Formal Verification of Romanov's Triplet Logic: A Verified Filter for Sliding-window 3-CNF with Application to Structured Formulas

Abstract: We present the first mechanised formalisation of Romanov's Triplet Logic (TLS) in the Rocq proof assistant. TLS is a triplet-based combinatorial framework for reasoning about compatible paths through layered triplet structures, called Compact Triplets Structures (CTS), and their intersection via Romanov's Effective Procedure, which we refer to as Simple Vertex Intersection (SVI). Originally motivated by Boolean satisfiability, TLS constitutes a self-contained mathematical theory whose formal properties had not been previously established. We formalise the core of TLS in Rocq, including Compact Triplets Formulas (CTF), CTS, hyperstructures, clearing, and SVI. For the well-formed sliding-window fragment we verify a clause-by-clause CNF-to-CTF translation, the clearing procedure, and aligned intersection, and we prove explicit polynomial-time bounds for the filter stages. Our main contribution is a precise correctness boundary: the existence of a joint satisfying set implies non-emptiness of SVI, but the converse does not hold in general; for aligned structures we recover a complete bi-implication, extended to systems of structures. We also formalise soundness of grouped-window translation and exhibit a formal counterexample to its completeness. We introduce VFR, an extracted OCaml prototype that provides a verified decision procedure for the sliding-window fragment and a sound one-sided filter for general 3-CNF, with a Python runtime and reproducible Docker packaging. Benchmarks on random and structured instances confirm the predicted behaviour, and the complete toolchain is available as a curated Zenodo artifact. The Rocq development comprises more than 23,000 lines of code across seventeen files, with 427 proved lemmas and theorems and zero admitted goals.

• The paper formalises Romanov’s Triplet Logic in over 23,000 lines of Rocq code with 427 proved results and no admitted goals, establishing a machine-checked foundation for its triplet structures and algorithms.
• The verified analysis proves that Simple Vertex Intersection is a sound one-sided filter but not a complete satisfiability test, while aligned intersection restores an exact correspondence between compatible satisfying sets and full-length paths.
• The extracted VFR solver is sound and complete for grouped sliding-window 3-CNF, with filter bounds up to 200n⁴ + 200, although its exponential post-check and unverified grouped-window decomposition limit broader applicability.

This paper presents the first mechanised formalisation of Romanov's Triplet Logic (TLS) in the Rocq proof assistant, together with a prototype solver (VFR) built on the verified core. The work is notable less for algorithmic novelty than for its precision: it determines exactly where TLS is correct, where it fails, and what complexity bounds hold, all with machine-checked proofs and zero admitted goals across a development of more than 23,000 lines of Rocq code in seventeen files containing 427 proved lemmas and theorems.

Background: triplet structures as a SAT representation

TLS encodes a 3-CNF formula as a Compact Triplets Formula (CTF): each clause over variables $(x_i, x_j, x_k)$ becomes a forbidden 3-bit triplet, grouped into tiers. Complementing each tier yields a Compact Triplets Structure (CTS) containing all triplets not forbidden by the corresponding clause. Two triplets are compatible when they agree on overlapping positions ($a_2 = b_1$ and $a_3 = b_2$); a satisfying assignment corresponds to a full-length path of compatible triplets through the tiers. The compatibility relation is exactly 2-regular in each direction, a fact proved formally. Romanov's Simple Vertex Intersection (SVI) computes common vertices between two structures' basic graphs, under the assumption that non-emptiness of SVI coincides with existence of a joint satisfying set (JSS).

The correctness boundary

The paper's central negative result refines Romanov's claim. Only the forward direction holds: existence of a JSS implies SVI non-emptiness (Theorem forward-main), proved in Rocq for pairs and extended to systems of $k$ structures. The converse fails. Exhaustive model checking over 787,244 cases plus 500 random instances found counterexamples to every claimed reverse implication, and the failure mode is characterised precisely: SVI matches triplets by value without tier alignment, so cross-tier matches and partial tier matches produce false positives. Concrete two-tier examples are given where every aligned tier pair is disjoint yet SVI reports non-empty.

Two further formally proved limitations sharpen the picture. First, a semantic gap theorem shows that the weak formula-level predicate $\mathrm{satisfies\_ctf}$, which checks each 3-bit window independently, admits locally consistent assignments that yield no compatible path after clearing; completeness is recovered only via aligned intersection. Second, and more strikingly, clearing is not conservative: because $\mathrm{can\_adjoin}$ requires forward-compatible successors while path building checks only backward compatibility, a three-tier structure exists whose unique valid path is destroyed by clearing. Clearing nevertheless remains sound (it never creates paths) and monotone, terminates with a tight measure on total structure size, and admits a fixed-point characterisation whereby every surviving triplet has compatible neighbours in both adjacent tiers.

