proofs.rs

Report #28 — ASCII classification, string views and sequence updates

Aeneas be86ab0f1989d04944292b345b24c435be3ad10a

51 verified claims · 0 findings

Recorded by the author; proofs.rs has not re-run it. How to read a report

nyuichi · 2026-11-05 04:39 UTC

Revision v9 · v8 · v7 · v6 · v5
4 more revisionsv4 · v3 · v2 · v1

Overview

For ascii 1.1.0, as_byte returns the exact ASCII code for every valid AsciiChar. The eleven classification methods are correct for all 128 characters: digits are characters '0' through '9'; alphabetic is A-Z or a-z; alphanumeric additionally accepts digits; lowercase and uppercase accept a-z and A-Z respectively; hexdigit accepts 0-9, A-F or a-f. Graphic accepts byte codes 33-126 and printable accepts 32-126. Blank accepts space or tab; whitespace accepts space, tab, LF, CR and FF, rejecting vertical tab; control accepts codes 0-31 or 127. eq_ignore_ascii_case returns exactly whether the two codes are equal after mapping A-Z to a-z and leaving other codes unchanged; the independent mathematical equivalence is proved for all 128 squared valid pairs. For the AsciiChar implementation of ToAsciiChar, the checked method always returns Ok of the same value and the unchecked method returns that same value. is_ascii_punctuation accepts exactly ASCII intervals 33-47, 58-64, 91-96 and 123-126. The hand-written Default implementation returns the NUL enum value. AsAsciiStrError::valid_up_to returns its stored index; this does not establish that a separate validator found the first invalid byte. The public is_alphabetic, is_alphanumeric, is_lowercase and is_uppercase methods satisfy the same letter/digit predicates. is_whitespace accepts space, tab, LF, CR, VT and FF. For every u32 radix, is_digit returns normally at radix 0-36 and accepts exactly characters whose digit value (0-9 or case-independent A-Z values 10-35) is below the radix; other characters return false. Thus radix 0 always returns false and radix 1 accepts only character '0'. Every radix above 36 panics. The other twenty-three character/error bodies terminate normally in the model. AsciiStr::as_slice preserves the complete character sequence; as_mut_slice supplies that initial view and its generated backward function writes every valid same-length replacement back exactly. AsciiStr::len gives the exact sequence length and is_empty is equivalent to an empty sequence. For an already valid AsciiStr receiver, the AsAsciiStr checked conversion returns Ok with the unchanged view, its unchecked conversion is the same view, and the AsMutAsciiStr unchecked conversion preserves the initial view and exact same-length valid replacement writeback. These original implementations are identities, not raw byte casts or validation of other input types. AsciiString::new produces an empty sequence, len returns its exact length, and is_empty is equivalent to an empty sequence. push writes back the original sequence followed by the supplied character below the model length limit; at model length usizeMAX it fails with maximumSizeExceeded. Separately, Kani directly checked the original checked ToAsciiChar bodies for u8, i8, u16, u32 and char over their complete type domains: Ok exactly for ASCII-range inputs, preserving the codepoint, and Err otherwise. Those five body-check results are separate evidence and are not additional Lean API claims. Seven separate Kani checks also verify original case conversion and mutable writeback, as_char, case-insensitive equality and printable control pictures over all 128 valid characters (all pairs for equality). These establish A-Z/a-z mapping, exact receiver updates, ASCII code preservation and U+2400 control pictures with DEL at U+2421. For every FromAsciiError<O> with arbitrary owner type O, ascii_error returns exactly its stored AsAsciiStrError and into_source consumes the wrapper and returns exactly its stored original owner. Both terminate normally with no Clone/Copy requirement on O and no validation or conversion. The stored error index is merely projected; these methods do not establish that a separate validator found an invalid byte. For the original default-allocator Vec<AsciiChar> implementations, From<Vec<AsciiChar>> for AsciiString, From<AsciiString> for Vec<AsciiChar>, and both IntoAsciiString methods preserve every character, its order and the sequence length in the official Vec model. The checked method returns Ok for every valid typed ASCII vector. The unchecked method returns the same wrapped vector for this exact implementation; its elements must already be valid AsciiChar values and it performs no raw-byte reinterpretation. These results do not validate Vec<u8> or describe physical allocation addresses, capacity or allocator failure behavior. Five further exact borrowing implementations are covered: AsRef<[AsciiChar]> and AsMut<[AsciiChar]> for AsciiStr and AsciiString preserve the complete initial character sequence and length; each mutable backward function writes every valid same-length replacement back exactly. AsRef<AsciiStr> for AsciiStr returns the unchanged typed view. These claims concern valid typed receivers and the modeled sequence, not physical buffer identity. Three further exact original methods are covered: AsMut<AsciiStr> for AsciiStr returns its unchanged typed view and identity backward function, so valid same-length replacements are written back exactly. ToAsciiCharError Error::description returns exactly "not an ASCII character" and AsAsciiStrError Error::description returns exactly "one or more bytes are not ASCII", for every error value. These descriptions do not validate the stored error or describe formatting behavior. The generic AsciiChar::from_ascii<C:ToAsciiChar> method exactly forwards the supplied checked callback result, preserving normal Ok/Err and modeled failure or divergence. It does not independently establish validation or termination of arbitrary callback implementations. For original FromAsciiError<O> Error::description (Rust O:Any), every owner and stored error index returns normally with the same exact constant one or more bytes are not ASCII, without inspecting or converting the owner. Separately, original-Rust Kani checks establish thirty additional scalar contracts: conversion of every valid AsciiChar to u8 or char preserves its code; equality and partial ordering against every u8 and every valid Unicode char agree with numeric code comparison in both directions, including inherited ne/lt/le/gt/ge on those manual implementations. Five further unsafe ToAsciiChar conversions for u8, i8, u16, u32 and char return the exact valid character for every documented safe input code 0..127. These thirty-five contracts are supplemental Kani evidence, not additional Lean API mappings. Separate original-Rust Kani checks establish that Error::source and the inherited cause method for every ToAsciiCharError return None. The actual original receiver has a unit field and is obtained through the public failing conversion; this is not a general rule about arbitrary zero-sized types. The original manual Default for a static AsciiStr reference returns a view with length0, is_empty true and empty character/byte contents. Because that API has no arguments, this covers its complete input domain. These three supplemental contracts passed55 checks and add no Lean mappings.

Findings (0)

No findings reported.

