Lean 4 · Mathlib · no sorries

SalienceLean

Machine-checked proofs of the propositions in Salience as an Internal Currency for Resource-Bounded Agents, together with further results on the same controller: gauge structure and identifiability, an entropy-regularized characterization of the selection rule, and conservation of transported charges under coarse-graining. Every result is checked by the Lean kernel and rebuilt from source in CI.

48theorems & lemmas
0sorries
3axioms (propext, choice, quot)
1proposition corrected

01Correction to Proposition 1

One statement of the paper requires an additional hypothesis. The formalization records the corrected statement and the counterexample that forces it.

Proposition 1 asserts that the selection probability is strictly increasing in a candidate's own score, the others held fixed. The statement fails for a singleton candidate set: with one candidate, softmax is constantly 1 regardless of the score, so no strict increase exists. The formalized statement adds the hypothesis that a second candidate exists; the singleton case is proved separately.

Corrected statement — Basic.lean

theorem softmax_lt_softmax_of_lt {T : ℝ} (hT : 0 < T) {S S' : ι → ℝ} {i : ι}
    (hlt : S i < S' i) (hoth : ∀ j, j ≠ i → S' j = S j) (hex : ∃ j, j ≠ i) :
    softmax T S i < softmax T S' i

Singleton case — Basic.lean

theorem softmax_eq_one_of_subsingleton [Subsingleton ι] (T : ℝ) (S : ι → ℝ) (i : ι) :
    softmax T S i = 1

With the added hypothesis ∃ j ≠ i, the proposition holds for every T > 0. The remaining propositions of §11.2 hold as stated.

02Results

Headline results, grouped by theme; each name links to its statement in the source. A complete listing of all 48 declarations follows the groups.

Propositions from the paper

Section 11.2, with structural properties of the score from Sections 3 and 7.

softmax_add_const Basic.lean:103

Proposition 2 (translation invariance). Adding a constant to every score leaves all selection probabilities unchanged, for every temperature.

tendsto_softmax_nhdsGT_zero_argmax Basic.lean:134

Proposition 3 (low-temperature limit). As T → 0⁺ the probability of the unique maximizer tends to 1; tendsto_softmax_nhdsGT_zero_of_lt sends any strictly dominated candidate to 0.

tendsto_softmax_atTop Basic.lean:172

Proposition 3 (high-temperature limit). As T → ∞ every selection probability tends to the uniform value 1/|I|.

sum_budget · budget_eq_zero_of_nonpos Basic.lean:194

Proposition 4 (conservation and sparsity). Allocated budgets sum to B, and candidates with non-positive score receive zero. In addition, 0 ≤ bᵢ ≤ B.

score_veto_of_continuity_zero Basic.lean:231

Veto gate. If the continuity factor is zero, the score is zero, independently of the value terms.

score_lt_score_of_age_lt Basic.lean:237

Time decay. Under positive value terms, gates, and decay rate, the score is strictly decreasing in the age Δt.

score_eq_density_mul_exp_neg_potential Basic.lean:262

Potential form (eqs. 9–10). For positive gate factors and normalizer, the score equals ρ · e^(−Φ), with Φ the salience potential.

Gauge structure and identifiability

Invariances of the selection policy, and which parameters observation determines.

softmax_scale_gauge Forte.lean:82

Rescaling all scores and the temperature by a common nonzero factor leaves the policy unchanged; only the ratio S/T is observable.

logit_gauge Forte.lean:96

Non-identifiability. The regime logit log S + βχ is invariant under S ↦ S·e^h, χ ↦ χ − h/β; at a single stake β, prior salience and evidence are not separately identifiable.

theorem logit_gauge {β : ℝ} (hβ : β ≠ 0) {S : ℝ} (hS : 0 < S) (χ h : ℝ) :
    log (S * exp h) + β * (χ - h / β) = log S + β * χ
chi_of_two_temperatures · log_prior_of_two_temperatures Forte.lean:103

Identification at two stakes. Logits observed at two values of β determine the evidence term and the log prior.

fisher_row_sum_zero Forte.lean:261

Rows of the Fisher matrix diag(p) − ppᵀ sum to zero: the all-ones direction of logit space is null, the same gauge in infinitesimal form.

