{"id":"formalization-ladder","title":"The Formalization Ladder","subtitle":"L0 receipts to L3 verified routing: making the proof kernel part of the research loop, with typed claim-shapes replacing threshold theater.","category":"formalization","tags":["lean","verification","methodology"],"source":"articles/docs/formalization-ladder.md","lang":"en","words":468,"readMinutes":2,"toc":[{"depth":2,"text":"The gap this closes","id":"the-gap-this-closes"},{"depth":2,"text":"The ladder","id":"the-ladder"},{"depth":2,"text":"Typed claim-shapes as registration","id":"typed-claim-shapes-as-registration"},{"depth":2,"text":"Non-goals (for now)","id":"non-goals-for-now"},{"depth":2,"text":"Ratchet rule","id":"ratchet-rule"}],"html":"<h1 id=\"the-formalization-ladder-making-proof-part-of-the-loop\">The Formalization Ladder — making proof part of the loop</h1><blockquote>\n<p>Status: design note, 2026-07-02. Owner: research loop. Companion to\n<code>docs/plans/y-matrix-confirmatory-results-2026-07-01.md</code> (process note) and\nthe lean-spec Theory layer.</p>\n</blockquote>\n<h2 id=\"the-gap-this-closes\">The gap this closes</h2><p>Today&#39;s generated theorems are <strong>receipts</strong>: decidable comparisons of two\nconstants computed in Python (<code>theorem ... : 170 ≤ 250 := by decide</code>). The\nkernel certifies the final inequality; the meaning (what was measured, how the\nmedian was taken, which null was used) lives in docstrings and in unverified\nPython. The modules are generated after the science and sit outside the lake\nbuild. Formalization is a stamp at the end of the loop, not a load-bearing\npart of it.</p>\n<h2 id=\"the-ladder\">The ladder</h2><p><strong>L0 — receipt theorems (current).</strong> Scalar facts, post-hoc, outside CI.\nValue: tamper-evidence for endpoints. Limit: nothing composes; analysis\nuntrusted.</p>\n<p><strong>L1 — the corpus builds.</strong> Generated evidence modules are part of the\nlean-spec lake build and CI. Every commit re-verifies every standing claim;\na broken or stale module fails the build instead of rotting silently.\n(Closes audit finding &quot;evidence-derived modules outside build graph&quot;.)</p>\n<p><strong>L2 — evidence as data, analysis in the kernel.</strong> A typed\n<code>Lupine.Evidence.Cell</code> structure (material, model, family, property,\npredicted, reference — integer-scaled); the bound dataset embedded as Lean\nterms by the generator; and the summary statistics <em>recomputed inside Lean</em>:\nmedians, ratios, per-family counts proven about the embedded dataset via\n<code>decide</code>/<code>native_decide</code>. Python becomes a proposer; the kernel checks the\ncomputation, not just the endpoint. The Python and Lean numbers must agree or\nthe module fails to build — a machine-checked replication of the analysis.</p>\n<p><strong>L3 — theory consumes evidence.</strong> The Theory layer&#39;s objects take L2 data as\nwitnesses: softening as a typed bias/variance decomposition (Round 2&#39;s\nfinding becomes a term, not a paragraph); non-transfer facts as <code>Prop</code>s;\nthe correction routing table (&quot;gearbox&quot;) as a structure whose well-formedness\nrequires an improvement witness for every routed gear and a non-transfer\nwitness for every interlock. Routing decisions become type-checkable.</p>\n<h2 id=\"typed-claim-shapes-as-registration\">Typed claim-shapes as registration</h2><p>Thresholded pass/kill registration is retired for exploratory work (process\nnote, 2026-07-02). Its replacement at L2/L3: before an experiment runs, define\nthe <strong>claim-shape</strong> — the Lean type of the fact the experiment could\nestablish. The experiment then either produces a witness or does not. This\nkeeps registration&#39;s honesty (the shape is fixed before the data) without its\ntheater (no invented numeric thresholds); and reserved threshold registration\nremains only for interested-party claims (operator uplift) and\npublication-bound claims.</p>\n<h2 id=\"non-goals-for-now\">Non-goals (for now)</h2><ul>\n<li>Proving physics (DFT correctness, BM3 fitting theory) — out of scope; the\nkernel checks data-analysis arithmetic, not quantum mechanics.</li>\n<li>Replacing the ledger — D1 remains the operational corpus; Lean is the\nverification layer. The two must reference each other (atlas_theorems\nrevision fix, audit finding).</li>\n</ul>\n<h2 id=\"ratchet-rule\">Ratchet rule</h2><p>Each new evidence family enters at the highest rung the tooling supports at\nthe time, and never below L1 once L1 lands. The ladder only ratchets upward.</p>\n"}