- The paper introduces an orchestration layer that combines cross-backend theorem citation, multi-axis convergence, and AI-driven proof dispatch while keeping final authority in trusted verification kernels.
- The validation mechanically discharged 26 residual Raft axioms in 17 active hours, achieved six-axis agreement for key arithmetic properties, and identified four production defects, including a potential $10^12$ funding overcharge.
- The paper shows that federated verification can expose correspondence errors through independent counterexamples, but emphasizes that human-authored TLA+ correspondence certificates remain the main unresolved trust gap.
The cost-of-rigour frontier and the case for federation
The paper identifies three structural constraints that have kept mechanical verification of production systems expensive for decades. Backend monoculture: every published mechanical proof of a Raft-family safety property rests on exactly one verifier — TLAPS for Ongaro's thesis and MongoRaftReconfig, Coq for Verdi-Raft and Velisarios, Dafny+Z3 for IronFleet, Ivy+Z3 for the Padon/Scimitar line — so a kernel soundness bug or stdlib axiom shift is a single point of failure for the entire artefact. Excluded algorithmic scope: Verdi-Raft explicitly omits reconfiguration, log compaction, and linearizable client reads; etcd's TLA+ specification covers only a subset of state transitions; CCF's authors describe their consensus as "based on an unproven algorithm." Per-axiom serialisation: multi-person-year campaigns (IronFleet at 3.7 person-years for IronRSL; Verdi-Raft at roughly 2 person-years) are rate-limited by one specialist iterating on one obligation at a time.
The paper's response is not an advance in any single kernel but an orchestration layer that composes three mechanisms: cross-backend citation, cross-axis convergence, and AI-orchestrated mass-parallel dispatch. Crucially, verification authority never leaves the kernels — the AI layer is untrusted proof-search labour inside a trusted CI envelope.
The architecture
Cross-backend citation discharges a TLA+ obligation via a structured CITED: tag naming an external theorem in Coq, Lean 4, Why3, Apalache, standalone Z3 over hand-encoded SMT-LIB v2, or CBMC. A Gradle task wired as a transitive dependency of the host TLAPS check enforces three properties on every commit: the cited theorem exists, its proof file checks cleanly under its own kernel, and the kernel's closure directive (Print Assumptions in Coq, #print axioms in Lean 4) reports no Admitted, Axiom, or non-whitelisted assumptions. Drift-resistance is thus by construction rather than by operator attestation. Dual-citation gates require agreement between two independent kernels (typically Coq and Lean 4); triple gates add Apalache bounded symbolic model checking.
The primitive differs structurally from Bythos-style embedding: Bythos encodes TLA semantics once inside Coq and retires per-obligation correspondence concerns globally, whereas citation keeps TLA semantics in TLAPS and pays a per-obligation cost — a correspondence certificate, currently human-asserted, claiming the cited external theorem is semantically equivalent to the TLA+ obligation. This certificate is named explicitly as a first-class component of the trust base and as the principal open problem.
Cross-axis convergence records per-obligation verdicts across sixteen backends spanning deductive, bounded symbolic, probabilistic (PRISM CTMC), SMT/saturation, and production-language axes (CBMC on native code, Lincheck on JVM). The composition is operational — build-system-enforced conjunctive agreement — and the paper is careful to state this is not a logical soundness theorem. Epistemic value scales with paradigm disjointness: Coq versus Lean share CIC ancestry and carry weaker orthogonality than deductive-versus-BMC contrasts.
AI-orchestrated dispatch fans out twenty specialist agents across four waves under a single coordinator that routes obligations by static structural signal (recursive operators → Coq Fixpoint; bounded quantifiers → Z3; randomized scheduling → PRISM), races capable backends speculatively from t=0, and accepts the first kernel-confirmed PROVED verdict. The load-bearing discipline is honest-negative reporting: every specialist must return structured NEGATIVE_RESULT rather than fabricate success, and negatives trigger cross-axis re-dispatch rather than within-tool retry. Routing signals are kernel-emitted verdicts, not LLM self-assessments — the departure from the plan-then-execute and Reflexion-family precedent set.
