---
title: Coq-Paradoxes Package Overview
url: https://www.emergentmind.com/topics/coq-paradoxes-package
type: topic
---

# Coq-Paradoxes Package Overview

Searching arXiv for the specified paper and closely related mechanized paradox literature to ground the article.
arxiv_search:
  query: "arXiv:2605.27633 OR Four Paradoxes and a Proof Assistant Burali-Forti Diaconescu Reynolds Hurkens coq-paradoxes"
  max_results: 5
```tool
arxiv_search(query="2605.27633", max_results=3)
```
The **coq-paradoxes** package is a collection of four mechanised derivations of `False` formulated in systems close to the Calculus of Inductive Constructions (CIC): the Burali-Forti paradox in system U, Diaconescu’s paradox that the axiom of choice entails excluded middle, Reynolds’s paradox that System F has no set-theoretic model, and Hurkens’s paradox for impredicative `Set`. Taken together, these developments “draw the boundary of the Calculus of Inductive Constructions from the outside”: each file formalises a contradiction under hypotheses that violate one of the kernel policies of Rocq/Coq, and each also exhibits the point at which the kernel refuses any concrete instantiation of the offending assumption [2605.27633].

## 1. Package scope, organisation, and intended reading

The package is organised around a small number of files with sharply delimited roles. `Logics.v` provides the well-foundedness infrastructure, specifically an accessibility predicate and an inverse-image lemma, used by `BuraliForti.v` and `Reynolds.v`. `Log_Rel.v` supplies a partial-equivalence-relation toolkit used by `Reynolds.v`. The paradox files are `BuraliForti.v`, `diaconescu.v`, `Reynolds.v`, and `Hurkens_Set.v`, together with “two small variants/auxiliary files” [2605.27633].

A compact summary of the package structure is as follows.

| File | Main content | Kernel policy implicated |
|---|---|---|
| `Logics.v` | Well-foundedness infrastructure | Shared support |
| `Log_Rel.v` | Partial-equivalence-relation toolkit | Shared support |
| `BuraliForti.v` | Burali-Forti paradox in system U | Universe constraints |
| `diaconescu.v` | Diaconescu paradox | Large elimination |
| `Reynolds.v` | Reynolds paradox | Impredicativity of `Prop` |
| `Hurkens_Set.v` | Hurkens paradox for impredicative `Set` | Impredicativity and elimination discipline |

The package is meant to be read operationally. One inspects the `Section` or `Module` of a file, notes the `Variable` or `Hypothesis` declarations that encode the “forbidden” axiom, checks the proof of `Theorem … : False.`, and then attempts to instantiate the hypothesis with an actual definition. The resulting failure is not incidental: the kernel rejects the construction either by a universe inconsistency, by disallowed large elimination, or by the interaction of impredicativity with unwanted flags [2605.27633].

This organisation supports the paper’s central interpretation of the library as a **negative specification** of CIC’s design. Each paradox type-checks only while the problematic principle remains hypothetical; the moment one tries to realise it concretely, the kernel intervenes.

## 2. Burali-Forti in system U

`BuraliForti.v` formalises the Burali-Forti paradox under a hypothesis intended to represent a universal type of relations equipped with an injectivity property up to order-morphism. The section begins with the following assumptions [2605.27633]:

```coq
Section Burali_Forti_Paradox.
Variable A0 : Type.
Variable i0 : ∀ X:Type, (X→X→Prop) → A0.
Hypothesis inj :
  ∀ X1 R1 X2 R2, i0 X1 R1 = i0 X2 R2 →
  ∃ f:X1→X2, ∀ x y, R1 x y → R2 (f x) (f y).
```

The construction then defines `emb : A0→A0→Prop`, where `emb x y` packages witnesses `X₁,R₁` and `X₂,R₂` with `x=i0 X₁ R₁`, `y=i0 X₂ R₂`, a strict order-preserving map `f:X₁→X₂`, and an upper bound `maj∈X₂` satisfying the indicated dominance condition. Intensionally, `emb` reads as strict embeddability of the ordinal coded by `x` below that coded by `y`. On this basis the file introduces
- `Ω := i0 A0 emb`,
- `sub(a) := { x:A0 | emb x a }`,
- `F : A0→A0` with `F(a) := i0 (sub a) (embedding on sub a)`.

