Lean statement

Weak normalization implies strong normalization in every pure type system

Lean is a language for mathematical statements and proofs that a computer can verify. This page shows one statement file from OpenAI’s release, possible paper matches and independent reports. The code-like names below identify the definitions or theorems selected by the proof-verification settings.

Theorem selected for verification: OAI.PureTypeSystem.weak_implies_strong

Lean statement file: TypeSystemNormalization.leanShow on the mapOpenAI’s Lean catalogue does not list this as a main result; the release’s Lean notes for family 245 link it.

See the candidate theorem Who ran the proof-verification program Report a comparison with the paper (GitHub issue)

The Lean statement

The lines of the Lean statement that state the theorem, then the definitions in the file that it uses.

theorem weak_implies_strong {S : Type u} (P : Specification S)    (h : SystemWeaklyNormalizing P) : SystemStronglyNormalizing P := by  sorry

A Lean statement states the theorem and leaves its proof as sorry on purpose. OpenAI’s proof is in a separate solution module, and a program called Comparator checks that proof against this statement.

Definitions needed to read it

Local definitions the statement names, followed through the definitions they name in turn. The match is by name in the source text, so a name reached only through notation can be missed; the full file is below.

inductive type OAI.PureTypeSystem.Expr line 15

inductive Expr (Sorts : Type u) : Type u  | var : Nat → Expr Sorts  | sort : Sorts → Expr Sorts  | app : Expr Sorts → Expr Sorts → Expr Sorts  | lam : Expr Sorts → Expr Sorts → Expr Sorts  | pi : Expr Sorts → Expr Sorts → Expr Sorts  deriving DecidableEq

definition OAI.PureTypeSystem.Expr.liftRen line 27

def liftRen (ρ : Nat → Nat) : Nat → Nat  | 0 => 0  | n + 1 => ρ n + 1

definition OAI.PureTypeSystem.Expr.rename line 31

def rename (ρ : Nat → Nat) : Expr S → Expr S  | var n => var (ρ n)  | sort s => sort s  | app f a => app (rename ρ f) (rename ρ a)  | lam A b => lam (rename ρ A) (rename (liftRen ρ) b)  | pi A B => pi (rename ρ A) (rename (liftRen ρ) B)

definition OAI.PureTypeSystem.Expr.liftSub line 38

def liftSub (σ : Nat → Expr S) : Nat → Expr S  | 0 => var 0  | n + 1 => rename Nat.succ (σ n)

definition OAI.PureTypeSystem.Expr.subst line 42

def subst (σ : Nat → Expr S) : Expr S → Expr S  | var n => σ n  | sort s => sort s  | app f a => app (subst σ f) (subst σ a)  | lam A b => lam (subst σ A) (subst (liftSub σ) b)  | pi A B => pi (subst σ A) (subst (liftSub σ) B)

definition OAI.PureTypeSystem.Expr.single line 49

def single (a : Expr S) : Nat → Expr S  | 0 => a  | n + 1 => var n

definition OAI.PureTypeSystem.Expr.instantiate line 53

def instantiate (b a : Expr S) : Expr S := subst (single a) b

structure OAI.PureTypeSystem.Specification line 57

structure Specification (S : Type u) where  axioms : S → S → Prop  rule : S → S → S → Prop

inductive type OAI.PureTypeSystem.Beta line 61

inductive Beta {S : Type u} : Expr S → Expr S → Prop  | head (A b a) : Beta (.app (.lam A b) a) (b.instantiate a)  | app_left {f f' a} : Beta f f' → Beta (.app f a) (.app f' a)  | app_right {f a a'} : Beta a a' → Beta (.app f a) (.app f a')  | lam_domain {A A' b} : Beta A A' → Beta (.lam A b) (.lam A' b)  | lam_body {A b b'} : Beta b b' → Beta (.lam A b) (.lam A b')  | pi_domain {A A' B} : Beta A A' → Beta (.pi A B) (.pi A' B)  | pi_body {A B B'} : Beta B B' → Beta (.pi A B) (.pi A B')

definition OAI.PureTypeSystem.Converts line 70

def Converts {S : Type u} : Expr S → Expr S → Prop := Relation.EqvGen Beta

definition OAI.PureTypeSystem.Normal line 72

def Normal {S : Type u} (M : Expr S) : Prop := ∀ N, ¬ Beta M N

definition OAI.PureTypeSystem.WeaklyNormalizing line 74

def WeaklyNormalizing {S : Type u} (M : Expr S) : Prop :=  ∃ N, Relation.ReflTransGen Beta M N ∧ Normal N

definition OAI.PureTypeSystem.StronglyNormalizing line 79

def StronglyNormalizing {S : Type u} (M : Expr S) : Prop :=  Acc (fun N M : Expr S => Beta M N) M

inductive type OAI.PureTypeSystem.HasType line 82

inductive HasType {S : Type u} (P : Specification S) :    List (Expr S) → Expr S → Expr S → Prop  | ax {s t} : P.axioms s t → HasType P [] (.sort s) (.sort t)  | var {Γ A s} : HasType P Γ A (.sort s) →

