Verified controller zoo

One source → every target — proved, simulated, and (where it exists) measured.

Each card below was produced by one command (make all) from a single EML source. From that one source Forge emits every target it can — general-purpose software, GPU shaders, LLVM IR, machine-checked proofs (Lean / Coq / Isabelle), safety-critical (Ada / SPARK, AUTOSAR, AADL, ROS2), a smart contract, a zk circuit, and — for the RC filter, which is an actual circuit — a SPICE netlist, a KiCad schematic, and a JLCPCB fab bundle. Alongside the code sits a contract proof whose axiom footprint is clean of sorryAx, a simulation whose measured quantity satisfies the proved bound, and links to the raw evidence. This page is a generated view of that evidence — nothing is hand-authored; a proof that weren't clean, or a sim check that didn't hold, would show in red. (FPGA RTL — Verilog/VHDL/Chisel — appears wherever a source carries an @target(fpga) clock annotation: the aerospace actuator guard emits synthesizable Verilog/VHDL/Chisel for the Arty A7, and the estimation kernels below run bit-exact under Verilator. The plain scalar controllers don't ask for it, so they emit none — the tool skips what a source doesn't request rather than fake it.)

Those contract proofs are sorryAx-clean but not axiom-free — they stand on MachLib's small axiomatic real-number base, kept Mathlib-free for build speed. That base is now itself machine-checked consistent: Mathlib's ℝ models every axiom it uses — field, order, exp / log / trig, derivative, and analyticity, the analytic finite-zeros theorem among them as a real proof rather than a postulate — each reducing to Lean's three foundational axioms (propext, Classical.choice, Quot.sound). The exact reals are proved; the float rounding behind the silicon / bit-exact badges stays measured, not proved.

A few cards are proof-first kernels rather than emitted controllers: a closed-loop safety envelope, a pure-math finiteness theorem (iterated-exponential Khovanskii), and two verified finance kernels — an amortization schedule that reconciles to the penny and a 30E/360 day-count whose coupon periods compose exactly, both in exact integers. They earn a place because the same discipline carries beyond control code: a machine-checked contract (clean of sorryAx) paired with a runtime witness that satisfies it.

Reproduction tiers: LOCAL one command, no heavy toolchain · TOOLCHAIN re-derive with Lean / Vivado · REPLAY captured on real hardware, replayed from evidence. 8 controllers + 4 theorems · 3 estimation filters · 238 target emissions · 4 with real-hardware evidence.

Aerospace actuator band guard (FPGA — Arty A7)

examples/actuator_guard.eml · sha256 adaa434e2a58679c

32 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

fpga rtlchiselverilogvhdl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

proof ✓ cleansim ✓ holdshardware replay

proof footprint re-derived 2026-07-02T04:37:24Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, three ways. The theorem actuator_command_within_band proves the guarded actuator command is always within the certified flight-envelope band [u_min, u_max], for any controller inputs; the sim shows 0 = 0 (the raw command peaks at ±4.53 (well past the band) yet the guarded output never leaves [-1.0,1.0] — the clamp the theorem proves and the RTL/silicon runs); and the same behavior was measured on real hardware.

report evidence.json axiom trail c wgsl verilog lean solidity

Amortization schedule — reconciles to the penny (finance)

machlib · MachLib.Finance.amortization_reconciles

a machine-checked result — a proof, not a codegen kernel

proof ✓ cleansim ✓ holds

proof footprint re-derived 2026-07-02T08:43:32Z from the machlib module · axiom trail

sim plot

The same claim, two ways. The theorem MachLib.Finance.amortization_reconciles proves a fixed-rate amortization schedule's principal payments sum to EXACTLY the loan amount and the balance closes to exactly $0.00 — in integer cents, for ANY per-period interest rounding; the sim shows 0 = 0 (schedule reconciles to the penny (final balance $0.00, Σprincipal = $250,000.00, exact integer cents, never float) — AND the rounded balance provably never leaves the certified envelope around exact arithmetic: measured max drift $0.05 ≤ certified cap $5.02 = c·(gᴺ−1)/(g−1)).

