FormalProofLinter.lean`

Explanation legend Lean4 Domain Explanation Language (L4DEL)

L4DEL explanations are a separate layer. They do not change the Lean source. Intuition is explanatory prose; numbered items are a reading path; sources link the wording back to evidence.

L4DEL: Lean4 Domain Explanation Language

Annotation provenance. This overlay contains 10 curated AI-written annotations and 7190 mechanical source-derived annotations. They have not been human-reviewed as explanations; treat them as unverified and not mathematical authority. Retained generation history: The 71 original curated annotations were produced in a Claude Sonnet 5.5 session at medium effort; Claude Opus 5.5 is recorded in that session as the advisor model, not the direct author. The bulk source-derived expansion was generated mechanically from pinned source comments by tooling developed in a GPT-5.6 Sol session at ultra reasoning; GPT-5.6 Sol did not originate the quoted source prose. On 2026-10-17 the mechanically generated source-comment annotations of the Formal Conjectures, Carleson, FLT, PFR, CompFiles, Mathematics in Lean and Theorem Proving in Lean overlays were regenerated by the same generator after three corrections made in a Claude Sonnet 5.5 session: titles no longer cut a sentence inside mathematics or end on a dangling word, workflow markers are removed from the quoted prose, and declaration names follow the scanner's namespace resolution. The boilerplate step line was dropped, and comments that were only a row of dashes no longer yield annotations. No new prose was written and no human review is claimed.

Credit: The upstream authors and contributors retain credit for the project and mathematics. lean4-explainer only renders their pinned source and adds the separately disclosed explanation layer.

Project sources: Pinned project documentation, Formal Conjectures paper, arXiv v1

5 declarations, 1 contain sorry, 0 declared as axioms

The Formal Proof Linter

A conditional formal_proof names the hypotheses its proof assumes, each stated in the same file with a sorry proof. If one of those is later proved, the proof is no longer conditional on it and the annotation should be revisited.

Noticing that means reading the hypothesis's proof term, which the attribute cannot do from inside a module: env.find? returns nothing useful there, so the check silently does nothing in exactly the files a test would live in. See #4780. A linter can, through findAsync?, which is the same route CategoryLinter takes for the equivalent check on category.

Imports (2)

Imported by 2 files

def FormalProofLinter.isProved Whether declName has a proof term with no sorry in it, waiting on the declaration to finish elaborating line 48 source
Source documentation
Whether declName has a proof term with no sorry in it, waiting on the declaration to finish elaborating.

standard axioms: Classical.choice, Quot.sound, propext what this means
Statement uses: Lean.Name, Lean.Elab.Command.CommandElabM, Bool
Proof uses: Bind.bind, Lean.Environment, Lean.MonadEnv.getEnv, Option, Lean.AsyncConstantInfo, Lean.Environment.findAsync?, Bool.false, Pure.pure, Lean.Elab.Command.Context, StateRefT', IO.RealWorld, Lean.Elab.Command.State, EIO, Lean.Exception, Option.any, Lean.Expr, Bool.not, Lean.Expr.hasSorry, Lean.ConstantInfo.value?, Lean.AsyncConstantInfo.toConstantInfo and 1 more
8 instances, coercions and auxiliary constants left out.
```
def isProved (declName : Name) : CommandElabM Bool := do
…
```
def FormalProofLinter.getFormalProofTagsFor Return every formal-proof tag attached to declName line 56 source
Source documentation
Return every formal-proof tag attached to declName.
A declaration may have more than one proof. Linter policy must therefore be computed over the complete list rather than the legacy singular accessor.