Show the remaining 13 lines

      HasType P (A :: Γ) (.var 0) (A.rename Nat.succ)  | weaken {Γ M B A s} : HasType P Γ M B → HasType P Γ A (.sort s) →      HasType P (A :: Γ) (M.rename Nat.succ) (B.rename Nat.succ)  | product {Γ A B s₁ s₂ s₃} : HasType P Γ A (.sort s₁) →      HasType P (A :: Γ) B (.sort s₂) → P.rule s₁ s₂ s₃ →      HasType P Γ (.pi A B) (.sort s₃)  | abstraction {Γ A b B s} : HasType P (A :: Γ) b B →      HasType P Γ (.pi A B) (.sort s) →      HasType P Γ (.lam A b) (.pi A B)  | application {Γ f a A B} : HasType P Γ f (.pi A B) →      HasType P Γ a A → HasType P Γ (.app f a) (B.instantiate a)  | conversion {Γ M A B s} : HasType P Γ M A → HasType P Γ B (.sort s) →      Converts A B → HasType P Γ M B

inductive type OAI.PureTypeSystem.ValidContext line 100

inductive ValidContext {S : Type u} (P : Specification S) : List (Expr S) → Prop  | nil : ValidContext P []  | cons {Γ A s} : ValidContext P Γ → HasType P Γ A (.sort s) →      ValidContext P (A :: Γ)

definition OAI.PureTypeSystem.Legal line 105

def Legal {S : Type u} (P : Specification S) (Γ : List (Expr S)) (M : Expr S) : Prop :=  ∃ A, HasType P Γ M A ∨ HasType P Γ A M

definition OAI.PureTypeSystem.SystemWeaklyNormalizing line 108

def SystemWeaklyNormalizing {S : Type u} (P : Specification S) : Prop :=  ∀ Γ, ValidContext P Γ → ∀ M, Legal P Γ M → WeaklyNormalizing M

definition OAI.PureTypeSystem.SystemStronglyNormalizing line 111

def SystemStronglyNormalizing {S : Type u} (P : Specification S) : Prop :=  ∀ Γ, ValidContext P Γ → ∀ M, Legal P Γ M → StronglyNormalizing M

Possible paper match, with no recorded review

Atlas selected this possible match by comparing words in the Lean statement with every statement in the family. No review of whether the statements mean the same thing is recorded.

Words of the Lean statement, its names split into words, that also appear in the theorem: valid, strongly, beta, weakly, context, system, legal and normalizing. Found in the paper’s title, which its main theorem states: strong and weak. Shared only with the release’s name for the Lean statement or OpenAI’s note on it: conjecture, barendregt, geuvers, klop, pure and expression.

Theorem 1 of Weak and strong normalization in pure type systems

Theorem (The \beta-Barendregt–Geuvers–Klop conjecture)

Let \mathcal P=(\mathcal S,\mathcal A,\mathcal R) be any pure type system. If every legal expression of \mathcal P, in every valid context, is weakly \beta-normalizing, then every such expression is strongly \beta-normalizing. No functionality assumption is imposed on \mathcal A or \mathcal R.

Section 1, Introduction Read it in the paper TeX source, line 116

Show the TeX

Let $\mathcal P=(\mathcal S,\mathcal A,\mathcal R)$ be any pure type system.
If every legal expression of $\mathcal P$, in every valid context, is weakly
$\beta$-normalizing, then every such expression is strongly
$\beta$-normalizing. No functionality assumption is imposed on
$\mathcal A$ or $\mathcal R$.

