Research
The category and the foundation
How we read the verified-runtime category, and the mechanized foundation the trust stack rests on.
Category
The category
Agents write more numerical code than reviewers can read. The gap widens with every model release. Verification is the constraint that remains, and it lives in the toolchain. C Proof operates at the substrate: the compiler refuses whole categories of bugs, properties bind implementations to specifications, and the product is verified understanding of a model. Where it holds, where it breaks, what witnesses the break.
Foundation
The mechanized foundation
The Chelis language semantics are mechanized in Lean 4. The core type-system guarantees rest on machine-checked theorems rather than implementation choices that could drift.
- Type soundness: well-typed programs do not get stuck.
- Dimension safety: named tensor shapes line up.
- Effect correctness: effects occur only where allowed.
- Linearity soundness: linear values keep their usage discipline.
- AD correctness: differentiation follows the formal specification.
The mechanization is what makes the trust stack defensible. A type system that catches dimension errors is useful. A type system whose dimension-safety property is a theorem is a different kind of artifact. The compiler implements what the proof certifies.
Verification
The verification machinery
The surface a user reads is understanding of a model. The machinery below is what earns each line of it.
Specifications enter Chelis as typed program properties, derived from structured English requirements, mathematical notation, or migrated from existing typed code. The C Proof Engine routes each property to the strongest available proof.
Type-level discharge handles structurally provable properties at compile time. An SMT solver discharges arithmetic and algebraic properties. Certified-envelope verification applies where the engine achieves coverage over transcendental paths, and the verdict carries the envelope's machine-checked certificate. For coupled pricing paths where the over-approximation does not close, the property stays at the validation tier with that fact labeled. The route and evidence are recorded on every result.
The engine's proofs are over real arithmetic. Floating-point roundoff is out of scope and stated as such.
The output is an audit chain. Every property carries its proof tier, the evidence behind the result, and provenance back to the originating specification. The chain extends from the source of truth your team approved through the compiled binary that runs in production.
Depth
Across the trading firm
The options desk is first because a silent numerical error is priced fastest there. The same checked path extends to risk measurement, execution, treasury, clearing, and governance. Each carries its own canon of invariants the code must satisfy.
As reasoning models improve, they author into a substrate that already checks the invariants they operate over. That architecture is worth more than validation after the fact.
Contact