{"title": "What the evidence means",
 "producer": ["docs/site/guides/03-evidence.md"],
 "format": "effect4-document/1",
 "body":
 [{"line":
   [{"text":
     "This guide explains how to interpret formal evidence across Effect4. It covers theorems, planned goals, theorems proved modulo goals, the trust ceiling on axioms, and why claims restrict to explicit fragments and observations."}],
   "kind": "para"},
  {"title": "The standard of proof",
   "kind": "part",
   "key": "proof-standard",
   "body":
   [{"line":
     [{"text":
       "Effect4 states its runtime semantics as Lean definitions. Every claim in the semantics registry names the theorem that states it ("},
      {"code": "tools/ProofGraph/Registry.lean"},
      {"text": ")."}],
     "kind": "para"},
    {"line":
     [{"text":
       "No status is written by hand. The semantics report reads each theorem's proof in the built Lean environment and derives its status: proved, modulo or a planned goal."}],
     "kind": "para"}]},
  {"title": "Theorems and verified claims",
   "kind": "part",
   "key": "theorems",
   "body":
   [{"line":
     [{"text":
       "A theorem is a Lean declaration whose type is a proposition, accepted by the kernel within the trust ceiling."}],
     "kind": "para"},
    {"line":
     [{"text":
       "When a claim points to a theorem whose proof depends on no planned goals, the site marks the claim "},
      {"status": "proved"},
      {"text": "."}],
     "kind": "para"},
    {"line":
     [{"text":
       "A proved theorem guarantees its conclusion whenever its hypotheses hold. However, theorems remain conditional on stated premises and do not establish facts outside their formal boundaries."}],
     "kind": "para"}]},
  {"title": "Planned goals and open obligations",
   "kind": "part",
   "key": "planned-goals",
   "body":
   [{"line":
     [{"text": "A planned goal is a theorem declared by "},
      {"code": "proof_goal"},
      {"text": " with a "},
      {"code": "sorry"},
      {"text":
       " body. It places a question in the theory before its proof exists (decisions row 203)."}],
     "kind": "para"},
    {"line":
     [{"text":
       "The site marks a claim that points to such a declaration as a "},
      {"status": "goal"},
      {"text": "."}],
     "kind": "para"},
    {"line":
     [{"text":
       "Planned goals allow developers to state and verify downstream theorems before completing upstream proofs. Having no open planned goals does not mean the semantics is finished."}],
     "kind": "para"}]},
  {"title": "Proofs modulo planned goals",
   "kind": "part",
   "key": "proofs-modulo",
   "body":
   [{"line":
     [{"text":
       "A theorem is proved modulo when its proof path reaches one or more planned goals. The site marks claims backed by such theorems as "},
      {"status": "modulo"},
      {"text": "."}],
     "kind": "para"},
    {"line": [{"text": "A theorem proved modulo:"}], "kind": "para"},
    {"lines":
     [[{"text":
        "is checked by the kernel now, with each goal it uses taken as given;"}],
      [{"text":
        "becomes proved, with no change to its own proof, once every goal it rests on is proved;"}],
      [{"text": "names the goals it rests on, which "},
       {"code": "#plan_status"},
       {"text": " lists."}]],
     "kind": "items"},
    {"line":
     [{"text":
       "The open work part of the semantics pages lists each planned goal and the theorems that rest on it."}],
     "kind": "para"}]},
  {"title": "The trust ceiling on axioms",
   "kind": "part",
   "key": "trust-ceiling",
   "body":
   [{"line":
     [{"text":
       "The repository enforces a strict trust ceiling on all proof declarations. The allowed axioms are "},
      {"code": "propext"},
      {"text": " (propositional extensionality) and "},
      {"code": "Quot.sound"},
      {"text": " (quotient soundness)."}],
     "kind": "para"},
    {"line":
     [{"text": "An automated axiom gate checks every declaration in "},
      {"code": "Effect4"},
      {"text": " and "},
      {"code": "Test"},
      {"text": ":"}],
     "kind": "para"},
    {"lines":
     [[{"text": "The gate rejects "},
       {"code": "sorry"},
       {"text": " outside declared planned goal bodies."}],
      [{"text": "The gate rejects "},
       {"code": "partial"},
       {"text": ", "},
       {"code": "unsafe"},
       {"text": ", and "},
       {"code": "native_decide"},
       {"text": "."}],
      [{"text": "The gate rejects undeclared axioms, "},
       {"code": "extern"},
       {"text": ", and bodyless "},
       {"code": "opaque"},
       {"text": " constants."}]],
     "kind": "items"},
    {"line":
     [{"text":
       "So a proved claim rests on Lean's kernel and those two axioms, and on no postulate of the repository."}],
     "kind": "para"}]},
  {"title": "Fragments and observations",
   "kind": "part",
   "key": "fragments-and-observations",
   "body":
   [{"line":
     [{"text":
       "No theorem in Effect4 relates two behaviours without naming the observation it compares. Each such theorem also names the fragment of programs it holds on."}],
     "kind": "para"},
    {"line":
     [{"text":
       "A fragment defines a restricted set of programs or tapes where a theorem applies:"}],
     "kind": "para"},
    {"lines":
     [[{"code": "Straight"},
       {"text": " ("},
       {"code": "src/Effect4/Program/Fragment.lean"},
       {"text": ") admits sequencing, failures and their handlers, "},
       {"code": "select"},
       {"text":
        ", and synchronous steps and rows. It leaves out loops, fibers, uninterruptible regions, scopes, services and yields."}],
      [{"code": "Looped"},
       {"text": " ("},
       {"code": "src/Effect4/Laws/Program/FragmentLooped.lean"},
       {"text": ") is "},
       {"code": "Straight"},
       {"text": " with "},
       {"code": "iterate"},
       {"text": "."}],
      [{"code": "M7Fragment"},
       {"text": " ("},
       {"code": "src/Effect4/Laws/Program/Typed/Assembly.lean"},
       {"text":
        ") takes a lawful source with an empty row table and a checked program with an empty requirement row. Its tape holds no host answer."}]],
     "kind": "items"},
    {"line":
     [{"text":
       "An observation is the part of a run that a theorem compares, such as the exits and the stores. An equal-observation theorem says that two behaviours give the same observation on every program of its fragment."}],
     "kind": "para"},
    {"line":
     [{"text":
       "Equal observations do not imply that underlying runtime states are identical. Restricting claims to explicit fragments and observations prevents unjustified generalizations."}],
     "kind": "para"}]},
  {"title": "What evidence does not claim",
   "kind": "part",
   "key": "evidence-boundaries",
   "body":
   [{"line":
     [{"text":
       "A formal proof establishes exactly what its proposition states, subject to four strict boundaries:"}],
     "kind": "para"},
    {"lines":
     [[{"text":
        "A conditional theorem leaves its premises open until separate lemmas discharge them."}],
      [{"text":
        "An invariant establishes safety, but an invariant does not prove progress or liveness."}],
      [{"text":
        "An equal-observation theorem holds only on its stated fragment and leaves unexamined behaviors open."}],
      [{"text": "The host boundary stays where "},
       {"code": "docs/core/host-boundary.md"},
       {"text":
        " puts it: no theorem says that the host answers, or answers in time."}]],
     "kind": "items"},
    {"line":
     [{"text":
       "Readers must inspect the formal proposition to identify the hypotheses, fragment, and observation governing each claim."}],
     "kind": "para"}]}]}