The contradiction proceeds in three stages. First, one proves `WF emb` by transporting accessibility along `i0` using `inj` and the inverse-image lemma from `Logics.v`; in particular, `ACC_nonreflexive _ emb x H_acc H_emb_xx : False` whenever `emb x x`. Second, one shows both `∀a, emb (F a) Ω` and that `F` itself is an order-morphism on `(A0,emb)`. Instantiating at `a = Ω` yields `emb Ω Ω`. Third, `ACC_nonreflexive` excludes self-embedding, so `emb Ω Ω` implies `False` [2605.27633].

The file also demonstrates why Rocq/Coq refuses any actual encoding. If one writes

```coq
Record A0 := i0 { X0:Type; R0:X0→X0→Prop }.
Definition inj_proof …  (* by case analysis on the record *).
Definition Paradox := Burali_Forti A0 i0 inj_proof.
```

the construction fails with a *Universe Inconsistency*. The stated reason is a clash between two constraints enforced by the kernel: the record `A0` lives in some universe `Type_i` while its field `X0:Type_j` must satisfy `j < i` because large elimination on records forces a strict inequality; yet instantiating `Ω = i0 A0 emb` demands `i ≤ j` so that `A0` itself can appear as an argument to `i0` [2605.27633]. The file thereby isolates the role of universe stratification in blocking a `Type : Type`-style collapse.

## 3. Diaconescu’s paradox and typed choice on equivalence relations

`diaconescu.v` treats a typed version of Diaconescu’s argument. The assumed principle is a choice operator for equivalence relations on `Set` [2605.27633]:

```coq
Definition EquivRel (A:Set) (R:A→A→Prop) :=
    (∀ x, R x x) ∧ (∀ x y, R x y→R y x) ∧ (∀ x y z, R x y→R y z→R x z).

Hypothesis Tchoice :
    ∀ (A:Set) (R:A→A→Prop), EquivRel A R →
      { f:A→A | (∀ x, R x (f x)) ∧ (∀ x y, R x y→f x=f y) }.
```

The key relation is an inductive `rel : bool→bool→Prop` with two constructors:

```coq
Inductive rel : bool→bool→Prop :=
| rrefl : ∀ b, rel b b
| rel2  : ∀ b c, P→rel b c.
```

This relation is parametrised by `P:Prop`. If `P` holds, `rel` identifies both booleans; otherwise it is the identity relation. The proof of excluded middle for `P` is then obtained by showing `EquivRel bool rel`, invoking `Tchoice bool rel` to produce `f:bool→bool`, and comparing `f true` with `f false`. If `f true = f false`, the extensionality condition together with `rel2` yields `P`. If `f true ≠ f false`, one gets `¬ rel true false`, hence `¬P`. Therefore `P ∨ ¬P` [2605.27633].

The significance of the mechanisation lies not in the derivation alone but in the way the kernel blocks any direct computational realisation. The stated policy is that large elimination from an inductive in `Prop` with more than one constructor into `Set` is forbidden. Consequently, a direct definition of the needed choice operator by pattern-matching on `rel` to compute a function `bool→bool` would be rejected. In the library, only the proposition-level hypothesis `Tchoice` is assumed, so the section type-checks; the kernel prevents closing the argument by forbidding the relevant elimination into data [2605.27633].

A common misunderstanding is to treat the formalisation as a demonstration that Coq validates classical choice principles. The package establishes the opposite point: the contradiction appears only under a hypothesis whose concrete implementation is excluded by the elimination discipline.