APIs (51)

Associated functions

impl AsciiChar

pub fn from_ascii<C: ToAsciiChar>(ch: C) -> Result<Self, ToAsciiCharError>

impl AsciiString

pub const fn new() -> Self

Methods

impl AsAsciiStrError

pub const fn valid_up_to(self: Self) -> usize

impl AsciiChar

pub const fn as_byte(self: Self) -> u8
pub const fn eq_ignore_ascii_case(self: &Self, other: &Self) -> bool
pub const fn is_alphabetic(self: Self) -> bool
pub const fn is_alphanumeric(self: Self) -> bool
pub const fn is_ascii_alphabetic(self: &Self) -> bool
pub const fn is_ascii_alphanumeric(self: &Self) -> bool
pub const fn is_ascii_blank(self: &Self) -> bool
pub const fn is_ascii_control(self: &Self) -> bool
pub const fn is_ascii_digit(self: &Self) -> bool
pub const fn is_ascii_graphic(self: &Self) -> bool
pub const fn is_ascii_hexdigit(self: &Self) -> bool
pub const fn is_ascii_lowercase(self: &Self) -> bool
pub const fn is_ascii_printable(self: &Self) -> bool
pub const fn is_ascii_punctuation(self: &Self) -> bool
pub const fn is_ascii_uppercase(self: &Self) -> bool
pub const fn is_ascii_whitespace(self: &Self) -> bool
pub fn is_digit(self: Self, radix: u32) -> bool
pub const fn is_lowercase(self: Self) -> bool
pub const fn is_uppercase(self: Self) -> bool
pub const fn is_whitespace(self: Self) -> bool

impl AsciiStr

pub fn as_mut_slice(self: &mut Self) -> &mut [AsciiChar]
pub const fn as_slice(self: &Self) -> &[AsciiChar]
pub const fn is_empty(self: &Self) -> bool
pub const fn len(self: &Self) -> usize

impl AsciiString

pub fn is_empty(self: &Self) -> bool
pub fn len(self: &Self) -> usize
pub fn push(self: &mut Self, ch: AsciiChar)

impl FromAsciiError<O>

pub fn ascii_error(self: &Self) -> AsAsciiStrError
pub fn into_source(self: Self) -> O

Trait implementations

impl ascii::AsAsciiStr for AsciiStr

pub fn as_ascii_str(self: &Self) -> Result<&AsciiStr, AsAsciiStrError>
pub unsafe fn as_ascii_str_unchecked(self: &Self) -> &AsciiStr

impl ascii::AsMutAsciiStr for AsciiStr

pub unsafe fn as_mut_ascii_str_unchecked(self: &mut Self) -> &mut AsciiStr

impl ascii::IntoAsciiString for alloc::vec::Vec<ascii::AsciiChar>

pub fn into_ascii_string(self: Self) -> Result<AsciiString, FromAsciiError<Self>>
pub unsafe fn into_ascii_string_unchecked(self: Self) -> AsciiString

impl ascii::ToAsciiChar for AsciiChar

pub fn to_ascii_char(self: Self) -> Result<AsciiChar, ToAsciiCharError>
pub unsafe fn to_ascii_char_unchecked(self: Self) -> AsciiChar

impl core::default::Default for AsciiChar

pub fn default() -> AsciiChar

Recorded callables

<alloc::vec::Vec<ascii::AsciiChar> as From<ascii::AsciiString>>::from recorded callable · signature and safety not recorded
<ascii::AsAsciiStrError as std::error::Error>::description recorded callable · signature and safety not recorded
<ascii::AsciiStr as AsMut<[ascii::AsciiChar]>>::as_mut recorded callable · signature and safety not recorded
<ascii::AsciiStr as AsMut<ascii::AsciiStr>>::as_mut recorded callable · signature and safety not recorded
<ascii::AsciiStr as AsRef<[ascii::AsciiChar]>>::as_ref recorded callable · signature and safety not recorded
<ascii::AsciiStr as AsRef<ascii::AsciiStr>>::as_ref recorded callable · signature and safety not recorded
<ascii::AsciiString as AsMut<[ascii::AsciiChar]>>::as_mut recorded callable · signature and safety not recorded
<ascii::AsciiString as AsRef<[ascii::AsciiChar]>>::as_ref recorded callable · signature and safety not recorded
<ascii::AsciiString as From<alloc::vec::Vec<ascii::AsciiChar>>>::from recorded callable · signature and safety not recorded
<ascii::FromAsciiError as std::error::Error>::description recorded callable · signature and safety not recorded
<ascii::ToAsciiCharError as std::error::Error>::description recorded callable · signature and safety not recorded

Evidence

https://github.com/nyuichi/rust-crate-proofs/tree/64144e62d129617852e3387fbcdcc03f653c0dee

Reproduce

Toolchain source metadata: not recorded.

Run locally

git clone -- https://github.com/nyuichi/rust-crate-proofs report-28-source-1
git -C report-28-source-1 checkout --detach 64144e62d129617852e3387fbcdcc03f653c0dee
git -C report-28-source-1 submodule update --init --recursive --checkout
cd report-28-source-1/ascii/1.1.0/aeneas/2026-11-05/proofs

lake build +BorrowViewProofs +CharForwardProofs +ErrorDescriptionProofs +ErrorProjectionProofs +GenericErrorProofs +Proofs +SelfBorrowProofs +SliceProofs +StringBorrowViewProofs +StringProofs +VectorIdentityProofs

printf '%s' 'import Lean
import BorrowViewProofs
import CharForwardProofs
import ErrorDescriptionProofs
import ErrorProjectionProofs
import GenericErrorProofs
import Proofs
import SelfBorrowProofs
import SliceProofs
import StringBorrowViewProofs
import StringProofs
import VectorIdentityProofs
open Lean Elab Command

run_cmd do
  let theorem_name := `Proofs.is_ascii_blank_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_blank_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_blank_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_blank_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_digit_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_digit_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_digit_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_digit_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_whitespace_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_whitespace_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_whitespace_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_whitespace_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_control_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_control_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_control_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_control_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_alphabetic_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_alphabetic_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_alphabetic_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_alphabetic_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_alphanumeric_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_alphanumeric_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_alphanumeric_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_alphanumeric_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_graphic_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_graphic_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_graphic_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_graphic_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_printable_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_printable_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_printable_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_printable_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_lowercase_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_lowercase_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_lowercase_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_lowercase_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_uppercase_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_uppercase_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_uppercase_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_uppercase_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_hexdigit_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_hexdigit_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_hexdigit_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_hexdigit_spec"

run_cmd do
  let theorem_name := `Proofs.as_byte_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.as_byte_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.as_byte_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.as_byte_spec"

run_cmd do
  let theorem_name := `Proofs.eq_ignore_ascii_case_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.eq_ignore_ascii_case_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.eq_ignore_ascii_case_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.eq_ignore_ascii_case_spec"

run_cmd do
  let theorem_name := `Proofs.to_ascii_char_identity_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.to_ascii_char_identity_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.to_ascii_char_identity_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.to_ascii_char_identity_spec"

run_cmd do
  let theorem_name := `Proofs.to_ascii_char_unchecked_identity_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.to_ascii_char_unchecked_identity_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.to_ascii_char_unchecked_identity_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.to_ascii_char_unchecked_identity_spec"

run_cmd do
  let theorem_name := `Proofs.is_alphabetic_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_alphabetic_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_alphabetic_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_alphabetic_spec"

run_cmd do
  let theorem_name := `Proofs.is_alphanumeric_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_alphanumeric_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_alphanumeric_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_alphanumeric_spec"