standard axioms: Classical.choice, Quot.sound, propext what this means
Statement uses: Lean.Name, Lean.Elab.Command.CommandElabM, Array, ProblemAttributes.FormalProofTag
Proof uses: Bind.bind, Lean.Elab.Command.liftTermElabM, ProblemAttributes.getFormalProofTags, Lean.Elab.Term.TermElabM, StateRefT', IO.RealWorld, Lean.Elab.Term.State, Lean.Meta.MetaM, Lean.Elab.Term.Context, Pure.pure, Lean.Elab.Command.Context, Lean.Elab.Command.State, EIO, Lean.Exception, Array.filter, BEq.beq, ProblemAttributes.FormalProofTag.declName, OfNat.ofNat, Nat, Array.size
13 instances, coercions and auxiliary constants left out.
```
def getFormalProofTagsFor
    (declName : Name) : CommandElabM (Array ProblemAttributes.FormalProofTag) := do
…
```
Mentions: ProblemAttributes.FormalProofTag
def FormalProofLinter.checkAssumptionsStillOpen Warns when a hypothesis assumed by a conditional formal_proof has since been proved, so the proof may no longer be conditional on it line 63 source
Source documentation
Warns when a hypothesis assumed by a conditional formal_proof has since been proved, so the proof may no longer be conditional on it.

standard axioms: Classical.choice, Quot.sound, propext what this means
Statement uses: Lean.TSyntax, List.cons, Lean.SyntaxNodeKind, Lean.Name.mkStr4, List.nil, Lean.Syntax, Lean.Elab.Command.CommandElabM, Unit
Proof uses: Bind.bind, Lean.Elab.Modifiers, Lean.Elab.elabModifiers, StateRefT', IO.RealWorld, Lean.Elab.Command.State, EIO, Lean.Exception, Lean.Elab.Command.Context, Prod, Lean.Name, Lean.Elab.expandDeclIdCore, Lean.Environment, Lean.MonadEnv.getEnv, ite, Eq, Bool, Lean.Elab.Modifiers.isPrivate, Bool.true, Lean.mkPrivateName and 29 more
37 instances, coercions and auxiliary constants left out.
```
def checkAssumptionsStillOpen (mods : TSyntax ``Lean.Parser.Command.declModifiers) (declId : Syntax) : CommandElabM Unit := do
…
```
def FormalProofLinter.checkProofIsSorryIfFormalProof Warns when a statement with a formal_proof annotation has a proof that is not exactly sorry or by sorry, unless it is conditional sorry line 87 source
Source documentation
Warns when a statement with a formal_proof annotation has a proof that is not exactly sorry or by sorry, unless it is conditional. The main branch is a statement repository, so proofs should live in their own repository or branch.

standard axioms: Classical.choice, Quot.sound, propext what this means
Statement uses: Lean.TSyntax, List.cons, Lean.SyntaxNodeKind, Lean.Name.mkStr4, List.nil, Lean.Syntax, Lean.Elab.Command.CommandElabM, Unit
Proof uses: Bind.bind, Lean.Elab.Modifiers, Lean.Elab.elabModifiers, StateRefT', IO.RealWorld, Lean.Elab.Command.State, EIO, Lean.Exception, Lean.Elab.Command.Context, Prod, Lean.Name, Lean.Elab.expandDeclIdCore, Lean.Environment, Lean.MonadEnv.getEnv, ite, Eq, Bool, Lean.Elab.Modifiers.isPrivate, Bool.true, Lean.mkPrivateName and 28 more
28 instances, coercions and auxiliary constants left out.
```
def checkProofIsSorryIfFormalProof (mods : TSyntax ``Lean.Parser.Command.declModifiers) (declId : Syntax) (val : TSyntax ``Lean.Parser.Command.declVal) : CommandElabM Unit := do
…
```
def FormalProofLinter.formalProofLinter Checks the assumptions named by a conditional formal_proof and ensures formal_proof statements are sorry line 111 source
Source documentation
Checks the assumptions named by a conditional formal_proof and ensures formal_proof statements are sorry.

standard axioms: Classical.choice, Quot.sound, propext what this means
Statement uses: Lean.Elab.Command.Linter
Proof uses: Lean.Elab.Command.Linter.mk, Lean.withSetOptionIn, Lean.Syntax, ite, Lean.Elab.Command.CommandElabM, Unit, Eq, Bool, Lean.Syntax.isOfKind, Lean.Name.mkStr4, Bool.true, Lean.Syntax.getArg, OfNat.ofNat, Nat, cond, Bool.or, Bool.false, Lean.TSyntax, List.cons, Lean.SyntaxNodeKind and 16 more
8 instances, coercions and auxiliary constants left out.
```
def formalProofLinter : Linter where
…
```