C Proof
Try C Note
Menu

What stands behind each result

Every result records the method that produced it: a type check, an SMT proof, an SMT proof with certified envelopes, or sampled tests. The C Proof Engine runs the proofs first and samples only when no proof applies.

Methods

Every result names the method that produced it. A proof covers the property as written, over the real numbers, for every input its preconditions allow.

  1. Type check The Chelis compiler, C Proof's language toolchain, rejects a malformed property before any solver runs. How it works lists the checks.

  2. SMT proof The solver proves the property over the real numbers under its hypotheses, with no sampling. Algebraic properties such as discount-factor bounds and present-value positivity are proved this way.

  3. SMT proof with a certified envelope An SMT solver cannot reason about transcendental functions, and most numerical code calls them. A certified envelope is a machine-checked lower and upper bound on such a function. Where one exists, the engine replaces the call with that bound and SMT proves the rest. The record names the envelope used.

  4. Sampled validation When no proof applies, the property runs on seeded samples and is labeled Sampled, not proven, with the seed and sample count.

  5. Disproved A property that fails is labeled Disproved and carries the input that breaks it, replayed at machine precision.

Foundation

LaCaDiLE

A first-order core calculus of Chelis in Lean 4, covering tensor derivatives, logical ownership, keyed randomness and resource protocols.

From requirement to record

  1. Requirement A structured rule names the function, its inputs, the preconditions and the expected response.

  2. Property The rule becomes a Chelis property, linked to its source.

  3. Check The engine type-checks it, then proves or validates it against the implementation.

  4. Record C Note keeps the property, method, result and source requirement together for the reviewer.

Results on an option pricer

A result labeled Proven · modulo contract is an SMT proof that rests on one stated assumption, and that assumption is checked by sampling.

Proven (SMT)

intrinsic_value

Intrinsic value is non-negative. The property is piecewise-linear, so SMT proves it directly.

Proven · modulo contract SMT, one assumption sampled

put_call_parity_residual

The parity residual is zero for the algebraic kernel. The normal-CDF symmetry it assumes is checked by sampling, so C Note records the proof as resting on that assumption.

Sampled, not proven

black_scholes_call

The closed-form price couples two normal-CDF terms, so this property is checked on seeded samples.

Disproved 1 counterexample

lower_bound_disc

S 150.00 · K 50.00 · r 0.02 · sigma 0.15 · T 0.25

pricer 100.2394

bound 100.2494

shortfall -0.0100

0.0 0.5 1.0 1.5 2.0 1.0 1.5 2.0 2.5 3.0 tenor T (years) moneyness S / K property holds checked domain bound violated lower_bound_disc frontier T = 0.25 S/K = 3.00 counterexample pricer 100.2394 < bound 100.2494
0.0 1.0 2.0 1.0 2.0 3.0 tenor T (years) moneyness S / K frontier property holds bound violated counterexample pricer 100.2394 bound 100.2494
A worked example: an option pricer whose normal-CDF approximation saturates deep in the money.

Check your own property

Send us a property from your own code. We show which method checks it and what C Note records.

Try C Note Talk to us