run_cmd do
  let theorem_name := `Proofs.is_lowercase_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_lowercase_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_lowercase_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_lowercase_spec"

run_cmd do
  let theorem_name := `Proofs.is_uppercase_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_uppercase_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_uppercase_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_uppercase_spec"

run_cmd do
  let theorem_name := `Proofs.is_whitespace_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_whitespace_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_whitespace_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_whitespace_spec"

run_cmd do
  let theorem_name := `Proofs.is_digit_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_digit_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_digit_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_digit_spec"

run_cmd do
  let theorem_name := `Proofs.is_ascii_punctuation_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.is_ascii_punctuation_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.is_ascii_punctuation_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.is_ascii_punctuation_spec"

run_cmd do
  let theorem_name := `Proofs.default_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.default_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.default_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.default_spec"

run_cmd do
  let theorem_name := `Proofs.valid_up_to_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: Proofs.valid_up_to_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in Proofs.valid_up_to_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:Proofs.valid_up_to_spec"

run_cmd do
  let theorem_name := `StringProofs.new_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: StringProofs.new_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in StringProofs.new_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:StringProofs.new_spec"

run_cmd do
  let theorem_name := `StringProofs.len_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: StringProofs.len_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in StringProofs.len_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:StringProofs.len_spec"

run_cmd do
  let theorem_name := `StringProofs.is_empty_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: StringProofs.is_empty_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in StringProofs.is_empty_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:StringProofs.is_empty_spec"

run_cmd do
  let theorem_name := `StringProofs.push_full_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: StringProofs.push_full_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in StringProofs.push_full_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:StringProofs.push_full_spec"

run_cmd do
  let theorem_name := `SliceProofs.as_slice_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SliceProofs.as_slice_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SliceProofs.as_slice_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SliceProofs.as_slice_spec"

run_cmd do
  let theorem_name := `SliceProofs.as_mut_slice_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SliceProofs.as_mut_slice_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SliceProofs.as_mut_slice_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SliceProofs.as_mut_slice_spec"

run_cmd do
  let theorem_name := `SliceProofs.len_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SliceProofs.len_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SliceProofs.len_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SliceProofs.len_spec"

run_cmd do
  let theorem_name := `SliceProofs.is_empty_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SliceProofs.is_empty_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SliceProofs.is_empty_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SliceProofs.is_empty_spec"

run_cmd do
  let theorem_name := `SliceProofs.as_ascii_str_identity_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SliceProofs.as_ascii_str_identity_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SliceProofs.as_ascii_str_identity_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SliceProofs.as_ascii_str_identity_spec"

run_cmd do
  let theorem_name := `SliceProofs.as_ascii_str_unchecked_identity_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SliceProofs.as_ascii_str_unchecked_identity_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SliceProofs.as_ascii_str_unchecked_identity_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SliceProofs.as_ascii_str_unchecked_identity_spec"

run_cmd do
  let theorem_name := `SliceProofs.as_mut_ascii_str_unchecked_identity_spec
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SliceProofs.as_mut_ascii_str_unchecked_identity_spec"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SliceProofs.as_mut_ascii_str_unchecked_identity_spec: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SliceProofs.as_mut_ascii_str_unchecked_identity_spec"

run_cmd do
  let theorem_name := `ErrorProjectionProofs.ascii_error_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: ErrorProjectionProofs.ascii_error_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in ErrorProjectionProofs.ascii_error_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:ErrorProjectionProofs.ascii_error_exact"

run_cmd do
  let theorem_name := `ErrorProjectionProofs.into_source_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: ErrorProjectionProofs.into_source_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in ErrorProjectionProofs.into_source_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:ErrorProjectionProofs.into_source_exact"

run_cmd do
  let theorem_name := `VectorIdentityProofs.from_vector_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: VectorIdentityProofs.from_vector_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in VectorIdentityProofs.from_vector_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:VectorIdentityProofs.from_vector_exact"

run_cmd do
  let theorem_name := `VectorIdentityProofs.into_vector_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: VectorIdentityProofs.into_vector_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in VectorIdentityProofs.into_vector_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:VectorIdentityProofs.into_vector_exact"

run_cmd do
  let theorem_name := `VectorIdentityProofs.checked_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: VectorIdentityProofs.checked_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in VectorIdentityProofs.checked_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:VectorIdentityProofs.checked_exact"

run_cmd do
  let theorem_name := `VectorIdentityProofs.unchecked_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: VectorIdentityProofs.unchecked_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in VectorIdentityProofs.unchecked_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:VectorIdentityProofs.unchecked_exact"

run_cmd do
  let theorem_name := `BorrowViewProofs.as_ref_slice_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: BorrowViewProofs.as_ref_slice_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in BorrowViewProofs.as_ref_slice_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:BorrowViewProofs.as_ref_slice_exact"

run_cmd do
  let theorem_name := `BorrowViewProofs.as_mut_slice_contract
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: BorrowViewProofs.as_mut_slice_contract"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in BorrowViewProofs.as_mut_slice_contract: {ax}"
  liftIO <| IO.println "proofs.rs:checked:BorrowViewProofs.as_mut_slice_contract"

run_cmd do
  let theorem_name := `BorrowViewProofs.as_ref_self_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: BorrowViewProofs.as_ref_self_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in BorrowViewProofs.as_ref_self_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:BorrowViewProofs.as_ref_self_exact"

run_cmd do
  let theorem_name := `StringBorrowViewProofs.as_ref_slice_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: StringBorrowViewProofs.as_ref_slice_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in StringBorrowViewProofs.as_ref_slice_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:StringBorrowViewProofs.as_ref_slice_exact"

run_cmd do
  let theorem_name := `StringBorrowViewProofs.as_mut_slice_contract
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: StringBorrowViewProofs.as_mut_slice_contract"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in StringBorrowViewProofs.as_mut_slice_contract: {ax}"
  liftIO <| IO.println "proofs.rs:checked:StringBorrowViewProofs.as_mut_slice_contract"

run_cmd do
  let theorem_name := `SelfBorrowProofs.as_mut_self_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: SelfBorrowProofs.as_mut_self_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in SelfBorrowProofs.as_mut_self_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:SelfBorrowProofs.as_mut_self_exact"

run_cmd do
  let theorem_name := `ErrorDescriptionProofs.char_description_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: ErrorDescriptionProofs.char_description_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in ErrorDescriptionProofs.char_description_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:ErrorDescriptionProofs.char_description_exact"

run_cmd do
  let theorem_name := `ErrorDescriptionProofs.str_description_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: ErrorDescriptionProofs.str_description_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in ErrorDescriptionProofs.str_description_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:ErrorDescriptionProofs.str_description_exact"

run_cmd do
  let theorem_name := `CharForwardProofs.from_ascii_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: CharForwardProofs.from_ascii_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in CharForwardProofs.from_ascii_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:CharForwardProofs.from_ascii_exact"

run_cmd do
  let theorem_name := `GenericErrorProofs.description_exact
  match (← getEnv).find? theorem_name with
  | some (.thmInfo _) => pure ()
  | _ => throwError "Expected a theorem: GenericErrorProofs.description_exact"
  let axioms ← Lean.collectAxioms theorem_name
  for ax in axioms do
    unless [``propext, ``Classical.choice, ``Quot.sound].contains ax do
      throwError "Unapproved axiom in GenericErrorProofs.description_exact: {ax}"
  liftIO <| IO.println "proofs.rs:checked:GenericErrorProofs.description_exact"
' | lake env lean --stdin

Checks out the recorded source commit from GitHub. Install the report’s tool version before running.

