Four Paradoxes and a Proof Assistant: Burali-Forti, Diaconescu, Reynolds, and Hurkens in the coq-paradoxes library

Abstract: This article reads the four paradoxes mechanised in the coq-paradoxes package, namely the Burali-Forti paradox in system U, the Diaconescu paradox that the axiom of choice entails excluded middle, the Reynolds paradox that System F has no set-theoretic model, and the Hurkens paradox for impredicative Set. The package collects four pieces of mechanised mathematics that, taken together, draw the boundary of the Calculus of Inductive Constructions from the outside: each file formalises a derivation of False in a system close to CIC, and each shows where the kernel of Rocq has been designed to refuse to compile the construction. The article walks through the shared machinery of well-foundedness in Logics.v, reads the Burali-Forti construction in BuraliForti.v against Coquand's analysis of Girard's paradox, sets out the Diaconescu argument in diaconescu.v, reconstructs the Reynolds argument in Reynolds.v via the preinitial PHI-algebra and Lawvere's fixed-point theorem, and follows Geuvers's adaptation of Hurkens in Hurkens_Set.v. The four together establish three boundary conditions on the kernel of Rocq: the placement of impredicativity, the restriction of large elimination, and the discipline of universe constraints. The article argues that the package is best read not as a collection of curiosities but as a negative specification of what Rocq's kernel had to be designed to refuse, and as evidence that the refusal is being made for the right reasons.

• The paper demonstrates how formalizing the Burali-Forti, Diaconescu, Reynolds, and Hurkens paradoxes in Coq delineates the kernel's permitted limits within the Calculus of Inductive Constructions.
• It employs a unified well-foundedness framework to systematically block pathological fixed-point constructions and enforce strict universe stratification.
• The study reveals that controlled impredicativity and disciplined elimination rules are essential for maintaining consistency in modern proof assistant kernels.

Synthesis and Analysis of "Four Paradoxes and a Proof Assistant: Burali-Forti, Diaconescu, Reynolds, and Hurkens in the coq-paradoxes library" (2605.27633)

Overview

The paper systematically investigates four foundational paradoxes—Burali-Forti, Diaconescu, Reynolds, and Hurkens—via their mechanized formalizations in the coq-paradoxes library. Each paradox serves as a synthetic boundary test for the design of proof assistant kernels based on the Calculus of Inductive Constructions (CIC), such as the Rocq and Coq kernels. The author demonstrates that the library constitutes a negative specification: the encoded paradoxes delineate the permissive limits enforced by the kernel, revealing which meta-theoretical hypotheses are categorically unsound and thus systematically rejected.

Shared Formal Infrastructure

A key unifying theme is the technical machinery of well-foundedness, concretely embodied as the accessibility predicate in the Logics.v module. The predicate ACC formalizes well-founded relations and enables critical reductions in the Burali-Forti and Reynolds paradoxes. The lemma ACC_nonreflexive establishes that accessible elements cannot be reflexively related under any well-founded relation, a property that operationalizes key steps in paradox derivations by converting purported fixed-points into contradictions. The package further leverages inverse image constructions to transport well-foundedness across morphisms, serving both the structural needs of Burali-Forti and Reynolds. This uniform proof infrastructure enables the precise formalization of foundational contradictions within the expressive but finitely circumscribed type theory of the kernel.

The Burali-Forti Paradox and Universe Stratification

The mechanization of Burali-Forti’s paradox targets the impredicative extension of system U and demonstrates the infeasibility of a universal type of relations, which would yield a “largest ordinal” within the universe hierarchy. The formalization creates a type $A_0$ parameterized by all relation-typed types and explores injection properties between relational structures. The definition of an embedding relation over $A_0$ and the attempted formation of a self-representing element $\Omega = i_0(A_0, \text{emb})$ triggers the paradox: $\Omega$ becomes related to itself, violating non-reflexivity.

Rocq's kernel, however, strategically prevents this construction from compiling by imposing universe constraints that the paradox's type-theoretic requirements cannot satisfy; the requisite universe inclusion $j \geq i$ contradicts the enforced stratification $j < i'$. This exemplifies how sound type-theoretic foundations enforce stratification at a meta-logical level, bypassing logical content in favor of universe discipline to avert paradoxes. This boundary is systematically structural rather than ad hoc.

Diaconescu’s Paradox: Choice and Excluded Middle

The Diaconescu formalization operationalizes the relationship between a typed axiom of choice and the derivability of the law of excluded middle (LEM) in constructive settings. By defining a minimal choice principle over equivalence relations and constructing a custom inductive relation over booleans parameterized by an arbitrary proposition $P$, the development shows that such choice implies $P \vee \neg P$ for all $P : \text{Prop}$. The mechanism exploits the extensionality inherent in functional existence within CIC and the decidable equality of booleans.

