ by a factor of 58 on the first case examined: 116,766 theorems reach th...

Where Formal Libraries Spend Their Axioms: A Cross-Foundation Measurement, and an Avoidable Classical Dependency in Lean's omega

Changes in 1.0.3: adds contemporaneous work to section 1.1 — Mendoza-Smith(arXiv:2606.28572), which separates statement-level from proof-level signal onthe same corpus by a different method; Fan and DeDeo (arXiv:2604.22519) ontactic ablation; Li, Peng, Severini and Shafto (arXiv:...

Why Tactic-Level Rates Cannot Attribute Classical Dependencies in Lean

A proof assistant reports which axioms a theorem depends on. It does not report which step introduced them, and a proof invoking several tactics offers no way to apportion the answer. The obvious approach is statistical: score each tactic by how often its proofs carry a classical...

Where Formal Libraries Spend Their Axioms: A Cross-Foundation Measurement, and an Avoidable Classical Dependency in Lean's omega

A proof assistant can report which axioms a theorem rests on, but only one theorem at a time, and only whether rather than why. I measure axiom use across six libraries and two proof systems - the Metamath databases set.mm (ZFC, classical first-order), iset.mm (intuitionistic), n...

Where Formal Libraries Spend Their Axioms: A Cross-Foundation Measurement, and an Avoidable Classical Dependency in Lean's omega

A proof assistant reports which axioms a theorem rests on one theorem at a time, and only whether rather than why. I measure axiom use across four libraries and two foundations - the Metamath databases set.mm (ZFC, classical first-order), iset.mm (intuitionistic) and nf.mm (Quine...

Certified upper bounds for Fejes Tóth's point-goalie problem at n = 4 and 5

In 1974 László Fejes Tóth posed the following problem: place n points in the plane so asto minimise the largest distance from a line meeting the unit-radius disc to the nearestpoint. Writing r_n for the optimum, he proved r_1 = r_2 = 1 and r_3 = 3/5 exactly, gaveconstructions sho...

Certified upper bounds for Fejes Tóth's point-goalie problem at n = 4 and 5

In 1974 László Fejes Tóth posed the following problem: place n points in the plane so asto minimise the largest distance from a line meeting the unit-radius disc to the nearestpoint. Writing r_n for the optimum, he proved r_1 = r_2 = 1 and r_3 = 3/5 exactly, gaveconstructions sho...