Source on GitHub · SARIF with logs (.json)

Recorded run

Completed · 51 checks passed · 0 failed

2026-11-05T17:23:49.674808434+00:00 · 197.7 seconds · Exit code 0

Recorded on the author’s machine.

CheckResultClaim
Lean checked theorem Proofs.is_ascii_blank_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_blank_spec
PassedClaim #1
Lean checked theorem Proofs.is_ascii_digit_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_digit_spec
PassedClaim #2
Lean checked theorem Proofs.is_ascii_whitespace_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_whitespace_spec
PassedClaim #3
Lean checked theorem Proofs.is_ascii_control_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_control_spec
PassedClaim #4
Lean checked theorem Proofs.is_ascii_alphabetic_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_alphabetic_spec
PassedClaim #5
Lean checked theorem Proofs.is_ascii_alphanumeric_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_alphanumeric_spec
PassedClaim #6
Lean checked theorem Proofs.is_ascii_graphic_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_graphic_spec
PassedClaim #7
Lean checked theorem Proofs.is_ascii_printable_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_printable_spec
PassedClaim #8
Lean checked theorem Proofs.is_ascii_lowercase_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_lowercase_spec
PassedClaim #9
Lean checked theorem Proofs.is_ascii_uppercase_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_uppercase_spec
PassedClaim #10
Lean checked theorem Proofs.is_ascii_hexdigit_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_hexdigit_spec
PassedClaim #11
Lean checked theorem Proofs.as_byte_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.as_byte_spec
PassedClaim #12
Lean checked theorem Proofs.eq_ignore_ascii_case_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.eq_ignore_ascii_case_spec
PassedClaim #13
Lean checked theorem Proofs.to_ascii_char_identity_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.to_ascii_char_identity_spec
PassedClaim #14
Lean checked theorem Proofs.to_ascii_char_unchecked_identity_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.to_ascii_char_unchecked_identity_spec
PassedClaim #15
Lean checked theorem Proofs.is_alphabetic_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_alphabetic_spec
PassedClaim #16
Lean checked theorem Proofs.is_alphanumeric_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_alphanumeric_spec
PassedClaim #17
Lean checked theorem Proofs.is_lowercase_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_lowercase_spec
PassedClaim #18
Lean checked theorem Proofs.is_uppercase_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_uppercase_spec
PassedClaim #19
Lean checked theorem Proofs.is_whitespace_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_whitespace_spec
PassedClaim #20
Lean checked theorem Proofs.is_digit_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_digit_spec
PassedClaim #21
Lean checked theorem Proofs.is_ascii_punctuation_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.is_ascii_punctuation_spec
PassedClaim #22
Lean checked theorem Proofs.default_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.default_spec
PassedClaim #23
Lean checked theorem Proofs.valid_up_to_spec; axioms limited to propext, Classical.choice, Quot.sound
Proofs.valid_up_to_spec
PassedClaim #24
Lean checked theorem StringProofs.new_spec; axioms limited to propext, Classical.choice, Quot.sound
StringProofs.new_spec
PassedClaim #25
Lean checked theorem StringProofs.len_spec; axioms limited to propext, Classical.choice, Quot.sound
StringProofs.len_spec
PassedClaim #26
Lean checked theorem StringProofs.is_empty_spec; axioms limited to propext, Classical.choice, Quot.sound
StringProofs.is_empty_spec
PassedClaim #27
Lean checked theorem StringProofs.push_full_spec; axioms limited to propext, Classical.choice, Quot.sound
StringProofs.push_full_spec
PassedClaim #28
Lean checked theorem SliceProofs.as_slice_spec; axioms limited to propext, Classical.choice, Quot.sound
SliceProofs.as_slice_spec
PassedClaim #29
Lean checked theorem SliceProofs.as_mut_slice_spec; axioms limited to propext, Classical.choice, Quot.sound
SliceProofs.as_mut_slice_spec
PassedClaim #30
Lean checked theorem SliceProofs.len_spec; axioms limited to propext, Classical.choice, Quot.sound
SliceProofs.len_spec
PassedClaim #31
Lean checked theorem SliceProofs.is_empty_spec; axioms limited to propext, Classical.choice, Quot.sound
SliceProofs.is_empty_spec
PassedClaim #32
Lean checked theorem SliceProofs.as_ascii_str_identity_spec; axioms limited to propext, Classical.choice, Quot.sound
SliceProofs.as_ascii_str_identity_spec
PassedClaim #33
Lean checked theorem SliceProofs.as_ascii_str_unchecked_identity_spec; axioms limited to propext, Classical.choice, Quot.sound
SliceProofs.as_ascii_str_unchecked_identity_spec
PassedClaim #34
Lean checked theorem SliceProofs.as_mut_ascii_str_unchecked_identity_spec; axioms limited to propext, Classical.choice, Quot.sound
SliceProofs.as_mut_ascii_str_unchecked_identity_spec
PassedClaim #35
Lean checked theorem ErrorProjectionProofs.ascii_error_exact; axioms limited to propext, Classical.choice, Quot.sound
ErrorProjectionProofs.ascii_error_exact
PassedClaim #36
Lean checked theorem ErrorProjectionProofs.into_source_exact; axioms limited to propext, Classical.choice, Quot.sound
ErrorProjectionProofs.into_source_exact
PassedClaim #37
Lean checked theorem VectorIdentityProofs.from_vector_exact; axioms limited to propext, Classical.choice, Quot.sound
VectorIdentityProofs.from_vector_exact
PassedClaim #38
Lean checked theorem VectorIdentityProofs.into_vector_exact; axioms limited to propext, Classical.choice, Quot.sound
VectorIdentityProofs.into_vector_exact
PassedClaim #39
Lean checked theorem VectorIdentityProofs.checked_exact; axioms limited to propext, Classical.choice, Quot.sound
VectorIdentityProofs.checked_exact
PassedClaim #40
Lean checked theorem VectorIdentityProofs.unchecked_exact; axioms limited to propext, Classical.choice, Quot.sound
VectorIdentityProofs.unchecked_exact
PassedClaim #41
Lean checked theorem BorrowViewProofs.as_ref_slice_exact; axioms limited to propext, Classical.choice, Quot.sound
BorrowViewProofs.as_ref_slice_exact
PassedClaim #42
Lean checked theorem BorrowViewProofs.as_mut_slice_contract; axioms limited to propext, Classical.choice, Quot.sound
BorrowViewProofs.as_mut_slice_contract
PassedClaim #43
Lean checked theorem BorrowViewProofs.as_ref_self_exact; axioms limited to propext, Classical.choice, Quot.sound
BorrowViewProofs.as_ref_self_exact
PassedClaim #44
Lean checked theorem StringBorrowViewProofs.as_ref_slice_exact; axioms limited to propext, Classical.choice, Quot.sound
StringBorrowViewProofs.as_ref_slice_exact
PassedClaim #45
Lean checked theorem StringBorrowViewProofs.as_mut_slice_contract; axioms limited to propext, Classical.choice, Quot.sound
StringBorrowViewProofs.as_mut_slice_contract
PassedClaim #46
Lean checked theorem SelfBorrowProofs.as_mut_self_exact; axioms limited to propext, Classical.choice, Quot.sound
SelfBorrowProofs.as_mut_self_exact
PassedClaim #47
Lean checked theorem ErrorDescriptionProofs.char_description_exact; axioms limited to propext, Classical.choice, Quot.sound
ErrorDescriptionProofs.char_description_exact
PassedClaim #48
Lean checked theorem ErrorDescriptionProofs.str_description_exact; axioms limited to propext, Classical.choice, Quot.sound
ErrorDescriptionProofs.str_description_exact
PassedClaim #49
Lean checked theorem CharForwardProofs.from_ascii_exact; axioms limited to propext, Classical.choice, Quot.sound
CharForwardProofs.from_ascii_exact
PassedClaim #50
Lean checked theorem GenericErrorProofs.description_exact; axioms limited to propext, Classical.choice, Quot.sound
GenericErrorProofs.description_exact
PassedClaim #51
Execution details
Started
2026-11-05T17:23:49.674808434+00:00
Finished
2026-11-05T17:27:07.333851293+00:00
Platform
linux x86_64
Rust compiler
rustc 1.100.0-nightly (923c95cdf 2026-09-16) binary: rustc commit-hash: 923c95cdf5ba65cea505aa2ea829f578e1506ed8 commit-date: 2026-09-16 host: x86_64-unknown-linux-gnu release: 1.100.0-nightly LLVM version: 23.1.1
Working directory
ascii/1.1.0/aeneas/2026-11-05/proofs
Environment overrides
None recorded
Git repository
https://github.com/nyuichi/rust-crate-proofs
Git commit
64144e62d129617852e3387fbcdcc03f653c0dee
Diagnostics & logs
=== stdout ===
⚠ [2/57] Ran aeneas:extraDep
warning: building from source; failed to fetch GitHub release (run with '-v' for details)
✔ [3/178] Built AeneasMeta.Simp.RegisterCommand (40s)
✔ [123/397] Built AeneasMeta.BvEnumToBitVec (40s)
✔ [343/712] Built Aeneas.Std.Global (40s)
✔ [344/712] Built AeneasMeta.UtilsCore (40s)
✔ [1575/1809] Built AeneasMeta.OptionConfig (41s)
✔ [1797/1809] Built Generated.Ascii (2.9s)
ℹ [1798/1809] Built SelfBorrowProofs (3.1s)
info: SelfBorrowProofs.lean:14:0: 'SelfBorrowProofs.as_mut_self_exact' depends on axioms: [propext, Quot.sound]
info: SelfBorrowProofs.lean:15:0: 'SelfBorrowProofs.same_length_writeback' depends on axioms: [propext, Quot.sound]
⚠ [1799/1809] Built VectorIdentityProofs (3.2s)
warning: VectorIdentityProofs.lean:8:178: This simp argument is unused:
  bind_tc_ok