Reconciliation is proven EXACT and rounding-mode-independent (Σ principal = loan, balance closes to exactly $0.00; the final payment absorbs the accumulated rounding). Banker's rounding is separately proven correct to ½¢ per period (roundHalfEven_half_ulp). And the accumulated rounding is now bounded END-TO-END: MachLib.Real.amortization_drift_within_envelope proves the rounded balance never leaves the certified envelope cap_N = c·(gᴺ−1)/(g−1) (c=½¢) around exact arithmetic — the expansion dual of the closed-loop safety envelope. Here the worst-case cap is $5.02 while the measured drift is only ~$0.05 (real roundings mostly cancel — the margin is the point, as in the safety card). Everything is INTEGER CENTS — the reconciliation proof never touches a float; all four finance theorems are sorryAx-free and registered in the claim auditor. Honest scope: this certifies the schedule's reconciliation + rounding + drift envelope, NOT a general decimal library, and it is NOT an audit certification.

report evidence.json axiom trail sim data

Catenary cable — cosh sag, envelope-guarded

examples/catenary.eml · sha256 5ae1c0fe19f40a87

29 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

proof ✓ cleansim ✓ holdsfwd-error ✓ ≤ 8.4e-15hardware n/a

proof footprint re-derived 2026-07-10T13:47:25Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, two ways. The theorem catenary_within_envelope proves the reported catenary height is always inside the structural envelope [1, 20] m, for any input; the sim shows 0 = 0 (across a ±4 m span the catenary sags to 5.0 m at the low point and rises toward the 20.0 m towers, always inside [1.0,20.0] — the envelope the theorem proves, the cosh the forward-error certificate bounds).

A cosh geometry kernel. y = scale·cosh(curv·x) is the exact shape of a cable hanging under gravity; the clamp guards the reported height to the structural envelope [1,20] m. The @verify contract PROVES the height stays in the envelope for any input; the forward-error certificate BOUNDS how far the compiled float64 cosh drifts from exact (Certcom.pipeline_nested_std — cosh is the 7th and last symmetric-domain primitive in the certified fold).

report evidence.json axiom trail certificate fwd-error proof c wgsl lean solidity

Saturating clamp (output bounded to [-1, 1])

examples/clamp_bounded.eml · sha256 602c87f60a2a9b9b

29 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

proof ✓ cleansim ✓ holds

proof footprint re-derived 2026-07-02T04:37:24Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, two ways. The theorem clamp_in_unit_interval proves clamp_unit(x) is always within [-1, 1] for every input x; the sim shows 1.0 ≤ 1.0 (clamp band [-1.0, 1.0]).

report evidence.json axiom trail c wgsl lean solidity

Day-count & accrual — coupon periods compose exactly (finance)

machlib · MachLib.Finance.days30E360_additive

a machine-checked result — a proof, not a codegen kernel

proof ✓ cleansim ✓ holds

proof footprint re-derived 2026-07-02T08:57:45Z from the machlib module · axiom trail

sim plot

The same claim, two ways. The theorem MachLib.Finance.days30E360_additive proves the 30E/360 day-count is additive — splitting a coupon period at ANY intermediate date preserves the total day-count, so accrued interest composes exactly (no interest created or destroyed by moving an accrual boundary); the sim shows 0 = 0 (the 20 semiannual periods each count exactly 180 days and sum to 3600 = the direct issue→maturity count — 30E/360 is additive, so accrued interest composes exactly (total accrued $500,000.00). Honest contrast on 2020-01-15→02-28 split at 01-31: 30E/360 adds (43=43) but US 30/360 does NOT (44≠43) — why the additive convention is the right one).

The headline (days30E360_additive) is EXACT: splitting a coupon period at any intermediate date preserves the total day-count, so accrued interest composes exactly (accrual_additive) — no interest is manufactured by moving an accrual boundary, the day-count analogue of amortization's telescoping reconciliation. Plus regularity (equal calendar spacing ⇒ equal day-count ⇒ equal coupons) and a full year = 360. Honest domain point: this uses 30E/360 (Eurobond) precisely BECAUSE it's additive — the US 30/360 'bond basis' is NOT (its end-of-month rule depends on the other endpoint; the sim exhibits a case where US gives 44≠43 while 30E/360 gives 43=43). All pure INTEGER arithmetic — #print axioms is propext + Quot.sound only, not even Classical.choice — and registered in the claim auditor. Honest scope: certifies the day-count convention's algebra, NOT a full calendar/business-day library, and NOT an audit certification.

report evidence.json axiom trail sim data

Iterated-exponential Khovanskii finiteness (depth 2)

machlib · MachLib.ChainExp2NoZeros.chain2_khovanskii_bound_unconditional

a machine-checked result — a proof, not a codegen kernel

proof ✓ cleansim ✓ holds

proof footprint re-derived 2026-07-02T04:37:24Z from the machlib module · axiom trail

sim plot

The same claim, two ways. The theorem MachLib.ChainExp2NoZeros.chain2_khovanskii_bound_unconditional proves a polynomial in the tower (x, eˣ, e^{eˣ}) that is nonzero at even one interior point has only FINITELY many zeros on (a,b) — the count derived from Rolle's theorem, not cited from Khovanskii; the sim shows 3 = 3 (count stable under 100× grid refinement ⇒ finite; e^(e^x) never vanishes so adds no zeros — consistent with the machine-checked bound).

