Lean Computer Science Library (CSLib)

• CSLib is an open-source framework that formalizes computer science concepts using Lean, enabling formal proofs of correctness for algorithms, data structures, and computational models.
• It employs a semantic framework with bundled operational semantics and computable definitions to provide reusable abstractions and interfaces across diverse CS domains.
• It integrates automation tactics, CI-driven maintenance, and rigorous benchmarking to support scalable formalizations and domain-specific extensions like EconCSLib.

CSLib, the Lean Computer Science Library, is an open-source framework for proving computer-science-related theorems and writing formally verified code in the Lean proof assistant. It is presented as a centralised library of formalised computer science and software development in Lean, intended to be for computer science what Mathlib is for mathematics. Its stated role is not merely to collect isolated formalizations, but to provide a common spine of semantic interfaces, reusable abstractions, proof automation, and maintenance infrastructure on top of Lean 4 and Mathlib (Barrett et al., 4 Feb 2026, Henson et al., 16 Feb 2026).

1. Project conception, scope, and aims

CSLib was proposed in response to what its founding papers describe as a major asymmetry in Lean’s ecosystem: Mathlib had become a broad, community-maintained repository of formalized mathematics, while “the base of computer science knowledge in Lean” remained limited. CSLib’s stated objective is therefore to create a Mathlib-like universal repository for formalized computer science knowledge, while also supporting “real-world verification projects” and the “manual and AI-aided engineering of large-scale formally verified systems” (Barrett et al., 4 Feb 2026).

The project is organized around two pillars. The first is the formalization of essential computer science concepts in Lean, including models of computation such as the $\lambda$-calculus and resource-bounded Turing machines, algorithms and data structures with proofs of correctness and complexity, concurrency theory, foundations of programming languages, and mathematical tools relevant to computer science that are not yet in Mathlib. The second pillar is infrastructure for Lean-based reasoning about “everyday imperative code,” centered on an intermediate language called Boole, which is intended to mix classical imperative constructs with Lean specifications and to generate Lean verification conditions from Boole programs (Barrett et al., 4 Feb 2026).

The intended use cases are explicitly broad. CSLib is presented as infrastructure for computer science education, for research in theory, programming languages, systems, and formal methods, and for the construction of large-scale verified systems. The white paper further gives a roadmap: by the end of 2026 it expects many undergraduate algorithms and data structures, most of the models and logics from a typical undergraduate theory of computation course, a robust Boole framework with Lean verification-condition generation and SMT integration, and a sizeable number of Boole-language algorithm implementations with proofs; by 2027 it expects more advanced topics such as complexity theory, concurrency, secure compilation, randomized and quantum algorithms, at least one important foundational discovery in computer science aided by CSLib, and end-to-end verification of at least one substantially sized real-world system (Barrett et al., 4 Feb 2026).

2. Founding technical principles and semantic framework

A central principle of CSLib is that operational semantics should be library objects rather than ad hoc relations. The “spine” paper therefore makes abstract reduction systems and labelled transition systems into bundled interfaces:

structure ReductionSystem (Term : Type u) where Red : Term → Term → Prop structure LTS (State : Type u) (Label : Type v) where Tr : State → Label → State → Prop

From these bundled structures, CSLib derives multistep reduction and transition relations, reachable states, images of states under labels, and standardized propositions and typeclasses for properties such as finiteness, image-finiteness, confluence, and the diamond property (Henson et al., 16 Feb 2026).

A second principle is the prioritization of computable definitions. The library contrasts Mathlib’s abstract Infinite α with a witness-producing class:

$=0.5242$0

This style is intended to keep definitions computationally meaningful and executable when possible, while still connecting back to Mathlib through noncomputable instances when necessary (Henson et al., 16 Feb 2026).

A third principle is to encode recurrent syntactic and semantic patterns as typeclass-driven abstractions. For contexts and congruences, CSLib defines:

$=0.5242$1

and

$=0.5242$2

These abstractions allow the same metatheoretic interface to be reused across languages and models. In the library’s own account, this is the mechanism by which congruence arguments for process calculi and similar systems become derivable from a common API rather than reproved from scratch (Henson et al., 16 Feb 2026).

3. Automation, CI, and library maintenance

CSLib treats proof automation as a design constraint rather than a convenience layer. The spine paper states that if a notion repeatedly requires bespoke reasoning, that is taken as evidence that the interface itself should be redesigned. The main tactic in this automation strategy is grind, described there as SMT-inspired and used from near the inception of CSLib. Quantitatively, 314 of 338 declarations used grind from their initial commit; the remaining theorems saw, on average, a savings of 7.1 lines of code after adding grind; bisimilarity proofs saw savings from 15 to 39 lines; and a System F development saw about 45% fewer lines of code (Henson et al., 16 Feb 2026).