Hint: Omit it from the simp argument list.
  [apply] simp [ascii.alloc.vec.VecAsciiChar.Insts.AsciiAscii_stringIntoAsciiString.into_ascii_string,
    ascii.ascii_string.AsciiString.Insts.CoreConvertFromVecAsciiChar.from, Std.bind_ok]

Note: This linter can be disabled with `set_option linter.unusedSimpArgs false`
info: VectorIdentityProofs.lean:13:0: 'VectorIdentityProofs.from_vector_exact' depends on axioms: [propext, Quot.sound]
info: VectorIdentityProofs.lean:14:0: 'VectorIdentityProofs.checked_exact' depends on axioms: [propext, Classical.choice, Quot.sound]
info: VectorIdentityProofs.lean:15:0: 'VectorIdentityProofs.unchecked_exact' depends on axioms: [propext, Quot.sound]
info: VectorIdentityProofs.lean:17:0: 'VectorIdentityProofs.into_vector_exact' depends on axioms: [propext, Quot.sound]
⚠ [1800/1809] Built StringProofs (3.5s)
warning: StringProofs.lean:16:37: Local variable 'c' resembles constructor 'ascii.ascii_char.AsciiChar.c' - write '.c' (with a dot) or 'ascii.ascii_char.AsciiChar.c' to use the constructor.

Note: This linter can be disabled with `set_option linter.constructorNameAsVariable false`
warning: StringProofs.lean:22:45: Local variable 'c' resembles constructor 'ascii.ascii_char.AsciiChar.c' - write '.c' (with a dot) or 'ascii.ascii_char.AsciiChar.c' to use the constructor.

Note: This linter can be disabled with `set_option linter.constructorNameAsVariable false`
warning: StringProofs.lean:27:20: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: StringProofs.lean:27:20: Used `tac1 <;> tac2` where `(tac1; tac2)` would suffice

Note: This linter can be disabled with `set_option linter.unnecessarySeqFocus false`
warning: StringProofs.lean:28:42: Local variable 'c' resembles constructor 'ascii.ascii_char.AsciiChar.c' - write '.c' (with a dot) or 'ascii.ascii_char.AsciiChar.c' to use the constructor.

