← Adversarial Math From First Principles

Isabelle/HOL and Countermodels

Isabelle2026 in Docker builds a repaired copy of the advisory theory and Nitpick finds a finite countermodel; the accepted formal source remains pinned and the engine result remains not_evaluated.

The first time the project’s Isabelle theory met a real Isabelle, it did not build. Three defects appeared, one after another:

*** Malformed command syntax (line 5)
*** Undefined method: "ring" (line 18)
*** Inner lexical error at "… = t^2 - x^2" (line 19)

The first is a portability problem: the UTF-8 text cartouche did not parse in this image, while the portable text \<open>...\<close> form does. The second had been predicted in an earlier draft of this chapter: ring is not a built-in Isabelle/HOL proof method. The third is a typographic ellipsis character where Isabelle expects its special ... fact. These are real failures of the candidate file, not failures of the mathematics.

Isabelle/HOL is a candidate third kernel for the book. This chapter records what happened when it was finally run: a repaired copy of the theory builds in Isabelle2026, and the Nitpick countermodel finder works on a small example. It is not an accepted source change and not an engine integration. The chapter builds on the status ladder (Chapter 3) and the kernel chapters (Chapters 11 and 12).

A repaired copy, not a changed source

The repaired copy lives at content/examples/math/tool-chapters/ch13-isabelle/ (download the theory). The accepted file, formal/isabelle/Lorentz_Interval.thy, was deliberately not edited, because its hash is pinned in the accepted evidence record. Editing it would silently change accepted evidence.

The copy changes only the three things that failed: the text cartouche, the algebraic method and the ellipsis.

text \<open> ... \<close>
by (simp add: algebra_simps power2_eq_square)
also have "... = t^2 - x^2"

Run on 2026-11-09 with

docker run --rm \
  -v "$PWD/content/examples/math/tool-chapters/ch13-isabelle:/home/isabelle/work" \
  makarius/isabelle:latest build -D work

it printed:

Running Adversarial_Math ...
Finished Adversarial_Math (0:00:00 elapsed time)

That is a real kernel build of the repaired theorem. It is not an engine EvidenceResult, and it does not change the accepted Isabelle binding.

Claim Isabelle’s role Status
lorentz-interval-invariance-1d-algebraic@1.0.0 Advisory proof candidate; the repaired copy builds in Isabelle2026 Docker formal check passed; accepted source unchanged; engine result still not_evaluated

No other claim has an Isabelle artifact.

What the engine still records

The Docker build happened outside the engine, so the engine’s view has not changed:

  • The host probe still reports isabelle available: False | reason: none of isabelle was found on PATH. Docker does not put isabelle on the host PATH.
  • The engine still records math01-isabelle-algebraic-not-installed-v1 as not_evaluated / not_installed, and the manual isabelle-lane in CI remains skipped.
  • No Isabelle EvidenceResult, claim-level binding update or L0–L4 audit was created.

What Nitpick adds

Nitpick searches for finite countermodels. It was run on 2026-11-09 in the same Isabelle2026 image, on a deliberately simple example in content/examples/math/tool-chapters/ch13-nitpick/ (download): is every bool list empty?

lemma "xs = ([] :: bool list)"
  nitpick
  oops

The build log reports:

Nitpick found a counterexample:
  Free variable:
    xs = [True]

That is a finite countermodel to the universal claim, and enough to show that Nitpick finds a model when one exists. It is not a proof of anything, and Nitpick finding nothing would not prove a theorem either. A finite-domain search is no substitute for a proof over the reals, and Z3 already covers the real-arithmetic countermodel role (Chapter 10).

What this establishes

Chapter 12 argued that a third kernel reduces some proof-checker risk without solving the shared-statement problem. The Isabelle run makes that concrete. The candidate theory needed three mechanical fixes before Isabelle accepted it, and a successful build still says nothing about physical validity. The chapter’s value is the record of a real candidate failure and its repair.

The declared Isabelle binding still reports declared_alignment_only with Lean, Rocq and Z3: metadata alignment, not semantic equivalence. Even a fully integrated Isabelle proof would not show that Isabelle’s reals and the other kernels’ reals are the same model. No human review of the statement, the fixes or their interpretation is recorded.

Try it yourself

Run the Docker command above. The accepted source must stay untouched until a versioned evidence update is approved. Promoting the repaired copy would take five steps:

  1. Create a new versioned Isabelle artifact and evidence record.
  2. Record the exact source hash, image digest and build output.
  3. Add the Isabelle result to the claim dossier with its proper status.
  4. Keep the existing accepted record and historical source unchanged.
  5. Decide whether the manual isabelle-lane becomes a required CI lane.

Seeded error. Replace the repaired algebraic method with by ring. The build fails with Undefined method: "ring", the failure recorded above.

Open questions.

  1. Should the repaired copy replace the accepted advisory source, and under which versioned evidence process?
  2. How should the engine take in a Docker-only Isabelle build without confusing the host probe with the container execution?
  3. What would justify promoting Isabelle from advisory to required, and who decides?

Evidence record

Executed, illustrative. The record is the example-copy path, the exact Docker command, the image tag and digest, Isabelle2026, the date 2026-11-09 and the build output. The image was makarius/isabelle:latest, digest sha256:d6e7b8995f30a7e33172b750a1db9f5d46d39d8dcd59303c2390df4fdd5dae93, reporting Isabelle2026.

The accepted formal/isabelle/Lorentz_Interval.thy keeps its normalized hash 9c57222c0057bf9f5950decaced989731525ab1cdd596ddb28315d62bcc0691f, pinned in the accepted evidence record, so that record remains valid. Promoting the repaired copy into formal/isabelle would need a separately reviewed, versioned evidence update, not a prose edit.

Sources

  • Tobias Nipkow, Lawrence C. Paulson and Markus Wenzel, Isabelle/HOL: A Proof Assistant for Higher-Order Logic (Springer, 2002), https://doi.org/10.1007/3-540-45949-9
  • Jasmin Christian Blanchette and Tobias Nipkow, “Nitpick: A Counterexample Generator for Higher-Order Logic Based on a Relational Model Finder”, ITP 2010 (2010). Nitpick was run on the finite example above; its manual has not been read for this edition.

In the repository: formal/isabelle/ (the pinned candidate), the repaired example in content/examples/math/tool-chapters/ch13-isabelle/, src/math_engine/adapters/external.py and docs/research/formalization-landscape.md.