## 4. Reynolds’s paradox and the role of impredicative `Prop`

`Reynolds.v` formalises Reynolds’s paradox from an assumed injection of `Prop` into a single proposition `Heyt` [2605.27633]:

```coq
Variable Heyt : Prop.
Variable I    : Prop → Heyt.
Hypothesis Iinject :
  ∀ P Q:Prop, I P = I Q → (P ↔ Q).
```

The development first builds a setoid structure on `Heyt` by defining
```coq
Definition T (h:Heyt) : Prop := ∃ P:Prop, P ∧ h = I P.
Definition Heyt_Eq (x y:Heyt) := T x ↔ T y.
```
It then introduces the endofunctor `PHI` on `Prop`,
\[
\mathrm{PHI}(A) := (A \to \mathrm{Heyt}) \to \mathrm{Heyt},
\]
and Church-encodes a preinitial algebra:
```coq
Definition A0 : Prop := ∀ A:Prop, (PHI A → A) → A.
Definition A0_cons  (z:PHI A0) : A0 := …
Definition A0_match (u:A0) : PHI A0 := …
```
The “true” initial algebra is obtained by quotienting by the smallest per `E0` that makes `A0_cons` and `A0_match` inverse in the quotient [2605.27633].

From the initial algebra property one constructs a surjection
```coq
khi : A0 → (A0 → Heyt)
```
onto the `Heyt`-valued subsets of `A0`. A version of Lawvere’s fixed-point theorem then implies that every
```coq
f : Heyt → Heyt
```
has a fixed point inside that surjection. Choosing
```coq
f(h) := I (¬ T h)
```
produces a fixed point and hence a contradiction, because the resulting `h` satisfies `h = f(h)` and “`¬h` can’t equal `h`”. The file concludes `False`, and also shows the stated bonus result `EM ⇒ proof_irrelevance` in `Prop` [2605.27633].

The kernel-side lesson is explicit. The argument “crucially uses impredicativity of `Prop` (quantification over all `Prop`) to build the Church encoding”. The same construction would fail in a predicative universe. Coq’s kernel admits impredicativity only at `Prop`; this makes the formalisation possible while simultaneously identifying why analogous constructions in `Set` are either refused or tightly constrained [2605.27633].

## 5. Hurkens’s paradox for impredicative `Set`

`Hurkens_Set.v` develops a version of Hurkens’s paradox from a retract between `Prop` and the small type `bool`, but only “up to double negation” [2605.27633]:

```coq
Variable p2b : Prop → bool.
Variable b2p : bool → Prop.

Hypothesis p2p1 : ∀ A:Prop, dn (b2p (p2b A)) → dn A.
Hypothesis p2p2 : ∀ A:Prop, A → b2p (p2b A).

where dn X := (X→False)→False.
```

The core definitions are compressed but structurally standard for the paradox:

```coq
Definition V := ∀ A:Set, ((A→bool)→A→bool) → A→bool.
Definition U := V → bool.
Definition sb (z:V) : V := …
Definition le (i:U→bool) (x:U) : bool := …
Definition induct (i:U→bool) : Prop := …
Definition WF : U := fun z => p2b (induct (z U le)).
```

Here `U` is described as “a universe-polymorphic encoding of a self-referential well-founded predicate”, and the key enabling ingredients are impredicative `Set` together with large elimination via `p2b` [2605.27633].

The contradiction is organised as follows. One first proves that `WF` is well-founded under `le`, using `induct` and double negation. One then instantiates a particular `i : U→bool` and proves that `i` satisfies `induct`. From this, one derives `dn (b2p (i WF))`. Separately, `p2p2` yields `b2p (p2b (i WF))`; combined with `p2p1`, this gives `False`. The file also states that, assuming classical excluded middle in `Set`, one may define
```coq
p2b A := if EM_set A then false else true,
b2p b := (b = true).
```
In that case both `p2p1` and `p2p2` follow by case analysis on `EM_set`, so the paradox shows that excluded middle in `Set` is inconsistent [2605.27633].