Positive results: aligned intersection and verified translation

The constructive counterpart to these negatives is a new bi-implication absent from Romanov's original work: for non-empty structures of equal length, the aligned intersection contains a full-length path if and only if a compatible joint satisfying set exists (Theorem compat), extended by induction to systems of $k$ aligned structures. Although conceptually a restatement of compatibility, its mechanisation certifies mutual consistency among three independently defined notions—compatible satisfying sets, aligned intersection, and the recursive path-building algorithm—and enables extraction of a correct-by-construction decision procedure.

On the translation side, the paper proves that for well-formed sliding-window CNF (each clause covering three consecutive variables), standard CNF satisfiability coincides with CTF satisfiability under a clause-by-clause pipeline, and that any extracted path yields a genuinely satisfying assignment. A verified constructive solver for grouped sliding-window CNF with disjoint variable ranges is proved both sound and complete and extracts to OCaml (VFR.ml, 786 lines). A further result shows clearing is the identity on single-forbidden structures, collapsing its cost from quartic to quadratic for the verified fragment.

Verified polynomial bounds

A mechanised cost model assigns unit cost to every cons cell, compatibility check, and traversal, yielding explicit closed-form inequalities proved by induction rather than asymptotic argument:

Stage	Bound
Generic clearing	$100n^4 + 100$
Single-forbidden clearing	$2000n^2 + 2000$
SVI filter	$3n^2 + 7$
Full filter pipeline	$a_2 = b_1$0

These bounds apply only to the filter stages; the complete decision procedure retains an exponential post-check ($a_2 = b_1$1 path enumeration), which is unavoidable absent $a_2 = b_1$2.

Scope restrictions and their justification

The paper is candid that the verified fragment is narrow. Well-formed sliding-window CNF has primal graph pathwidth at most 2 and is solvable in linear time by classical dynamic programming; the verified polynomial bounds therefore reconstruct an already-tractable class within Romanov's framework rather than expanding it. Moreover, deciding whether an arbitrary 3-CNF admits a sliding-window variable ordering is equivalent to testing whether a 3-uniform hypergraph has pathwidth at most 2, which is NP-complete; the verified exhaustive permutation search is thus practical only for $a_2 = b_1$3. The grouped-window decomposition used by the VFR prototype for general inputs is explicitly unverified: a formalised counterexample shows it is sound but incomplete as a filter, since the weak predicate ignores consistency across overlapping windows.

VFR architecture and empirical behaviour

VFR combines the polynomial SVI filter with an exponential post-check and final verification against the original CNF. SAT assignments are checked by the extracted $a_2 = b_1$4; UNSAT proofs from the Z3 fallback are checked by the Rocq-extracted Swansea RUP checker, so verification failures raise errors rather than falling back silently. Empirically, agreement with brute force is 100% on the verified fragment (exhaustively validated for $a_2 = b_1$5) and on small random instances, confirming the post-check eliminates all false positives. On random 3-SAT the heuristic filter is ineffective—SVI almost never returns False—which the authors present as confirmation of theory rather than a defect: emptiness requires tightly constrained shared variable triples. On dense structured instances the filter rejects between 19% and 100% of UNSAT cases in small experiments, though these figures concern the unverified heuristic shell.

Limitations and open problems

The principal limitation is the exponential post-check, compounded by the absence of clause learning or any analogue of conflict-driven pruning. Four gaps remain open: a verified CNF-to-CTF translation for grouped-window formulas (identified as the single most important open problem for end-to-end verification); a verified polynomial or FPT permutation search for medium-sized structured instances; extension of the cost model beyond the filter stages; and a conjectured correspondence between clearing derivations on single-forbidden structures and short resolution proofs, which would let the kernel emit DRAT/RUP certificates. TLA+ model checking serves only as an auxiliary sanity check, exhausting TLC memory beyond two variables—a limitation the authors accept given that general guarantees come from Rocq.

Conclusion

The paper establishes TLS as a rigorously delimited combinatorial framework: SVI is a provably correct one-sided filter whose converse fails for identifiable geometric reasons; aligned intersection restores a complete bi-implication for pairs and systems; and the tractable sliding-window fragment carries machine-checked polynomial bounds and an extractable solver. The contribution is a certified reformulation of a known-tractable fragment rather than a new complexity result, but the exactness of the correctness boundary—formal counterexamples rather than informal caveats—and the fully mechanised trust boundary make this a substantive case study in verifying a non-classical constraint-solving architecture.