The automation strategy is tied to a maintenance regime. CSLib uses a CI pipeline in which syntax linters produce immediate warnings that become CI errors, slower environment linters are run in CI, and still more expensive checks are run weekly and reported to the community. The paper specifically mentions a mergeWithGrind linter, which checks whether a preceding tactic is redundant whenever grind is used, tests over the import graph to ensure modules transitively include a special initialization module, and analysis of annotations to detect combinations that instantiate beyond a threshold. It also mentions periodic analysis through the Lean Kernel Arena, which exports kernel declarations and checks them using external implementations (Henson et al., 16 Feb 2026).

This maintenance posture is explicitly compatible with Mathlib rather than separate from it. CSLib is described as depending heavily on Mathlib, reusing its infrastructure whenever reasonable, and extending its linter ecosystem, for example by enforcing stricter namespacing policies. A plausible implication is that CSLib is conceived not as a parallel foundation, but as a computer-science-specialized layer whose technical norms are deliberately aligned with the broader Lean library ecosystem (Henson et al., 16 Feb 2026).

4. Core semantic developments

The first substantial developments reported for CSLib are languages, models, and behavioural equivalences. On top of the [LTS](https://www.emergentmind.com/topics/loss-aware-curriculum-lts) interface, the library formalizes bisimilarity, weak bisimilarity, simulation equivalence, similarity, and trace equivalence, all parameterized by the underlying transition system and all proved to be equivalence relations. The paper also proves that the union of two bisimulations is a bisimulation, from which it derives that bisimulations and union form a join-semilattice with bottom and top elements, where the bottom is the empty relation and the top is bisimilarity itself (Henson et al., 16 Feb 2026).

The same semantic spine supports automata-theoretic constructions. Because nondeterministic automata are represented as a special case of labelled transition systems, the subset construction is expressed using set-image:

$=0.5242$3

The corresponding language-equivalence proof is given in the paper as:

$=0.5242$4

This example is used to illustrate a recurrent CSLib design claim: once the semantic interface is chosen well, proofs that would otherwise be domain-specific become short corollaries of generic infrastructure (Henson et al., 16 Feb 2026).

CSLib also includes a formalization of Milner’s Calculus of Communicating Systems. The CCS development instantiates HasContext, proves a completeness theorem for contexts,

$=0.5242$5

and culminates in an instance asserting that bisimilarity is a congruence for CCS:

$=0.5242$6

The same paper reports developments for the simply typed lambda calculus and System F with subtyping, using a locally nameless representation and typing contexts built largely from Mathlib list infrastructure (Henson et al., 16 Feb 2026).

A distinct but integrated development is the library-level formalization of Hennessy–Milner Logic inside CSLib. That work formalizes HML syntax, satisfaction, denotational semantics, and the Hennessy–Milner theorem over arbitrary labelled transition systems. Its main theorem is stated as:

$=0.5242$7

This is described as the first modal logic formalisation in CSLib and as the library’s reference implementation of HML, directly reusable for systems that expose the CSLib LTS API, including automata and CCS (Montesi et al., 17 Feb 2026).

5. Expansion into domain libraries and adjacent ecosystems

The CSLib model has already been adopted by domain-specific developments. “The Chase in Lean” presents a reusable formalization of existential rules and the chase, explicitly positioned as a CSLib-style project. It introduces a Lean framework for existential rules, multiple notions of trigger obsolescence, coinductive chase derivations and chase trees, and generic termination criteria in the likeness of Model-Faithful Acyclicity. The main theorems include a universal model set theorem for chase trees, a deterministic branch universal model theorem, a core theorem without alternative matches, and correctness results for a generic MFA-like termination framework with support for constants (Gerlach, 24 Apr 2026).

EconCSLib is presented as an early Lean 4 library for computational economics and as part of the broader CSLib vision. One paper describes an architecture with foundation modules for players, preferences, profiles, and utility theory; a mathematical branch with combinatorial optimization, matroid theory, and fixed-point theorems; an algorithmic branch; and domain-specific branches for game theory, mechanism design, social choice, and market design. It reports more than 40,000 lines of Lean code and over 1,300 theorems/lemmas, with no additional axioms, and lists completed formalizations including Arrow’s theorem, Gibbard–Satterthwaite, Zermelo-style determinacy, linear programming strong duality, Farkas’ lemma, Brouwer, KKM, and Scarf fixed-point results, VCG mechanisms, Myerson’s optimal auction, Gale–Shapley deferred acceptance, cut-and-choose, Dubins–Spanier, and existence of EFX allocations for two agents (Bei et al., 15 Jun 2026).