Depth-2 shown here (proof + zero-count witness). Depth-3 is ALSO proven clean (MachLib.IterExpDepth3Bound.chain3_khovanskii_bound_unconditional); the ∀N generalization is in progress (lemma-1 + the reduce seam are done, machine-checked). General-depth PfaffianFunction.zero_bound STILL cites the classical Khovanskii axiom — only depths 1–3 are counted, not quoted.

report evidence.json axiom trail sim data

PID controller (output clamped to actuator range)

examples/pid_controller.eml · sha256 4d51cd9248714388

29 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

proof ✓ cleansim ✓ holdsfwd-error ✓ ≤ 6.4e-14hardware replay

proof footprint re-derived 2026-07-02T04:37:24Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, three ways. The theorem pid_output_clamped proves the control output is always within the actuator band [OUT_MIN, OUT_MAX] = [-1, 1]; the sim shows 1.0 ≤ 1.0 (actuator band [-1.0, 1.0]); and the same behavior was measured on real hardware.

report evidence.json axiom trail certificate fwd-error proof c wgsl lean solidity

RC low-pass filter (τ = R·C, step response)

examples/rc_filter.eml · sha256 ed5acb7a4025d3f1

32 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

circuit/fabjlcpcbkicadspice

proof ✓ cleansim ✓ holdshardware replay

proof footprint re-derived 2026-07-02T04:37:24Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, three ways. The theorem rc_time_constant_def proves the filter time constant is exactly τ = R·C; the sim shows 0.0068 ≤ 0.01 (settles to Vin within 5τ); and the same behavior was measured on real hardware.

report evidence.json axiom trail c wgsl lean solidity spice

Closed-loop safety envelope under an injected fault

machlib · MachLib.Real.first_order_clamp_envelope

a machine-checked result — a proof, not a codegen kernel

proof ✓ cleansim ✓ holdshardware replay

proof footprint re-derived 2026-07-02T04:37:24Z from the machlib module · axiom trail

sim plot

The same claim, three ways. The theorem MachLib.Real.first_order_clamp_envelope proves for a first-order plant with a saturating actuator clamp (|u|≤U) and bounded disturbance (|w|≤W), the state stays within the envelope X=(U+W)/(1−a) for ALL time and ANY controller; the sim shows 0.8 ≤ 2.0 (state stays inside the proved envelope X*=(U+W)/(1−|a|) even after the injected fault — safety rides on the clamp, not on good control); and the same behavior was measured on real hardware.

The envelope is a conservative worst-case SAFETY bound — real trajectories sit well inside it (here the fault peak is ~40% of the envelope). That margin IS the safety, not a defect: the bound rests on the actuator clamp, not on good control. Measured on real hardware (ESP32 RC + a nonlinear diode-RC plant) it held under an injected fault while the breadboard limit-cycled.

report evidence.json axiom trail sim data

Bounded sine oscillator (|output| ≤ amplitude)

examples/sine_oscillator.eml · sha256 73837d61bea80a15

29 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

proof ✓ cleansim ✓ holds

proof footprint re-derived 2026-07-02T04:37:24Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, two ways. The theorem sine_oscillator_amplitude_bound proves |A·sin(ωt)| ≤ A for A ∈ [0,1], ω ∈ [0, 1e4], t ≥ 0; the sim shows 0.8 ≤ 0.8 (amplitude bound |·| ≤ 0.8).

report evidence.json axiom trail c wgsl lean solidity

Soft (tanh) actuator — smooth saturation, band-guarded

examples/soft_actuator.eml · sha256 66d899cb3171f438

29 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

proof ✓ cleansim ✓ holdsfwd-error ✓ ≤ 1.1e-13hardware n/a

proof footprint re-derived 2026-07-10T08:02:45Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, two ways. The theorem soft_actuator_within_band proves the soft-actuator output is always within the band [-1, 1], for any input; the sim shows 0 = 0 (across a ±5 error sweep the tanh output saturates smoothly and stays in [-1.0,1.0] (peak |1.0|) — the band the theorem proves, the transcendental the forward-error certificate bounds).

A transcendental control kernel. tanh gives smooth saturation (no derivative kick at the edge); the clamp is the hard guard. The @verify contract PROVES the output stays in [-1,1]; the forward-error certificate BOUNDS how far the compiled float64 tanh drifts from exact (Certcom.pipeline_nested_std).

report evidence.json axiom trail certificate fwd-error proof c wgsl lean solidity