The kernel blocks this route in two independent ways. Coq keeps `Set` predicative by default, so the impredicative quantification required by `V` is unavailable in ordinary settings. In addition, while certain `Set`-inductives admit large elimination, `Prop` does not permit the general eliminations needed to define `p2b : Prop→bool` by pattern-matching on a proposition. Thus the retract can be assumed for metatheoretic study but cannot be concretely defined in the kernel [2605.27633].

## 6. Shared well-foundedness machinery in `Logics.v`

The common infrastructure of the package is deliberately small. `Logics.v` defines the accessibility predicate

```coq
Inductive ACC (A:Type) (R:A→A→Prop) : A→Prop :=
| ACC_intro: ∀ x, (∀ y, R y x → ACC A R y) → ACC A R x.
```

and the derived notion
```coq
Definition WF A R := ∀ x, ACC A R x.
```
It also proves
```coq
Lemma ACC_nonreflexive : ∀ A R x, ACC A R x → R x x → False.
```
The informal reason given is that if `x` were related to itself, one could descend indefinitely through the single constructor `ACC_intro`, reaching contradiction [2605.27633].

A further inverse-image lemma states that given `f:X→A` and `WF A R`, one may define `Rof x y := R (f x) (f y)` and prove `WF X Rof`. This development is said to be the “common engine” for Burali-Forti’s proof that `emb` is well-founded and for Reynolds’s transport of order-relations through the Church quotient, while remaining “harmless in plain CIC” [2605.27633].

This shared substrate is important for interpretation. The paradoxes do not rely on ad hoc proof engineering in every file; rather, they reuse a minimal piece of constructive well-foundedness theory and differ only in the hypotheses that the kernel refuses to instantiate.

## 7. Boundary conditions on the kernel and the package’s metatheoretical status

Read jointly, the four paradoxes establish three boundary conditions on the kernel of Rocq/Coq [2605.27633].

1. **Universe hierarchy**. The kernel disallows `Type : Type` and any fixed-point universe arrangement that would let a type quantify over itself. This is the barrier that prevents the closure of the Burali-Forti construction.

2. **Placement of impredicativity**. Only `Prop` is impredicative, while `Set` and higher universes remain predicative in the default mode. Reynolds’s construction relies on the impredicativity of `Prop`; Hurkens’s construction would require impredicative `Set` together with excluded middle, which the kernel refuses by default.

3. **Discipline of large elimination**. Elimination from `Prop` into `Prop` is allowed, and certain eliminations from `Set` into `Type` or `Set` are allowed, but “general `Prop`-inductives” with more than one constructor may not be eliminated into `Set` or `Type`. This blocks direct Diaconescu-style extraction of computational data from a two-constructor proposition and prevents definitions such as `p2b : Prop→bool`.

Within the package, each paradox is packaged in a section of the form

```coq
Section X.
    Variables … (* “forbidden” axiom *)
    Theorem paradox : False.  Proof … Qed.
End X.
```

The proofs of `False` therefore type-check under hypotheses alone. No section instantiates its own variables with a concrete definition or axiom; whenever one attempts to do so, the universe checker or elimination checker rejects the construction. For that reason, the package does not present an inconsistency of Coq. It functions instead as a runnable metamathematical account of what the kernel “had to be designed to refuse”, and why that refusal occurs for the stated reasons [2605.27633].

In that sense, the coq-paradoxes package is best understood not as a collection of isolated curiosities but as a concentrated negative specification of CIC: universe self-reference, impredicative `Set` combined with classical principles, and unrestricted elimination from `Prop` into data are each formalised far enough to derive `False`, and each is then blocked at the precise point where the kernel draws the line.

Source: https://www.emergentmind.com/topics/coq-paradoxes-package