A companion paper frames EconCSLib as a human-AI-Lean workflow organized around research papers. It reports a current public repository containing 11 fully formalized papers and 3 partially formalized papers, with reusable modules for probability, auctions, matching markets, and graph tools. That work explicitly describes EconCSLib as complementary to CSLib and says it expects to be a downstream user of CSLib, especially for computational complexity infrastructure (Garg, 11 Jun 2026).

6. Benchmarks, premise retrieval, and AI-facing evaluation

As CSLib became large enough to function as a research corpus, its own benchmark work began to emphasize that repository structure changes the formal reasoning problem. CSLibPremiseBench is a reproducible benchmark for source-visible premise retrieval over Lean 4 theorem and lemma declarations in CSLib. It pins CSLib v4.29.0 at commit 0d37cc7fcc985cfc53b155e7eef2453f846c6da2, builds with Lean 4.29.0, and evaluates a strict import/source-order task set with 801 proxy-labelable tasks and 1875 CSLib candidate declarations (Ji, 14 May 2026).

Its labels are explicitly not elaborated Lean dependency traces. The main signal is 2845 source-visible proof-reference links over 801 tasks; a strict source-visible audit removes ambiguous short-name-only matches and retains 2666 of 2845 links (93.7%); and a Lean environment expression audit on a 300-task subset finds 257 usable target declarations, skips 14 due to unsupported Lean name syntax, and observes 462 of 958 proxy links (48.2%) in elaborated value-level constants. The benchmark compares BM25, symbol/name overlap, namespace/module and import-graph heuristics, PageRank-style module priors, fixed hybrids, and a structure-guided reranker, CSG-Rerank (Ji, 14 May 2026).

The empirical conclusion is deliberately narrow. Under the strict policy, BM25 has Recall@10 $=0.5242$ and MRR $=0.5061$; BM25+symbol has Recall@10 $=0.5282$ and MRR $=0.5199$; and CSG-Rerank has Recall@10 $=0.5215$ and MRR $=0.5236$. A paired-bootstrap analysis with 5000 resamples and seed 17 finds that CSG-Rerank improves MRR over BM25 by $+0.0175$ with 95% CI $[+0.0016,+0.0335]$, but does not reliably beat BM25+symbol in MRR, and does not improve Recall@10. The paper’s broader claim is methodological: repository structure, namespaces, modules, imports, source order, and candidate-policy design materially shape CSLib premise retrieval, and broad mathematical benchmarks such as MiniF2F or ProofNet do not capture that behavior (Ji, 14 May 2026).

A common misconception addressed by this line of work is that CSLib retrieval benchmarking is equivalent to theorem proving. The benchmark paper explicitly rejects that interpretation: its labels are source-visible retrieval targets with explicit caveats, and it does not claim elaborated dependency recovery, proof generation, proof repair, or downstream proof-assistance gains (Ji, 14 May 2026).

7. Limits, interpretation, and outlook

CSLib’s own foundational papers differ in genre. The white paper is primarily a vision and project document; it does not report a mature benchmark suite or global empirical evaluation for CSLib as a whole, and its Boole-related capabilities are presented as a roadmap rather than a completed end state (Barrett et al., 4 Feb 2026). The spine paper, by contrast, documents reusable abstractions, first substantial developments, and maintenance infrastructure, but also presents CSLib as “rapidly-growing” and “burgeoning,” indicating that the library is still in an expansion phase rather than a settled one (Henson et al., 16 Feb 2026).

The benchmark literature adds a second interpretive limit. CSLib-specific premise retrieval is sensitive to repository layout and to source-visible accessibility rules, so leaderboard performance depends materially on candidate-policy design. The benchmark therefore treats strict, family-local, and all-earlier fallback scopes as explicit experimental variables rather than hidden implementation details. This suggests that CSLib is not just a corpus of declarations; it is a structured software repository in which import boundaries, module families, and source order are themselves semantically relevant artifacts (Ji, 14 May 2026).

Taken together, the current literature presents CSLib as both infrastructure and research object. It is infrastructure because it supplies common semantic interfaces, automation, CI, and library-grade developments in concurrency, automata, modal logic, and programming-language metatheory. It is a research object because its organization, candidate scopes, and declaration structure measurably affect retrieval and formalization workflows. The project’s long-term significance, as these papers describe it, lies in making Lean a practical platform for formalized computer science in the same sense that Mathlib made Lean a practical platform for formalized mathematics (Barrett et al., 4 Feb 2026, Henson et al., 16 Feb 2026).