Note: This linter can be disabled with `set_option linter.constructorNameAsVariable false`
info: StringProofs.lean:37:0: 'StringProofs.new_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: StringProofs.lean:38:0: 'StringProofs.len_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: StringProofs.lean:39:0: 'StringProofs.is_empty_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: StringProofs.lean:40:0: 'StringProofs.push_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: StringProofs.lean:41:0: 'StringProofs.push_maximum_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: StringProofs.lean:43:0: 'StringProofs.push_full_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
ℹ [1801/1809] Built StringBorrowViewProofs (3.8s)
info: StringBorrowViewProofs.lean:25:0: 'StringBorrowViewProofs.as_ref_slice_exact' depends on axioms: [propext, Classical.choice, Quot.sound]
info: StringBorrowViewProofs.lean:26:0: 'StringBorrowViewProofs.as_mut_slice_contract' depends on axioms: [propext, Classical.choice, Quot.sound]
ℹ [1802/1809] Built GenericErrorProofs (3.8s)
info: GenericErrorProofs.lean:10:0: 'GenericErrorProofs.description_exact' depends on axioms: [propext, Classical.choice, Quot.sound]
ℹ [1803/1809] Built SliceProofs (3.9s)
info: SliceProofs.lean:33:0: 'SliceProofs.as_slice_spec' depends on axioms: [propext, Quot.sound]
info: SliceProofs.lean:34:0: 'SliceProofs.as_mut_slice_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: SliceProofs.lean:35:0: 'SliceProofs.len_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: SliceProofs.lean:36:0: 'SliceProofs.is_empty_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: SliceProofs.lean:38:0: 'SliceProofs.as_ascii_str_identity_spec' depends on axioms: [propext, Quot.sound]
info: SliceProofs.lean:39:0: 'SliceProofs.as_ascii_str_unchecked_identity_spec' depends on axioms: [propext, Quot.sound]
info: SliceProofs.lean:40:0: 'SliceProofs.as_mut_ascii_str_unchecked_identity_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
ℹ [1804/1809] Built ErrorDescriptionProofs (3.3s)
info: ErrorDescriptionProofs.lean:14:0: 'ErrorDescriptionProofs.char_description_exact' depends on axioms: [propext, Classical.choice, Quot.sound]
info: ErrorDescriptionProofs.lean:15:0: 'ErrorDescriptionProofs.str_description_exact' depends on axioms: [propext, Classical.choice, Quot.sound]
ℹ [1805/1809] Built ErrorProjectionProofs (5.0s)
info: ErrorProjectionProofs.lean:12:0: 'ErrorProjectionProofs.ascii_error_exact' depends on axioms: [propext, Quot.sound]
info: ErrorProjectionProofs.lean:13:0: 'ErrorProjectionProofs.into_source_exact' depends on axioms: [propext, Quot.sound]
ℹ [1806/1809] Built CharForwardProofs (2.8s)
info: CharForwardProofs.lean:9:0: 'CharForwardProofs.from_ascii_exact' depends on axioms: [propext, Quot.sound]
info: CharForwardProofs.lean:10:0: 'CharForwardProofs.from_ascii_return' depends on axioms: [propext, Quot.sound]
ℹ [1807/1809] Built BorrowViewProofs (3.1s)
info: BorrowViewProofs.lean:23:0: 'BorrowViewProofs.as_ref_slice_exact' depends on axioms: [propext, Quot.sound]
info: BorrowViewProofs.lean:24:0: 'BorrowViewProofs.as_ref_self_exact' depends on axioms: [propext, Quot.sound]
info: BorrowViewProofs.lean:25:0: 'BorrowViewProofs.as_mut_slice_contract' depends on axioms: [propext, Quot.sound]
⚠ [1808/1809] Built DigitProofs (47s)
warning: DigitProofs.lean:145:16: Local variable 'c' resembles constructor 'ascii.ascii_char.AsciiChar.c' - write '.c' (with a dot) or 'ascii.ascii_char.AsciiChar.c' to use the constructor.

Note: This linter can be disabled with `set_option linter.constructorNameAsVariable false`
warning: DigitProofs.lean:152:18: Local variable 'c' resembles constructor 'ascii.ascii_char.AsciiChar.c' - write '.c' (with a dot) or 'ascii.ascii_char.AsciiChar.c' to use the constructor.

Note: This linter can be disabled with `set_option linter.constructorNameAsVariable false`
warning: DigitProofs.lean:157:31: Local variable 'c' resembles constructor 'ascii.ascii_char.AsciiChar.c' - write '.c' (with a dot) or 'ascii.ascii_char.AsciiChar.c' to use the constructor.

Note: This linter can be disabled with `set_option linter.constructorNameAsVariable false`
warning: DigitProofs.lean:165:39: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: DigitProofs.lean:165:43: Unused tactic linter: `scalar_tac` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: DigitProofs.lean:165:43: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: DigitProofs.lean:167:29: Local variable 'c' resembles constructor 'ascii.ascii_char.AsciiChar.c' - write '.c' (with a dot) or 'ascii.ascii_char.AsciiChar.c' to use the constructor.

Note: This linter can be disabled with `set_option linter.constructorNameAsVariable false`
info: DigitProofs.lean:175:0: 'DigitProofs.is_digit_success_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: DigitProofs.lean:176:0: 'DigitProofs.is_digit_panic_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
⚠ [1809/1809] Built Proofs (53s)
warning: Proofs.lean:142:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:142:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:142:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:144:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:144:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:144:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:146:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:146:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:146:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:148:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:148:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:148:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:150:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:150:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:150:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:152:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:152:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:152:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:154:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:154:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:154:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:159:33: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:159:37: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:159:37: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:161:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:161:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:161:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:163:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:163:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:163:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:165:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:165:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:165:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:167:629: Unused tactic linter: `<;>` should be replaced with `;` or be removed.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:167:633: Unused tactic linter: `(simp only [UScalar.val, UScalarTy.U8_numBits_eq] <;> decide)` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
warning: Proofs.lean:167:633: this tactic is never executed

Note: This linter can be disabled with `set_option linter.unreachableTactic false`
warning: Proofs.lean:190:3: Unused tactic linter: `exact hprop` does nothing.

Note: This linter can be disabled with `set_option linter.unusedTactic false`
info: Proofs.lean:227:0: 'Proofs.as_byte_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:228:0: 'Proofs.is_ascii_blank_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:229:0: 'Proofs.is_ascii_digit_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:230:0: 'Proofs.is_ascii_whitespace_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:231:0: 'Proofs.is_ascii_control_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:232:0: 'Proofs.is_ascii_alphabetic_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:233:0: 'Proofs.is_ascii_alphanumeric_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:234:0: 'Proofs.is_ascii_graphic_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:235:0: 'Proofs.is_ascii_printable_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:236:0: 'Proofs.is_ascii_lowercase_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:237:0: 'Proofs.is_ascii_uppercase_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:238:0: 'Proofs.is_ascii_hexdigit_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:239:0: 'Proofs.eq_ignore_ascii_case_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:240:0: 'Proofs.to_ascii_char_identity_spec' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:241:0: 'Proofs.to_ascii_char_unchecked_identity_spec' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:242:0: 'Proofs.caseEqBits' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:243:0: 'Proofs.is_alphabetic_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:244:0: 'Proofs.is_alphanumeric_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:245:0: 'Proofs.is_lowercase_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:246:0: 'Proofs.is_uppercase_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:247:0: 'Proofs.is_whitespace_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:249:0: 'Proofs.is_digit_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:251:0: 'Proofs.is_ascii_punctuation_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:252:0: 'Proofs.default_spec' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:253:0: 'Proofs.valid_up_to_spec' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:255:0: 'StringProofs.new_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:256:0: 'StringProofs.len_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:257:0: 'StringProofs.is_empty_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:258:0: 'StringProofs.push_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:259:0: 'StringProofs.push_maximum_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:260:0: 'StringProofs.push_full_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:262:0: 'SliceProofs.as_slice_spec' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:263:0: 'SliceProofs.as_mut_slice_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:264:0: 'SliceProofs.len_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:265:0: 'SliceProofs.is_empty_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
info: Proofs.lean:267:0: 'SliceProofs.as_ascii_str_identity_spec' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:268:0: 'SliceProofs.as_ascii_str_unchecked_identity_spec' depends on axioms: [propext, Quot.sound]
info: Proofs.lean:269:0: 'SliceProofs.as_mut_ascii_str_unchecked_identity_spec' depends on axioms: [propext, Classical.choice, Quot.sound]
Build completed successfully (1809 jobs).