Variational characterization

The selection rule as the solution of an entropy-regularized optimization.

entropy_regularized_le · softmax_attains_free_energy Forte.lean:216

Optimality. Every distribution satisfies ⟪p,ℓ⟫ + T·H(p) ≤ T log Z, and the softmax policy attains the bound.

objective_eq_free_energy_iff Forte.lean:248

Uniqueness. Equality holds only at the softmax policy, via a strict Gibbs inequality (sum_mul_log_sub_log_neg).

theorem objective_eq_free_energy_iff [Nonempty ι] {T : ℝ} (hT : 0 < T) (ℓ : ι → ℝ)
    {p : ι → ℝ} (hp : ∀ i, 0 ≤ p i) (hps : ∑ i, p i = 1) :
    (∑ i, p i * ℓ i) + T * (-∑ i, p i * log (p i)) = T * log (∑ j, exp (ℓ j / T))
      ↔ p = softmax T ℓ
argmax_stable_of_margin Forte.lean:271

Perturbation bound. If the leading score exceeds every other by more than , no ε-perturbation of the scores changes the argmax.

Conserved charges and coarse-graining

Conditions under which linear invariants survive changes of scale and lossy compression.

charge_conserved_under_renormalization Forte.lean:305

For square invertible C, a charge conserved by F and transported contragrediently (q_c ᵥ* C = q_f) is conserved by C Fᵐ C⁻¹ — a change of coordinates with temporal blocking.

coarse_charge_conserved_of_intertwines Forte.lean:327

Lossy case. For rectangular C with C F = Fc C, the transported charge is conserved along every coarse trajectory arising from a fine state; no invertibility or rank hypothesis.

theorem coarse_charge_conserved_of_intertwines {C : Matrix m n ℝ} {F : Matrix n n ℝ}
    {Fc : Matrix m m ℝ} {qf : n → ℝ} {qc : m → ℝ}
    (hinter : C * F = Fc * C) (hf : qf ᵥ* F = qf) (htrans : qc ᵥ* C = qf) (x : n → ℝ) :
    qc ⬝ᵥ (Fc *ᵥ (C *ᵥ x)) = qc ⬝ᵥ (C *ᵥ x)
charge_computable_of_rowspace · charge_erased_on_kernel Forte.lean:345

A charge of the form q = q_c ᵥ* C is computable from Cx alone, and vanishes on ker C. Sufficiency and its corollary; the converse is not formalized (see Scope).

Leakage and error correction

Decay of a two-state binding charge, and the repetition-code threshold.

leakage_decay · tendsto_leakage_pow_zero Forte.lean:376

The antisymmetric mode of a symmetric two-state leakage channel is an eigenvector with eigenvalue 1 − 2ε; the charge scales as (1−2ε)^t and tends to 0 for 0 < ε < 1.

repetitionRG_lt_self · lt_repetitionRG · repetitionRG_deriv_half Forte.lean:408

Majority decoding over three copies gives the map ε ↦ 3ε² − 2ε³: contraction below ε = 1/2, growth above it, and derivative 3/2 at the fixed point, so the threshold repels.

03Verification

Build the project, then query the kernel for the axioms each result depends on.

git clone https://github.com/CarlSR9001/SalienceLean && cd SalienceLean
lake exe cache get     # fetch prebuilt Mathlib
lake build
import SalienceLean

#print axioms Salience.objective_eq_free_energy_iff
-- 'Salience.objective_eq_free_energy_iff' depends on axioms:
-- [propext, Classical.choice, Quot.sound]

These are Lean's standard axioms, the same foundation Mathlib uses. An incomplete proof would surface as sorryAx in this list; none appears for any declaration in the library. Toolchain: leanprover/lean4:v4.33.0-rc1, Mathlib pinned to the matching release.

04Scope

What the formalization does not cover, and known gaps in what it does.

Not formalized

Related material outside the scope of the library.

  • The bundle / connection / holonomy, sheaf, groupoid, categorical, and persistent-homology material of the same program supplies definitions under which the intended statements hold by construction, and is not formalized here.
  • The proposed RG exponent for binding corruption presumes a fixed point whose existence is not established.

Known gaps

Limitations of the formalized results.

  • The row-space criterion is one-directional. Sufficiency and its corollary are proved; the classical converse — a charge computable from Cx lies in the row space, equivalently q ⊥ ker C ↔ q ∈ rowspace C — is not formalized.
  • T = 0 is formally admissible but not meaningful. Lean totalizes division, so some identities typecheck at T = 0, where the conventional softmax is undefined. The intended domain is T > 0; no result relies on the degenerate case.
  • The leakage and repetition-code results concern an idealized two-state channel and a three-copy code, not a measured system.