The formal system thereby rules out the possibility of combining this form of choice with constructive logic at the level of computational types (Set), since LEM would consequentially propagate into computational content, defying the proof-theoretic intent of constructive type theory. The proof is constructive: a term is synthesized that “decides” $P$ based on the behavior of a choice function, confirming the incompatibility at a foundational computational level.

Reynolds’ Paradox: Set-Theoretic Inadmissibility of Polymorphism

Reynolds’ paradox, widely recognized for the insight that System F’s polymorphism defies set-theoretic modeling, is transposed into Coq’s context as the impossibility of a set-theoretic injection from $A_0$0 into any proposition, underlining the non-classical nature of impredicative polymorphic quantification. The mechanization constructs a hypothetical injection and partial inverse, builds the relevant per-quotiented algebraic structure using Church encodings (A0 and its quotient by the per $A_0$1), and applies the Lawvere fixed-point theorem to derive a contradiction.

Notably, the paradox’s operational step—constructing a fixed point of negation as a function from $A_0$2 to itself—conclusively demonstrates the unsoundness of set-theoretically interpretable impredicative polymorphism. Additionally, the derived proof that excluded middle entails full proof irrelevance in $A_0$3 emphasizes the intimate relationship between logical and proof-theoretic content in impredicative systems. The kernel’s universe discipline again forestalls this pathological injection, preempting logical inconsistency at the universe arithmetic level.

Hurkens’ Paradox: Impredicativity, Large Elimination, and Excluded Middle in Set

Hurkens’ paradox, in the form adapted by Geuvers, utilizes a self-referential retract construction between $A_0$4 and a small type (bool), parameterized by double-negation translation, to demonstrate that combining impredicativity with classical logic (excluded middle) in the Set sort is inconsistent. Through a series of dependent definitions (V, U, sb, le, induct, WF), the construction encodes an impredicative initial algebra in Set, arriving at a contradiction through Lawvere’s fixed-point style reasoning.

The kernel’s discipline—strictly separating the locations where impredicativity and large elimination are permitted (impredicativity restricted to Prop, large elimination to certain types)—is shown to be necessary for consistency. The mechanization thus exposes that classical logic in Set (either in the form $A_0$5 or $A_0$6) is incompatible with CIC, justifying the kernel’s exclusion of such hypotheses.

Boundary Conditions Elucidated by Mechanized Paradoxes

Synthesizing these results, the paper identifies three sharply delineated boundaries fortifying the kernel's consistency:

1. Universe Hierarchy and Stratification: Ensuring every type quantifies only over strictly lower universes prohibits the formation of fixed points over universes, directly blocking constructions typified by Burali-Forti.
2. Controlled Impredicativity: Restricting impredicative quantification to Prop (or carefully gated Set) blocks Reynolds and Hurkens paradoxes, reflecting the incompatibility of unguarded impredicativity with classical reasoning and certain computational principles.
3. Disciplined Large Elimination: Restricting eliminations from Prop to Set, and more generally restricting computational extraction from propositional content, is essential to prevent Diaconescu-like import of classicality into computational universes.

These constraints are not isolated; rather, their interaction—especially regarding the relationship between impredicativity, proof irrelevance, and computational types—emerges as a core design principle for all credible implementations of CIC and its extensions.

Implications and Future Directions

The explicit mechanization and failure of these paradoxes within the coq-paradoxes library serve not merely as historical curiosities, but as executable metatheorems forming the negative specification of the proof assistant's kernel. The approach, which embeds counterexamples as parameterized, unprovable hypotheses, is an effective and transparent strategy for designing and documenting consistency boundaries within proof assistants.

This methodology offers a blueprint for formal specification and self-verification in the construction of new proof engines: encoding canonical paradoxes as unsatisfiable hypotheses provides implementers and users reciprocal visibility into both the system’s powers and its necessary limitations. As type theories are extended with new computational features (such as higher universe polymorphism, quotient types, or new forms of inductive-recursive definitions), this strategy will be increasingly valuable for maintaining consistency and exposing the price of new expressiveness.

On the theoretical side, these mechanized boundaries have ongoing implications for foundational research in type theory, particularly as interest grows in homotopy type theory, higher-categorical semantics, and the design of systems beyond CIC. The library's approach of encoding failures as negative specifications can aid in the systematic study of which features can coexist without leading to inconsistency, and how universe hierarchies interact with complex forms of recursion and polymorphism.

Conclusion

The paper provides a rigorous and detailed analysis of how the mechanized formalization of four canonical paradoxes defines and justifies the design boundaries in modern proof assistant kernels grounded in the Calculus of Inductive Constructions. The coq-paradoxes library thus serves as both formal documentation and practical metatheoretical safeguard, demonstrating that carefully coordinated constraints on universe stratification, impredicativity, and elimination principles are not merely prudent but provably necessary. Future developments in proof theory and the implementation of advanced logical frameworks are likely to continue leveraging these negative specifications as essential instruments for consistency management and system design.