$ lake env lean --stdin (proofs.rs theorem/axiom audit)
proofs.rs:checked:Proofs.is_ascii_blank_spec
proofs.rs:checked:Proofs.is_ascii_digit_spec
proofs.rs:checked:Proofs.is_ascii_whitespace_spec
proofs.rs:checked:Proofs.is_ascii_control_spec
proofs.rs:checked:Proofs.is_ascii_alphabetic_spec
proofs.rs:checked:Proofs.is_ascii_alphanumeric_spec
proofs.rs:checked:Proofs.is_ascii_graphic_spec
proofs.rs:checked:Proofs.is_ascii_printable_spec
proofs.rs:checked:Proofs.is_ascii_lowercase_spec
proofs.rs:checked:Proofs.is_ascii_uppercase_spec
proofs.rs:checked:Proofs.is_ascii_hexdigit_spec
proofs.rs:checked:Proofs.as_byte_spec
proofs.rs:checked:Proofs.eq_ignore_ascii_case_spec
proofs.rs:checked:Proofs.to_ascii_char_identity_spec
proofs.rs:checked:Proofs.to_ascii_char_unchecked_identity_spec
proofs.rs:checked:Proofs.is_alphabetic_spec
proofs.rs:checked:Proofs.is_alphanumeric_spec
proofs.rs:checked:Proofs.is_lowercase_spec
proofs.rs:checked:Proofs.is_uppercase_spec
proofs.rs:checked:Proofs.is_whitespace_spec
proofs.rs:checked:Proofs.is_digit_spec
proofs.rs:checked:Proofs.is_ascii_punctuation_spec
proofs.rs:checked:Proofs.default_spec
proofs.rs:checked:Proofs.valid_up_to_spec
proofs.rs:checked:StringProofs.new_spec
proofs.rs:checked:StringProofs.len_spec
proofs.rs:checked:StringProofs.is_empty_spec
proofs.rs:checked:StringProofs.push_full_spec
proofs.rs:checked:SliceProofs.as_slice_spec
proofs.rs:checked:SliceProofs.as_mut_slice_spec
proofs.rs:checked:SliceProofs.len_spec
proofs.rs:checked:SliceProofs.is_empty_spec
proofs.rs:checked:SliceProofs.as_ascii_str_identity_spec
proofs.rs:checked:SliceProofs.as_ascii_str_unchecked_identity_spec
proofs.rs:checked:SliceProofs.as_mut_ascii_str_unchecked_identity_spec
proofs.rs:checked:ErrorProjectionProofs.ascii_error_exact
proofs.rs:checked:ErrorProjectionProofs.into_source_exact
proofs.rs:checked:VectorIdentityProofs.from_vector_exact
proofs.rs:checked:VectorIdentityProofs.into_vector_exact
proofs.rs:checked:VectorIdentityProofs.checked_exact
proofs.rs:checked:VectorIdentityProofs.unchecked_exact
proofs.rs:checked:BorrowViewProofs.as_ref_slice_exact
proofs.rs:checked:BorrowViewProofs.as_mut_slice_contract
proofs.rs:checked:BorrowViewProofs.as_ref_self_exact
proofs.rs:checked:StringBorrowViewProofs.as_ref_slice_exact
proofs.rs:checked:StringBorrowViewProofs.as_mut_slice_contract
proofs.rs:checked:SelfBorrowProofs.as_mut_self_exact
proofs.rs:checked:ErrorDescriptionProofs.char_description_exact
proofs.rs:checked:ErrorDescriptionProofs.str_description_exact
proofs.rs:checked:CharForwardProofs.from_ascii_exact
proofs.rs:checked:GenericErrorProofs.description_exact

=== stderr ===
info: aeneas: materializing new dependency
info: aeneas: fetching revision 'be86ab0f1989d04944292b345b24c435be3ad10a' from https://github.com/AeneasVerif/aeneas
info: aeneas: checking out revision 'be86ab0f1989d04944292b345b24c435be3ad10a'
info: mathlib: materializing new dependency
info: mathlib: fetching revision '56a005855ea17e0b0958f73ec801ae140b0a1679' from https://github.com/leanprover-community/mathlib4.git
info: mathlib: checking out revision '56a005855ea17e0b0958f73ec801ae140b0a1679'
info: plausible: materializing new dependency
info: plausible: fetching revision 'dfa4f38190d07c37e315953e08b90fe2d95b3c24' from https://github.com/leanprover-community/plausible
info: plausible: checking out revision 'dfa4f38190d07c37e315953e08b90fe2d95b3c24'
info: LeanSearchClient: materializing new dependency
info: LeanSearchClient: fetching revision 'd6b4c7be5be75ec4917c873ac50c756dc1436372' from https://github.com/leanprover-community/LeanSearchClient
info: LeanSearchClient: checking out revision 'd6b4c7be5be75ec4917c873ac50c756dc1436372'
info: importGraph: materializing new dependency
info: importGraph: fetching revision 'a41f0e9a4dea23188ea9cc1c41ac9f8bbafe0b93' from https://github.com/leanprover-community/import-graph
info: importGraph: checking out revision 'a41f0e9a4dea23188ea9cc1c41ac9f8bbafe0b93'
info: proofwidgets: materializing new dependency
info: proofwidgets: fetching revision 'df72b022e558978a1c50264cfc4d7fec86fa8e04' from https://github.com/leanprover-community/ProofWidgets4
info: proofwidgets: checking out revision 'df72b022e558978a1c50264cfc4d7fec86fa8e04'
info: aesop: materializing new dependency
info: aesop: fetching revision '4a174c490d8707121c4a9290800489f105d85e07' from https://github.com/leanprover-community/aesop
info: aesop: checking out revision '4a174c490d8707121c4a9290800489f105d85e07'
info: Qq: materializing new dependency
info: Qq: fetching revision 'dce0ad79c486cb1fb504af04f953c3466b0c6db8' from https://github.com/leanprover-community/quote4
info: Qq: checking out revision 'dce0ad79c486cb1fb504af04f953c3466b0c6db8'
info: batteries: materializing new dependency
info: batteries: fetching revision '66e469188fe07963e5cf666c7d4433f45b8131c5' from https://github.com/leanprover-community/batteries
info: batteries: checking out revision '66e469188fe07963e5cf666c7d4433f45b8131c5'
info: Cli: materializing new dependency
info: Cli: fetching revision 'c24fe6078c630e89b489bffe59b3e20ac30d12c8' from https://github.com/leanprover/lean4-cli
info: Cli: checking out revision 'c24fe6078c630e89b489bffe59b3e20ac30d12c8'
Environment

