Verified: Formal Proof at Zero Errors in AI

In August 2026, researcher Dmitry V. Alexandrov published on arXiv the first mechanized formalization of Romanov's Triplet Logic, built using the Rocq proof assistant. The unusual choice comes immediately: before building an executable tool, he decided to prove every mathematical property of the system. The result carries a label that is rare in production software: verified.

The original idea: prove the theory, then extract the tool

Triplet Logic, abbreviated TLS, is a combinatorial framework built on triplets. It serves to reason about compatible paths inside layered structures called Compact Triplets Structures. The operational engine is an intersection procedure: the Simple Vertex Intersection.

Alexandrov formalized the core of the theory inside Rocq. He included Compact Triplets Formulas, hyperstructures, the clearing procedure, and the SVI itself.

The logic behind this choice is clear. An autonomous mathematical theory deserves demonstrated foundations before any applicative promise. Many software projects reverse the order: they write the code, then seek guarantees. Here the sequence is methodically inverted, and this inversion defines the entire story. Reversing the order has a precise consequence. Every property used by the tool rests on an already-closed proof. No room remains for downstream assumed guarantees. Whoever inherits the code also inherits the proofs.

The verified results

The numbers in this work have an explicit denominator. Every figure points back to a public, reproducible artifact.

From the paper deposited on arXiv, the Rocq development exceeds 23,000 lines of code distributed across seventeen files, with 427 lemmas and theorems proved and zero admitted goals.

• Over 23,000 lines of Rocq code
• 17 development files
• 427 lemmas and theorems proved
• Zero admitted goals

The expression zero admitted goals deserves attention. In a proof assistant, an admitted goal is a step taken as true without a proof. A single admitted goal undermines the entire chain. One unproved link is enough to weaken everything built on top of it. Reducing them to zero means the entire chain holds on its own. No theorem leans on a shortcut.

Another number concerns complexity. Alexandrov proves explicit polynomial time bounds for the filter phases. This theoretical guarantee accompanies benchmarks on random and structured instances, and the two measures converge toward the predicted behavior. The convergence matters. The proved bound says how the code should behave. The benchmark shows how it actually behaves. When the two data points coincide, the theory does not remain on paper. The complete toolchain is available as a curated artifact on Zenodo.

The correctness boundary: where the story becomes instructive

The central contribution is a precise correctness boundary. This is where the story gains real value.

The existence of a set satisfying the system implies that the SVI is populated. The reverse implication fails in the general case. A populated SVI does not always guarantee a valid solution. The link holds in one direction, not the other.

For aligned structures, the double implication becomes complete. It also holds for systems of aligned structures. Within that perimeter the method covers both directions.

There is more. Alexandrov formalizes the correctness of the grouped-window translation. He then shows a formal counterexample to its completeness, and declares the boundary with the same care used for the theorems. This is the moment of friction: a work that indicates where it stops working is worth more than one that promises total coverage. The correction remains the most informative datum. The reader knows in advance where the method gives way. This transparency is worth more than a generic guarantee, because it eliminates surprises in production.

From proof to prototype: VFR

The proved theory becomes a tool. Alexandrov extracts VFR, a prototype in OCaml.

VFR offers two distinct guarantees. For the sliding-window fragment it provides a verified decision procedure. For general 3-CNF it offers a one-sided correct filter.

A one-sided filter has a useful property: when it excludes an instance, the exclusion is reliable. It produces no false rejections. When it lets an instance through, the verdict remains open. Knowing this asymmetry guides correct use of the tool. The prototype comes with a Python runtime and reproducible Docker packaging.

Reproducibility here is concrete substance, beyond the framing. Anyone can download the artifact, run the benchmarks, and compare results with those declared. The value of this choice emerges in contrast with common practice: many AI tools arrive as black boxes, with results that are difficult to replicate. VFR takes the opposite path.

What 'verified' means for AI builders

The term verified circulates widely in AI marketing. This case restores the word to its original weight.

A verified result declares three things: what was proved, by which method, within which boundary. Alexandrov's work satisfies all three criteria.

For a CTO, the lesson is direct. A formal guarantee is worth as much as the perimeter it declares. A one-sided correct filter, with explicit limits, is more useful than an opaque model that promises everything. The declared perimeter says where to rely on the tool and where not to. An opaque model leaves this question unanswered, shifting the risk onto the team that integrates it.

This position recurs across many enterprise cases studied by this desk. Results that hold always carry an explicit denominator, while inflated results avoid before-and-after comparison. For a board, the signal concerns benchmarks of the possible: the trust bar shifts toward controllable evidence.

What you can take from this

The story offers a transferable playbook, even outside formal logic.

First lesson: declaring the validity boundary increases credibility. A result with explicit limits withstands external scrutiny.

Second lesson: reproducibility transforms a claim into evidence. Open code, benchmarks, and packaging allow anyone to verify.

Third lesson: sequence matters. Proving the foundations before extracting the tool reduces downstream risk. For an SME integrating AI, the principle applies identically: define the metric, declare the perimeter, make the result auditable. This discipline distinguishes an operational result from a communication exercise.

The open question

Every organization adopting AI faces the same choice. How much of its results holds up to an external, reproducible check?

Alexandrov invested over 23,000 lines of proof to make the answer public. Most enterprise deployments remain far from this standard.

The concrete question for the reader: which metric from your last AI project survives an independent audit, with a before-and-after figure? The answer indicates the distance between what you announce and what you can prove.