Coq-Paradoxes Package Overview

• Coq-Paradoxes Package is a collection of mechanised derivations of False in systems close to the Calculus of Inductive Constructions, illustrating intrinsic kernel limits.
• It formalises four paradoxes—Burali-Forti, Diaconescu, Reynolds, and Hurkens—to expose how universe stratification, impredicativity, and elimination rules prevent concrete violations.
• The package employs a streamlined well-foundedness framework to showcase how prohibited axioms trigger kernel rejections, defining a negative specification of CIC.

Searching arXiv for the specified paper and closely related mechanized paradox literature to ground the article. arxiv_search: query: "(Alonso, 26 May 2026) OR Four Paradoxes and a Proof Assistant Burali-Forti Diaconescu Reynolds Hurkens coq-paradoxes" max_results: 5

arxiv_search(query="2605.27633", max_results=3)

The coq-paradoxes package is a collection of four mechanised derivations of False formulated in systems close to the Calculus of Inductive Constructions (CIC): the Burali-Forti paradox in system U, Diaconescu’s paradox that the axiom of choice entails excluded middle, Reynolds’s paradox that System F has no set-theoretic model, and Hurkens’s paradox for impredicative Set. Taken together, these developments “draw the boundary of the Calculus of Inductive Constructions from the outside”: each file formalises a contradiction under hypotheses that violate one of the kernel policies of Rocq/Coq, and each also exhibits the point at which the kernel refuses any concrete instantiation of the offending assumption (Alonso, 26 May 2026).

1. Package scope, organisation, and intended reading

The package is organised around a small number of files with sharply delimited roles. Logics.v provides the well-foundedness infrastructure, specifically an accessibility predicate and an inverse-image lemma, used by BuraliForti.v and Reynolds.v. Log_Rel.v supplies a partial-equivalence-relation toolkit used by Reynolds.v. The paradox files are BuraliForti.v, diaconescu.v, Reynolds.v, and Hurkens_Set.v, together with “two small variants/auxiliary files” (Alonso, 26 May 2026).

A compact summary of the package structure is as follows.

File	Main content	Kernel policy implicated
Logics.v	Well-foundedness infrastructure	Shared support
Log_Rel.v	Partial-equivalence-relation toolkit	Shared support
BuraliForti.v	Burali-Forti paradox in system U	Universe constraints
diaconescu.v	Diaconescu paradox	Large elimination
Reynolds.v	Reynolds paradox	Impredicativity of Prop
Hurkens_Set.v	Hurkens paradox for impredicative Set	Impredicativity and elimination discipline

The package is meant to be read operationally. One inspects the Section or Module of a file, notes the Variable or Hypothesis declarations that encode the “forbidden” axiom, checks the proof of Theorem … : False., and then attempts to instantiate the hypothesis with an actual definition. The resulting failure is not incidental: the kernel rejects the construction either by a universe inconsistency, by disallowed large elimination, or by the interaction of impredicativity with unwanted flags (Alonso, 26 May 2026).

This organisation supports the paper’s central interpretation of the library as a negative specification of CIC’s design. Each paradox type-checks only while the problematic principle remains hypothetical; the moment one tries to realise it concretely, the kernel intervenes.

2. Burali-Forti in system U

BuraliForti.v formalises the Burali-Forti paradox under a hypothesis intended to represent a universal type of relations equipped with an injectivity property up to order-morphism. The section begins with the following assumptions (Alonso, 26 May 2026):

Section Burali_Forti_Paradox. Variable A0 : Type. Variable i0 : ∀ X:Type, (X→X→Prop) → A0. Hypothesis inj : ∀ X1 R1 X2 R2, i0 X1 R1 = i0 X2 R2 → ∃ f:X1→X2, ∀ x y, R1 x y → R2 (f x) (f y).

The construction then defines emb : A0→A0→Prop, where emb x y packages witnesses X₁,R₁ and X₂,R₂ with x=i0 X₁ R₁, y=i0 X₂ R₂, a strict order-preserving map f:X₁→X₂, and an upper bound maj∈X₂ satisfying the indicated dominance condition. Intensionally, emb reads as strict embeddability of the ordinal coded by x below that coded by y. On this basis the file introduces

• Ω := i0 A0 emb,
• sub(a) := { x:A0 | emb x a },
• F : A0→A0 with F(a) := i0 (sub a) (embedding on sub a).

The contradiction proceeds in three stages. First, one proves WF emb by transporting accessibility along i0 using inj and the inverse-image lemma from Logics.v; in particular, ACC_nonreflexive _ emb x H_acc H_emb_xx : False whenever emb x x. Second, one shows both ∀a, emb (F a) Ω and that F itself is an order-morphism on (A0,emb). Instantiating at a = Ω yields emb Ω Ω. Third, ACC_nonreflexive excludes self-embedding, so emb Ω Ω implies False (Alonso, 26 May 2026).