Original crates.io ascii 1.1.0 Rust files and Cargo.toml, archive-compared; default features, x86_64-unknown-linux-gnu. The upstream bindings_with_variant_name lint is disabled through RUSTFLAGS and corresponding official rustdoc doctest-build arguments, without source changes. Rust nightly-2026-09-17, Charon 08d7c9d50144bd84848212c24701253585e90d1f, Aeneas be86ab0f1989d04944292b345b24c435be3ad10a, Lean 4.35.0. One union extraction supplies all fifty-one API proofs, with full normal/panic radix partitioning in DigitProofs. Panic message payloads are not specified; the generated failure code for the out-of-range branch is assertionFailure. The independent casefold equivalence is checked by Lean kernel reduction over Fin 128 pairs, without native_decide/bv_decide trust. Separate original conversion body checks use Kani 0.68.0, CBMC 6.11.0 and nightly-2026-08-21; source/archive and direct path-dependency provenance are recorded in evidence/kani-conversions. Supplemental scalar30 and unchecked5 evidence is preserved under evidence/kani-scalar35 with immutable producer manifests, raw successful logs and independent reviews; it uses the same Kani 0.68/CBMC 6.11/nightly-2026-08-21 default x86_64 configuration. Separate Error2/Default1 raw logs, original archives and both independent reviews are retained under evidence/kani-error-default3; Kani0.68/CBMC6.11/nightly2026-08-21,55checks0failed. All prior51 mappings and scalar35 supplemental evidence remain retained.

What is trusted

Borrowed slice contracts use the generated value and backward-function semantics. They do not independently establish Rust pointer identity, lifetime or aliasing rules, and no resizing through a mutable slice is claimed. The Rust compiler, official Charon/Aeneas translation, standard-library scalar models and Lean kernel are trusted. Proofs split the complete finite AsciiChar type and use kernel-checked logical reduction and proved scalar arithmetic, without native-evaluation trust. The byte-code table contains each actual ASCII variant in code order. Transitive axioms are limited to propext, Classical.choice and Quot.sound; no custom models or local axioms are introduced. Separate Kani body checks trust Kani/CBMC, their standard/intrinsic semantics and their pinned Rust compiler; no mechanized cross-tool equivalence is claimed. Vector guarantees use the official Vec model of an element sequence and a usize length bound; it contains no allocator, capacity or allocation-address state. Normal-result equalities are established in that abstraction for valid model inputs. The four inspected typed-vector Rust bodies only wrap or move the stored vector; these results are not a general allocator/OOM or Rust memory-safety proof. Generic delegation additionally assumes the supplied Lean trait dictionary corresponds to the Rust implementation. Rust Drop/destructor behavior, captured or external effects and callback termination are not established by the forwarding equation.

Technical limitations

Fifty-one API mappings are Lean-proved; the other explicitly described scalar/case results are separate Kani body checks. The unsafe identity results cover only ToAsciiChar for AsciiChar, AsAsciiStr/AsMutAsciiStr for an existing AsciiStr, and IntoAsciiString for the original default-allocator Vec<AsciiChar>. Inputs must already be valid Rust values of those exact types. Those identity proofs do not cover unchecked scalar conversions; the separate five Kani scalar contracts cover only the documented 0..127 safety domain. They do not cover unchecked byte slices, str, Vec<u8> or other implementations, and do not independently establish general pointer, lifetime or allocator safety. The Lean mathematical code-fold is not a proof of the separate case-conversion APIs; those original bodies instead have the separately recorded full-domain Kani checks. General input validation, the remaining AsciiStr/AsciiString APIs, allocation, serde and arbitrary unsafe conversions remain unproved. The official Vec model stores only element sequences and a length bound. It does not represent capacity, Rust isizeMAX allocation limits, allocator availability, OS failure or OOM. Thus the push result and failure partition are properties of that model; no exact physical allocation/panic behavior or capacity preservation is claimed. Case conversion and printable-picture behavior have separate Kani evidence, not Lean proofs. Invalid enum representations are outside the input domain. The original is_digit_strange_radixes test fails on the pinned modern Rust because char::is_digit panics at radix 0/1; the crate is_digit API is covered separately for all radix values; the failed test comparison invokes std char::is_digit at radix 0/1. Remaining original tests pass with only that test excluded. The five checked scalar conversion bodies and the stated case/character bodies have separate Kani evidence, rather than additional Lean claims. The original AsciiChar::new constructor is checked only on ASCII inputs by the generator; its non-ASCII panic domain remains unproved. All-feature/no-default configurations and other targets were not proved. The four typed-vector claims exclude Vec<u8>, other Vec element/allocator types and all other From/IntoAsciiString implementations. Vector length and element contents are represented, while capacity, allocation addresses and physical allocation behavior are not. These results establish no guarantee for the distinct Vec<u8> implementations or other element types. The generic from_ascii delegation does not independently prove any arbitrary ToAsciiChar implementation validates or terminates. The generic Error description constant does not validate its stored index or owner. The new scalar Kani dependency copies contain archive-identical runtime src9 and Cargo.toml, but omit archive-root tests.rs; crate tests were not run for these supplemental checks. Full package restoration and general unsafe-call safety outside the documented domain are not claimed. The Error2/Default1 checks use default x86_64 Kani and the original runtime src9/Cargo.toml, with root tests.rs absent and not run. They do not establish pointer address identity, general alias/lifetime semantics, other configurations/targets or const evaluation. The manual static-reference Default is distinct from derived AsciiString Default and from AsciiString::new.

Tool limitations

Lean backend only, requiring cargo-proofs 0.4.0 or later. The version identifies the official Aeneas Git revision pinned in lake-manifest.json (backends/lean); this revision uses Lean 4.35.0. The recorder checks committed Lean theorem declarations and permits only propext, Classical.choice, and Quot.sound as transitive axioms. It rejects sorryAx and custom axioms, including axiomatized external models. Charon/Aeneas extraction is not rerun. The author must review that the committed functional model matches the recorded Rust source, that the named theorem corresponds to the public API, and that the reported precondition matches the theorem. A checked theorem alone does not establish those links or the adequacy of the specification. The current adapter records the default Cargo configuration, with ordinary Lean module paths and a pinned official Git dependency. Other backends, custom Lake source directories, and local-path Aeneas dependencies are unsupported. See https://proofs.rs/book/aeneas.html and https://github.com/AeneasVerif/aeneas/tree/be86ab0f1989d04944292b345b24c435be3ad10a.

Updated 2026-10-16 00:00 UTC

Aeneas be86ab0f1989d04944292b345b24c435be3ad10a — version details

Dependencies (2)

CrateReports
serde ^1.0.25 · optional—
serde_test ^1.0 · optional—

Comments (0)

No comments.

Sign in to comment.