From a Source Page to a Checked Theorem

Someone says: “Euclid proved the Pythagorean theorem, Lean has now proved it, so Euclid is verified.” Every part of that sentence slides between two things.

• What Euclid wrote is a statement about squares on sides, in synthetic geometry.
• What Lean checked is a statement about six real numbers and a polynomial identity.

A kernel’s acceptance cannot tell you whether those are the same claim. This chapter keeps them apart on purpose, and the engine records the gap between them as data.

The engine can pin an external source to an exact page, record what has and has not been verified about it, and then test a separately versioned modern statement with proof kernels, without letting the modern result stand in for the historical one. The chapter builds on the claim contract (Chapter 1), the engine’s bundles (Chapter 16) and the kernel evidence of Chapter 20.

Three claims, not one

The historical claim’s canonical formulation, forall T : right_triangle, area(square_on(hypotenuse(T))) = area(square_on(leg1(T))) + area(square_on(leg2(T))), is the project’s own wording, and the record says so: “a project-authored interpretation, not a source quotation.”

Source, reconstruction and kernel proof are different objects. Integrity of the files does not establish fidelity of the transcription, and a kernel proof of the modern theorem does not establish the historical claim.

The source

The project’s P5 phase selected Euclid, Elements, Book I, Proposition 47, in Thomas L. Heath’s 1908 English translation. The page text, transcribed from the scan, reads:

In right-angled triangles the square on the side subtending the right angle is equal to the squares on the sides containing the right angle.

The authority is a public-domain scan on Wikimedia Commons, pinned by its file-page revision and hash rather than by a web address that could change. The committed page is PDF page 370, printed page 349, captured at 200 dpi.

There is a small defect worth noticing. The Commons filename calls this “Volume III”, while the scan’s own title page says Volume I. The source record states the mismatch, and rests the source’s identity on hash, revision and page content, not on the filename. A source is worth citing because the engine records defects like this one.

Seven things that are not one thing

P5 separates layers that a casual citation runs together:

“Verified” here means that a stored file still matches its stored hash. It does not mean that the transcription matches the page. Nobody has compared the manual transcription with the image, and the extraction from the parent file is not replayed in CI, so both stay not_evaluated. The bounded conclusion for the source is span_anchored, and the mathematical conclusion is not_evaluated, with zero supporting results and zero mathematical executions.

What the first attempt got wrong

A correction round, P5-R1, exists because the first P5 implementation overstated four things. It labelled a hand transcription as a raw capture; treated a changeable web address plus an access date as a fixed revision; used blanket licensing language that was valid only in the US; and set statement correspondence to qualified with no semantic audit. The correction is part of the record, and this chapter inherits its caution.

The rights assessment is recorded as an assessment, not as legal advice. Heath died on 1940-03-16; the 1908 work is in the public domain in the US (it predates 1930), and the life-plus-70-years term expired in the UK and the EU on 1 January 2011. Jurisdictions with longer terms may differ.

The modern reconstruction

The next phase, P6, does not touch the historical claim. It adds a second claim, with its own version and fingerprint, plus a contract that states how the two are related:

The contract is classified project_authored_modern_reconstruction. Its retained obligations include: synthetic geometry versus Cartesian coordinates; areas replaced by squared distances; degenerate point triples are permitted by the modern theorem; the coordinatization theorem is not formalized; and neither the Greek original nor the diagram is formalized.

The proof

Write $u = B-A$ and $w = C-A$, so that $C-B = w-u$. Then

theorem pythagoreanCoordinateResidual (a_x a_y b_x b_y c_x c_y : ℝ) :
    ((c_x - b_x) ^ 2 + (c_y - b_y) ^ 2)
        - (((b_x - a_x) ^ 2 + (b_y - a_y) ^ 2)
          + ((c_x - a_x) ^ 2 + (c_y - a_y) ^ 2))
      = -2 * (((b_x - a_x) * (c_x - a_x)) + ((b_y - a_y) * (c_y - a_y))) := by
  ring

The theorem then rewrites the hypothesis into it:

theorem pythagoreanCoordinate
    (a_x a_y b_x b_y c_x c_y : ℝ)
    (h : (b_x - a_x) * (c_x - a_x) + (b_y - a_y) * (c_y - a_y) = 0) :
    (c_x - b_x) ^ 2 + (c_y - b_y) ^ 2 =
      ((b_x - a_x) ^ 2 + (b_y - a_y) ^ 2)
        + ((c_x - a_x) ^ 2 + (c_y - a_y) ^ 2) := by
  have hres := pythagoreanCoordinateResidual a_x a_y b_x b_y c_x c_y
  rw [h] at hres
  ring_nf at hres
  linarith

The Rocq file (formal/rocq/EuclidI47Coordinate.v) is written independently, in the same two-step shape: ring, then rewrite and lra.

