Blog / BABYLON-60
What Lean checks and what execution still needs to establish
A formal property depends on its definitions and assumptions; correspondence with an executor requires further evidence.
Read the statement before the result
A proof establishes a precise statement within a model. AX0 represents authorization states and events through a transition function. Understanding a dispatch property requires reading the available states, permitted transitions and representation of consumed authorization. A successful build checks the corresponding formal development; it does not add resources, failures or actors absent from its definitions. The scope begins with those definitions, rather than with a general claim about everything the software might do.
Inspect the proof’s dependencies
Lean allows axioms to be declared and the dependencies of a theorem to be inspected. This audit matters: a false assumption can make a conclusion useless even when the file compiles. Review the axioms, proof placeholders and evaluation mechanisms, and record the compiler version as well. Lean’s documentation explains this trusted foundation. None of those checks is a measurement of latency, electrical consumption or the behaviour of an operating system running the implementation.
Connect the model to the implementation
The next step is to justify which program structures and operations correspond to each part of the model. Serialization, concurrency, persistence and error paths must then be examined for ways to break that relationship. A targeted test supplies evidence about the case executed; an adversarial campaign explores additional cases. Keeping these levels separate makes formal proof useful without presenting it as certification of the complete binary, the hardware or every possible deployment configuration.