The file also demonstrates why Rocq/Coq refuses any actual encoding. If one writes

Record A0 := i0 { X0:Type; R0:X0→X0→Prop }. Definition inj_proof … (* by case analysis on the record *). Definition Paradox := Burali_Forti A0 i0 inj_proof.

the construction fails with a Universe Inconsistency. The stated reason is a clash between two constraints enforced by the kernel: the record A0 lives in some universe Type_i while its field X0:Type_j must satisfy j < i because large elimination on records forces a strict inequality; yet instantiating Ω = i0 A0 emb demands i ≤ j so that A0 itself can appear as an argument to i0 (Alonso, 26 May 2026). The file thereby isolates the role of universe stratification in blocking a Type : Type-style collapse.

3. Diaconescu’s paradox and typed choice on equivalence relations

diaconescu.v treats a typed version of Diaconescu’s argument. The assumed principle is a choice operator for equivalence relations on Set (Alonso, 26 May 2026):

Definition EquivRel (A:Set) (R:A→A→Prop) := (∀ x, R x x) ∧ (∀ x y, R x y→R y x) ∧ (∀ x y z, R x y→R y z→R x z). Hypothesis Tchoice : ∀ (A:Set) (R:A→A→Prop), EquivRel A R → { f:A→A | (∀ x, R x (f x)) ∧ (∀ x y, R x y→f x=f y) }.

The key relation is an inductive rel : bool→bool→Prop with two constructors:

Inductive rel : bool→bool→Prop := | rrefl : ∀ b, rel b b | rel2 : ∀ b c, P→rel b c.

This relation is parametrised by P:Prop. If P holds, rel identifies both booleans; otherwise it is the identity relation. The proof of excluded middle for P is then obtained by showing EquivRel bool rel, invoking Tchoice bool rel to produce f:bool→bool, and comparing f true with f false. If f true = f false, the extensionality condition together with rel2 yields P. If f true ≠ f false, one gets ¬ rel true false, hence ¬P. Therefore P ∨ ¬P (Alonso, 26 May 2026).

The significance of the mechanisation lies not in the derivation alone but in the way the kernel blocks any direct computational realisation. The stated policy is that large elimination from an inductive in Prop with more than one constructor into Set is forbidden. Consequently, a direct definition of the needed choice operator by pattern-matching on rel to compute a function bool→bool would be rejected. In the library, only the proposition-level hypothesis Tchoice is assumed, so the section type-checks; the kernel prevents closing the argument by forbidding the relevant elimination into data (Alonso, 26 May 2026).

A common misunderstanding is to treat the formalisation as a demonstration that Coq validates classical choice principles. The package establishes the opposite point: the contradiction appears only under a hypothesis whose concrete implementation is excluded by the elimination discipline.

4. Reynolds’s paradox and the role of impredicative Prop

Reynolds.v formalises Reynolds’s paradox from an assumed injection of Prop into a single proposition Heyt (Alonso, 26 May 2026):

Variable Heyt : Prop. Variable I : Prop → Heyt. Hypothesis Iinject : ∀ P Q:Prop, I P = I Q → (P ↔ Q).

The development first builds a setoid structure on Heyt by defining

Definition T (h:Heyt) : Prop := ∃ P:Prop, P ∧ h = I P. Definition Heyt_Eq (x y:Heyt) := T x ↔ T y.

It then introduces the endofunctor [PHI](https://www.emergentmind.com/topics/preference-hijacking-phi) on Prop,

$$\mathrm{PHI}(A) := (A \to \mathrm{Heyt}) \to \mathrm{Heyt},$$

and Church-encodes a preinitial algebra:

Definition A0 : Prop := ∀ A:Prop, (PHI A → A) → A. Definition A0_cons (z:PHI A0) : A0 := … Definition A0_match (u:A0) : PHI A0 := …

The “true” initial algebra is obtained by quotienting by the smallest per E0 that makes A0_cons and A0_match inverse in the quotient (Alonso, 26 May 2026).

From the initial algebra property one constructs a surjection

khi : A0 → (A0 → Heyt)

onto the Heyt-valued subsets of A0. A version of Lawvere’s fixed-point theorem then implies that every

arxiv_search(query="2605.27633", max_results=3)

0 has a fixed point inside that surjection. Choosing

arxiv_search(query="2605.27633", max_results=3)

1 produces a fixed point and hence a contradiction, because the resulting h satisfies h = f(h) and “¬h can’t equal h”. The file concludes False, and also shows the stated bonus result EM ⇒ proof_irrelevance in Prop (Alonso, 26 May 2026).