The kernels’ axioms are the usual ones: Lean Classical.choice, Quot.sound and propext; Rocq ClassicalDedekindReals.sig_forall_dec and FunctionalExtensionality.functional_extensionality_dep. No sorry, admit, custom Axiom or Admitted is present. The record calls the proofs “not axiom-free”, and so should this chapter. False fixtures with no placeholder (P6KernelRejected.lean and .v) are rejected by the real kernels, so the pipeline has been seen to say no.

The negative control

Drop the hypothesis and the claim is false. Take $A=(0,0)$, $B=(1,0)$, $C=(1,1)$:

What this establishes

Three claims get three separate bounded conclusions:

Established: in the real Cartesian model, orthogonality at $A$ gives the squared-distance identity, and without orthogonality the identity fails, with a concrete witness.

Not established:

• that the modern theorem is Euclid’s theorem; it must not be relabelled as such;
• that the historical statement and the canonical formulation mean the same thing;
• that the transcription is faithful to the page, or the page to the Greek;
• anything about degenerate triples beyond the fact that the modern theorem allows them.

The scope is recorded formally too. For the historical claim, the formalization scope is main_claim with formal claim kind none and proof status not_attempted. The modern theorem is a different claim and cannot be relabelled as the source’s main claim; the engine has a test for exactly that relabelling. The reconstruction does not formalize Euclid’s construction, Heath’s complete argument, the diagram, the Greek or the theory of area.

On the cross-system side, the Lean and Rocq statements are structurally_aligned: their kernel-elaborated types match the canonical claim under a documented translation, and the axiom baselines are verified. That is not semantic equivalence. The record states cross-kernel semantic equivalence = not_established and notes that it does not establish model equivalence between Lean’s ℝ and Rocq’s R.

Human review: not evaluated. The P5 and P6 records list no independent human review of the transcription, the proof or the correspondence. The expansion of $\lvert w-u\rvert^2$ above is a two-line check a reader can do; nobody has recorded doing it.

P5’s review set records source_integrity as passed and citation_context as qualified, both by full automation, and is labelled as automated. Eight other dimensions, including upstream_source_fidelity, statement_correspondence, mathematical_argument and independent_reproduction, are not_evaluated. The revision ledger has one created event: withdrawing the source would mark the dossier and notebook stale, and restoring it would need a new event. No repair is proposed for the historical claim, because “the source states a classical theorem; P5 does not invent a defect.”

Try it yourself

uv sync --all-groups --locked
uv run math-engine external validate <P5 pilot plan>
uv run math-engine reconstruction validate <P6 plan>
uv run math-engine reconstruction build <P6 plan> --clean --output .ci/math-val01-p6
uv run math-engine reconstruction verify .ci/math-val01-p6

The exact plan paths are under experiments/external/euclid-i47/; the P6 plan is reconstruction/qualification-plan.json. Check the command line against the P6 evidence record before relying on it: this edition quotes the structure, not a tested transcript.

Seeded error. In either proof, change the residual’s -2 to +2. The ring step should fail in both kernels.

Exercise. Take $A=(1,1)$, $B=(4,1)$, $C=(1,5)$. Check orthogonality at $A$ and the identity. Then move $C$ to $(2,5)$ and predict the residual from the dot product before computing it. (Answer: $u=(3,0)$, $w=(0,4)$, $u\cdot w=0$, and $25 = 9+16$. With $C=(2,5)$, $w=(1,4)$ and $u\cdot w=3$, so the residual is $-6$: $d^2(B,C)=4+16=20$, while $9+17=26$.)

Open questions.

1. Does the transcription match the page image? A reviewer comparing them would move transcription_fidelity off not_evaluated.
2. Is “the square on a segment is its squared length” faithful to Euclid, who compares areas by cutting and rearranging, and never multiplies lengths?
3. What exactly would a proof of statement correspondence between the synthetic and coordinate theorems require? This is the open problem the project names but has not attacked.

Evidence record

The scan is pinned by Wikimedia Commons file-page revision 1121740921 and SHA-256 79dbcba256dd42f928df7375a642da0cc7d2bdf5353ce0967c5f112f988525a9. The committed page image has SHA-256 71e431c773d0f101eb627572e5d19b80c355c319ab653a7bae9f33eb645275b6. The 16 MB parent file is hashed but not committed.

Identifiers for citation, from the P6 record: P6 index p6-qualification-index-5f529257ec050bf14a92599f18bc04e0ee5b517e8c6038ff92a764654da837ef; canonical executed notebook d406f9247dce55f500c7e990817b572b4133a83aa35ddb457b88083256aa9941; modern dossier dossier-3177ed8a258307c6c55e3efd7ea28d2a5d6317da39c5fe9f2a5fd21ae1b3d6be; claim fingerprints dc58408c… (modern) and 4273e2c7… (false claim). Post-merge main CI for P5 (run 40320278433) and P6 (run 40400910044) succeeded, according to the later phases’ baseline records.

The P6 bundle ran six mathematical executions (2 SymPy, 2 Z3, 1 Lean, 1 Rocq). The dossier, the kernel audit and the notebook each ran zero: reading a notebook does not rerun the mathematics.

Sources

The fidelity of the transcription and of the page to the original remain not_evaluated.