A fourth methodological distinction separates the load-bearing algorithmic chain (TLA+ spec → TLAPS proof → annotation-processor-generated runtime invariant hooks) from the annotation-layer chorus, so a regression in any single chorus axis does not invalidate the algorithmic claim.
Validation results
The validation covers two production subsystems of the Mercury HFT platform running in one JVM process: full-scope Raft (joint consensus, leadership transfer, log compaction, linearizable client reads, dynamic reconfiguration) and the Themis matching engine's financial-arithmetic layer.
On Raft, the campaign reduced a 26-axiom residual census to zero in 17 active single-session hours, with median per-axiom Coq verification wallclock of 34.4 s (8/8 PASS, ~1.3 GB peak RSS) against a 30–40 hour Path-A.2 ghost-composition estimate — roughly three orders of magnitude on verifier runtime and ≈60× on authoring time. All five canonical Raft liveness properties reach mechanical discharge, achieving functional IronFleet-parity: four via dual deductive closure (TLAPS per-state safety induction plus Coq temporal composition, necessitated by tlapm's LS4 backend rejecting the PTL composition lemma), and one via PRISM probabilistic discharge where randomized election timeouts make deductive treatment inappropriate. Five numeric canonicals achieve six-axis chorus discharge.
The wallclock claims are reported under an explicit comparator-hygiene template with baseline-source labels: the within-method 50–60× ratio is author-generated against the same team's serial estimate (selection bias disclosed); the headline ≈60× is author-prior (Path-A.2); the cross-precedent 635×/453× against IronFleet carries three scope qualifiers (cross-protocol, cross-scope, cross-rigour) and reflects a larger trusted base since verified extraction is not claimed. The ratios are acknowledged to be properties of 2026 agent compute economics.
Bug-finding empirics substantiate that the machinery is not ornamental: CBMC surfaced three real defects in FFM-wrapped native libraries invisible to valgrind, ASan, UBSan, and upstream fuzz corpora, and the SpecBridge runtime hook caught a perp-funding bug that would have produced a 1012 over-charge of accrued funding — a silent multiplicative scale mismatch structurally invisible to single-backend specification campaigns.
Negative results and falsifiability
Three negative results demonstrate the architecture detecting its own failure modes. Most notably, Apalache symbolic exploration produced a six-step counter-example to the unconditional form of LogPositionTermMatchAxiom, revealing that the cited Coq theorem proved only a local pair-property — strictly weaker than the TLA+ claim. The response was hypothesis-strengthening the TLA+ statement to match the discharged scope, an existence-proof that kernel-agreement gates catch correspondence divergences single-kernel discharge would miss. A five-FAIL PRISM cluster was reclassified post hoc as model-abstraction bugs, and Apalache's <dynamic> integer-range encoding limit yielded a generalisable dispatch heuristic: recursive operators over unbounded integer domains route to deductive Fixpoint, not bounded SMT.
Limitations and open problems
The paper is unusually explicit about what it does not claim. No verified extraction with a soundness theorem is asserted — the trusted base (JVM, unit-test suite, SpecBridge runtime, build system) is larger than what Verdi or IronFleet accept. The convergence matrix's value rests on the assumption that multi-kernel agreement implies semantic correctness, which is empirically defensible but not a theorem. The InvariantTranslator's TLA+→Java rewrite rules are human-authored and unmechanised. Kernel independence is assumed in the strong sense of disjoint implementations, not mathematical independence. Generalisability is bounded to two proof-shape classes. The principal open problem remains mechanising correspondence certificates — producing per-citation kernel-checked equivalence proofs between the TLA+ obligation and the cited external theorem — with candidate approaches including shallow embeddings, schema-based translation rules proved once, and meta-kernel-checked equivalence theorems.
Conclusion
This paper contributes a compositional orchestration layer around heterogeneous proof systems rather than a faster single kernel. Its empirical validation — a zeroed 26-axiom Raft census in seventeen hours, six-axis discharge of financial-arithmetic canonicals, four production bugs found, and a demonstrated capacity to catch its own correspondence mismatches — supports the claim that federated verification can compress the cost-of-rigour frontier without weakening the soundness claim, provided the residual human-asserted correspondence certificates are eventually mechanised.