Vibration RMS — one-sided sqrt, range-guarded

examples/vibration_rms.eml · sha256 a3b7f9cd162f69b6

29 targets from one source

softwareccppcsharpgdscriptgojavajavascriptkotlinluaumatlabpythonrustswiftwasm

gpu shaderglslglsl-eshlslmetalwgsl

compiler IRllvm

proofcoqisabellelean

safety-criticalaadlada/sparkautosarros2

blockchainsolidityzkproof

proof ✓ cleansim ✓ holdsfwd-error ✓ ≤ 6.0e-13hardware n/a

proof footprint re-derived 2026-07-10T14:10:45Z from the emitted Lean (not a hand-written probe) · axiom trail

sim plot

The same claim, two ways. The theorem vibration_rms_within_range proves the reported RMS magnitude is always inside the sensor range [0, 50] m/s^2, for any input; the sim shows 0 = 0 (a swept-frequency 2-axis vibration with a burst peaking at 35.8 m/s^2 stays inside [0,50.0] throughout — the range the theorem proves, the sqrt the forward-error certificate bounds (conditional on the 0.25 noise floor keeping the argument > 0)).

A sqrt kernel — the one-sided-domain primitive. sqrt is only Lipschitz away from 0, so its forward-error certificate needs a positive lower bound on the argument; here ax²+ay²≥0 plus an additive NOISE_FLOOR supplies it honestly. The @verify contract PROVES the RMS magnitude stays in the sensor range [0,50] via the clamp; the certificate BOUNDS the compiled float64 sqrt's drift (Certcom.pipeline_pos_over_arith — ln/sqrt over an arithmetic core, conditional on the noise-floor lower bound).

report evidence.json axiom trail certificate fwd-error proof c wgsl lean solidity

Verified estimation filters

The same discipline carried to a full filter: a linear Kalman tracker, a matrix Extended Kalman Filter (its gain uses the matrix inverse), and a quaternion AHRS. Each drives the REAL Forge-emitted kernels over a trajectory — proven sorryAx-free (each theorem’s axiom trail is linked and re-derivable), simulated as a working filter that beats its dead-reckoning baseline, and run bit-exact on RTL. standalone gallery →

Linear Kalman tracker (constant velocity)

estimation filter · 2 proofs · 1 RTL kernels

32 targets emitted

proof ✓ cleansim ✓ holdssilicon · RTL bit-exact

kalman2d_cov_predict_psd — the predicted covariance F·P·Fᵀ+Q stays positive-semidefinite · axiom trail

kalman2d_joseph_psd — the Joseph covariance update preserves PSD for any gain · axiom trail

A textbook predict→update Kalman filter — cuts position noise and recovers the unmeasured velocity from position measurements alone. Simulated: filter RMS vs measurement RMS 0.525 / 0.934 ratio 0.56 < 0.6 · recovered velocity (never measured) 0.516 ≈ 0.5 · max |filter − NumPy-KF| 1.1e-16 < 1e-9. Silicon: kalman2d_predict.cov_predict — bit-exact.

report summary.json

EKF localization (range-only, two beacons)

estimation filter · 3 proofs · 3 RTL kernels

100 targets emitted

proof ✓ cleansim ✓ holdssilicon · RTL bit-exact

ekf_range_nonneg — the range measurement √((lx-x)²+(ly-y)²) is ≥ 0 · axiom trail

kalman2d_innovation_cov_psd — the innovation covariance H·P·Hᵀ+R stays positive-semidefinite · axiom trail

kalman2d_matrix_joseph_psd — the Joseph covariance update A·P·Aᵀ+W preserves PSD for any gain · axiom trail

A nonlinear Extended Kalman Filter — range-only trilateration to two beacons; the gain K = P·Hᵀ·(H·P·Hᵀ+R)⁻¹ exercises the matrix-inverse operator. Simulated: EKF position RMSE vs dead-reckoning 0.479 / 2.993 ratio 0.16 < 0.6 · max |EKF − NumPy-EKF| 4.2e-15 < 1e-9. Silicon: complementary_filter.fuse, weighted_fusion.fuse3, kalman2d_update_matrix.update_cov — bit-exact.

report summary.json

Mahony AHRS (quaternion attitude)

estimation filter · 1 proofs · 2 RTL kernels

18 targets emitted

proof ✓ cleansim ✓ holdssilicon · RTL bit-exact

quat_normalize_unit — ‖normalize(q)‖² = 1 — the state stays a unit quaternion (sorryAx-free) · axiom trail

A complementary attitude filter fusing a biased gyroscope with an accelerometer; every quaternion op is a shipped kernel and the state is re-normalised onto the unit sphere each step. Simulated: Mahony attitude error vs gyro-only 2.38° / 18.44° ratio 0.13 < 0.3 · max |‖q‖ − 1| over the run 2.2e-16 < 1e-12. Silicon: quat_mul, quat_rotate_vec — bit-exact.

report summary.json

Generated from out/*/evidence.json + out/*/summary.json by reproduce/gallery.py. Regenerate: make gallery. The registry grows by genuine end-to-end reproducibility, not by count.