The kernel-side lesson is explicit. The argument “crucially uses impredicativity of Prop (quantification over all Prop) to build the Church encoding”. The same construction would fail in a predicative universe. Coq’s kernel admits impredicativity only at Prop; this makes the formalisation possible while simultaneously identifying why analogous constructions in Set are either refused or tightly constrained (Alonso, 26 May 2026).

5. Hurkens’s paradox for impredicative Set

Hurkens_Set.v develops a version of Hurkens’s paradox from a retract between Prop and the small type bool, but only “up to double negation” (Alonso, 26 May 2026):

arxiv_search(query="2605.27633", max_results=3)

2

The core definitions are compressed but structurally standard for the paradox:

arxiv_search(query="2605.27633", max_results=3)

3

Here U is described as “a universe-polymorphic encoding of a self-referential well-founded predicate”, and the key enabling ingredients are impredicative Set together with large elimination via p2b (Alonso, 26 May 2026).

The contradiction is organised as follows. One first proves that WF is well-founded under le, using induct and double negation. One then instantiates a particular i : U→bool and proves that i satisfies induct. From this, one derives dn (b2p (i WF)). Separately, p2p2 yields b2p (p2b (i WF)); combined with p2p1, this gives False. The file also states that, assuming classical excluded middle in Set, one may define

arxiv_search(query="2605.27633", max_results=3)

4 In that case both p2p1 and p2p2 follow by case analysis on EM_set, so the paradox shows that excluded middle in Set is inconsistent (Alonso, 26 May 2026).

The kernel blocks this route in two independent ways. Coq keeps Set predicative by default, so the impredicative quantification required by V is unavailable in ordinary settings. In addition, while certain Set-inductives admit large elimination, Prop does not permit the general eliminations needed to define p2b : Prop→bool by pattern-matching on a proposition. Thus the retract can be assumed for metatheoretic study but cannot be concretely defined in the kernel (Alonso, 26 May 2026).

6. Shared well-foundedness machinery in Logics.v

The common infrastructure of the package is deliberately small. Logics.v defines the accessibility predicate

arxiv_search(query="2605.27633", max_results=3)

5

and the derived notion

arxiv_search(query="2605.27633", max_results=3)

6 It also proves

arxiv_search(query="2605.27633", max_results=3)

7 The informal reason given is that if x were related to itself, one could descend indefinitely through the single constructor ACC_intro, reaching contradiction (Alonso, 26 May 2026).

A further inverse-image lemma states that given f:X→A and WF A R, one may define Rof x y := R (f x) (f y) and prove WF X Rof. This development is said to be the “common engine” for Burali-Forti’s proof that emb is well-founded and for Reynolds’s transport of order-relations through the Church quotient, while remaining “harmless in plain CIC” (Alonso, 26 May 2026).

This shared substrate is important for interpretation. The paradoxes do not rely on ad hoc proof engineering in every file; rather, they reuse a minimal piece of constructive well-foundedness theory and differ only in the hypotheses that the kernel refuses to instantiate.

7. Boundary conditions on the kernel and the package’s metatheoretical status

Read jointly, the four paradoxes establish three boundary conditions on the kernel of Rocq/Coq (Alonso, 26 May 2026).

1. Universe hierarchy. The kernel disallows Type : Type and any fixed-point universe arrangement that would let a type quantify over itself. This is the barrier that prevents the closure of the Burali-Forti construction.
2. Placement of impredicativity. Only Prop is impredicative, while Set and higher universes remain predicative in the default mode. Reynolds’s construction relies on the impredicativity of Prop; Hurkens’s construction would require impredicative Set together with excluded middle, which the kernel refuses by default.
3. Discipline of large elimination. Elimination from Prop into Prop is allowed, and certain eliminations from Set into Type or Set are allowed, but “general Prop-inductives” with more than one constructor may not be eliminated into Set or Type. This blocks direct Diaconescu-style extraction of computational data from a two-constructor proposition and prevents definitions such as p2b : Prop→bool.

Within the package, each paradox is packaged in a section of the form

arxiv_search(query="2605.27633", max_results=3)

8

The proofs of False therefore type-check under hypotheses alone. No section instantiates its own variables with a concrete definition or axiom; whenever one attempts to do so, the universe checker or elimination checker rejects the construction. For that reason, the package does not present an inconsistency of Coq. It functions instead as a runnable metamathematical account of what the kernel “had to be designed to refuse”, and why that refusal occurs for the stated reasons (Alonso, 26 May 2026).

In that sense, the coq-paradoxes package is best understood not as a collection of isolated curiosities but as a concentrated negative specification of CIC: universe self-reference, impredicative Set combined with classical principles, and unrestricted elimination from Prop into data are each formalised far enough to derive False, and each is then blocked at the precise point where the kernel draws the line.