TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Lean v4.35.0 adds the lake check command, which rechecks a Lean development with an external kernel inside a sandbox. Its paranoid mode runs four additional kernels and a hardened build of Lean’s official kernel; the Lean Foundation for Innovation and Research says one added checker, con-leche, has a formal consistency proof.
Lean v4.35.0 now includes lake check, a command that exports a Lean development and rechecks it with an external kernel, according to a report published October 15 by Lean creator Leonardo de Moura. The release also ships with four additional kernels, giving users a way to compare independent checkers after recent security concerns involving Lean’s proof-checking kernel.
In its standard mode, lake check sends the exported development to leanchecker, described in the report as the official Lean kernel without the surrounding system components. The process runs in a sandbox by default. Users can disable that protection with the explicitly named option –inadvisably-no-sandbox, a warning in the command itself that running without isolation is discouraged.
The new –paranoid mode checks a development with four additional kernels: nanoda, lean4lean, con-leche and con-ron. It also runs a version of the official kernel built with a hardened memory allocator. The report says that allocator turns memory corruption into a checked abort rather than allowing a potentially incorrect result to pass silently. The command is intended to make cross-checking available through Lean’s existing build tool, Lake.
De Moura’s report describes con-leche as a Lean-written kernel with a proof of consistency, supervised by Joachim Breitner at the Lean Foundation for Innovation and Research (Lean FRO). The report says Claude, using Fable and Opus, implemented and proved the kernel under that supervision. In this account, consistency means every environment accepted by con-leche has a model in set theory, following Mario Carneiro’s model of Lean’s type theory. The proof is itself checked by Lean’s official kernel and assumes the consistency of the set theory used in the model.
Independent Checks for Lean Proofs
Lean checks formal proofs through a kernel: a proof accepted by that checker is treated as meeting the system’s formal rules. If the checker has a flaw, a proof could be accepted even when it does not establish its stated result. Running multiple kernels offers a way to catch some errors that a single implementation might miss, although it does not by itself prove every part of the software stack correct.
The change follows security disclosures that the report points readers to in two postmortems dated August 1 and August 24. It says AI agents have been effective at finding software vulnerabilities, including in Lean’s kernel. The release’s practical response is to add alternative checkers and a built-in route for users to run them. The report does not describe those postmortems’ specific vulnerabilities in this announcement, so their details should not be inferred from it.
Con-leche’s formal proof addresses a particular risk: programming mistakes in that kernel’s implementation. The report says the kernel checks a full Mathlib export using 0.69 times the instruction count of the official kernel and completes the check in about 100 seconds with eight threads. Those are performance figures reported by the project, not a general guarantee for other projects or hardware. The proof also has stated assumptions, and the broader software used to build and run the checker remains relevant.
As an affiliate, we earn on qualifying purchases.
How Lean Is Expanding Kernel Checks
Lean is a programming language and proof assistant used to develop and verify mathematical results. Its official kernel checks whether proof terms conform to the system’s rules. The October 15 report frames the new tooling as part of a broader effort to strengthen that kernel, add independent implementations and make rechecking easier after the recent security postmortems.
The report distinguishes the new checkers by how they are built and verified. Con-leche is implemented in Lean and has the described consistency proof. To reduce reliance on Lean’s compiler and runtime when executing it, Breitner translated con-leche to Rust with AI assistance and used Aeneas, a tool for verifying Rust code using Lean, to prove that the Rust version refines con-leche’s checking algorithm. That version is called con-ron. The report argues that checking with both may reduce the chance that a compiler or runtime bug affecting one implementation also affects the other; it does not claim that either path is immune to defects.
Lean’s kernel renovation is also under way. The report says Arthur Adjedj is working on a renovation plan, with pull requests submitted and Breitner reviewing changes to keep con-leche aligned and update its proof. Lean FRO expects verification of lean4lean to be completed in the next few months, according to the post. That is an expectation, not a completed milestone; the report says lean4lean’s close resemblance to the official C++ kernel is one reason its verification matters.
software development sandbox environment
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits and Open Verification Work
The report does not provide a full account of the August security incidents, identify every vulnerability found, or say whether the new kernels address each issue in those postmortems. It also does not establish that the four additional checkers are all formally verified to the same standard. The explicit consistency claim applies to con-leche; verification of lean4lean is described as work expected to finish in the coming months.
Formal checking also has boundaries. The con-leche proof relies on the consistency of the set theory used in its model, and the report notes that bugs in Lean’s compiler or runtime could still affect the executable. The Rust-based con-ron route is intended to reduce shared implementation risk, but the post does not claim that it removes every possible failure mode. Performance figures are specific to the reported Mathlib export and test conditions.
Scale is another open issue. The report cites large projects, including Anthropic’s FLT at more than 13 million lines of code and Mathlib at 2.5 million, and says the current external-checking approach will not scale to developments of the size the community is discussing. The announcement does not give a delivery date for binary export formats, incremental checking, easier kernel integration or compiler verification.
As an affiliate, we earn on qualifying purchases.
More Kernels and Scalable Rechecking
Lean FRO says it is working on the outstanding tooling and scale problems, including binary export formats and incremental checking with external checkers. The report also sets out goals for making lake check more user-friendly and allowing users to connect kernels of their choice, including efficient checkers in the Lean Kernel Arena. These are plans, not features the announcement says are already available.
For now, the report encourages Lean users to run lake check –paranoid on their projects and send any kernel disagreements to contact@lean-fro.org. The next stated verification milestone is completion of the lean4lean verification, which the project expects within the next few months. No exact date is given.
memory-safe kernel for programming
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does lake check do?
Lake check exports a Lean development and rechecks it with leanchecker. The report says the process runs in a sandbox by default.
Which kernels run in paranoid mode?
Lake check –paranoid runs nanoda, lean4lean, con-leche and con-ron, as well as a hardened-memory-allocator version of Lean’s official kernel.
Does the announcement say all four new kernels are formally verified?
No. The report specifically describes con-leche as having a formal consistency proof. Verification of lean4lean is still in progress, while the announcement does not claim that all four additional kernels have equivalent proofs.
What should users do if the kernels disagree?
The report asks users to contact contact@lean-fro.org if checking their project produces a disagreement among kernels.
What remains on Lean’s development roadmap?
Lean FRO says it is working on easier kernel integration, simpler kernels, compiler verification, and scalable rechecking through binary exports and incremental checking. The report gives no release dates for those efforts.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