Other possible paper matches, closest wording first

Proposition 59 of Weak and strong normalization in pure type systems. Words of the Lean statement, its names split into words, that also appear in the theorem: wide, beta, weakly, system, weak, legal and one more. Shared only with the release’s name for the Lean statement or OpenAI’s note on it: pure and expression.
Proposition 34 of Weak and strong normalization in pure type systems. Words of the Lean statement, its names split into words, that also appear in the theorem: instantiated, product, weakening, typed, domain, pi and six more.
Proposition 21 of Weak and strong normalization in pure type systems. Words of the Lean statement, its names split into words, that also appear in the theorem: pts, strongly, legal and normalizing. Shared only with the release’s name for the Lean statement or OpenAI’s note on it: expression.
Proposition 57 of Weak and strong normalization in pure type systems. Words of the Lean statement, its names split into words, that also appear in the theorem: context.
Proposition 20 of Weak and strong normalization in pure type systems. Words of the Lean statement, its names split into words, that also appear in the theorem: eq.

How Atlas selects possible matches: it compares words in the Lean statement with every statement in the family. It also splits Lean names into words. The release’s label and note receive less weight; a main theorem wins a close match. If the Lean wording yields no clear match, Atlas uses the catalogue description. This selects passages to compare; it does not establish that they mean the same thing.

Reported Comparator runs

three independent groups report that Comparator accepted runs for this Lean statement file: Carlos Toledo’s cert-machine; MathVet; Neal McBurnett’s openai-math-lean-tooling. Each group reports its own Comparator run for this statement file. Atlas has not repeated the runs.

For a configured theorem, Comparator tests whether OpenAI’s proof proves the exact Lean statement. Some files instead configure definitions for comparison by name and type. Acceptance does not establish that the statement means the same thing as the paper’s theorem.

Carlos Toledo’s cert-machine

How they ran it, in their words

Every Comparator challenge re-run on Linux with nanoda switched on, decided by a preregistered rule; every family’s challenge statements read against OpenAI’s headline, clause by clause. Decider: Comparator (leanprover/comparator d03acab1 = tag v4.34.0, built with the release’s toolchain v4.34.1), lean4export 076e8e57, landrun 811cfff5, nanoda_lib 3a240721 — on GitHub’s Linux runners (.github/workflows/openai-math-kernel.yml), one j…

Accepted Their term: “CERTIFIED”.
Re-run through Comparator with the independent nanoda kernel switched on: Lean’s kernel and nanoda both accept OpenAI’s solution.
Reported 10 October 2026, at the release version shown here. Original verification report

MathVet

How they ran it, in their words

An independent, model-assisted, pre-referee reading of each family’s challenge statements against its headline claim under a published rubric (PROTOCOL.md), with its own Comparator runs per challenge. Its protocol describes a planned error-rate study; this import does not establish that the study has been completed.

Accepted Their term: “comparator-sandboxed-pass”.
Re-run through Comparator in a sandboxed virtual machine: accepted.
Reported 8 October 2026, at the release version shown here. Original verification report

Neal McBurnett’s openai-math-lean-tooling

How they ran it, in their words

Each challenge’s solution is built and checked by Comparator at the pinned release, on Lean leanprover/lean4:v4.34.1, recording the verdict, the check time and the peak memory; the run was still in progress at this snapshot (192 accepted, 224 pending).

Accepted Their term: “accepted”.
Re-run through Comparator with Lean’s kernel: accepted (the check took 45 s; peak memory 6.2 GiB).
Reported 11 October 2026, at the release version shown here. Original verification report

What an accepted Comparator run would establish

If Comparator is run under this configuration and accepts, the solution proves the configured theorem using only the allowed axioms, and the Lean kernel accepts every step.

This configuration lists no definition holes, so every definition the statement uses is compared as it is written in this file.

Allowed axioms: propext, Quot.sound, Classical.choice

Acceptance leaves open whether the Lean statement means the same thing as the paper’s theorem, whether the paper’s other claims are correct, and whether the result is new. Those questions require comparing the definitions and statements, reviewing the paper’s arguments, and reading the earlier literature.

Do family 245’s Lean statements express the advertised result?

These assessments compare all the family’s Lean statements with the whole result OpenAI describes in its catalogue. They do not assess this statement alone. Each group uses its own published rules.

MathVet and cert-machine agree on how much of the advertised result the Lean statements express.

MathVet
Finds the whole advertised result stated or implied Their term: “full”.
The challenge statements imply the headline claim after unpacking definitions or one routine step. Their record
Their note: weak_implies_strong (P : Specification S) (h : SystemWeaklyNormalizing P) : SystemStronglyNormalizing P for every sort type S, arbitrary axioms/rule relations (nonfunctional allowed), annotated lam/pi syntax with β-reduction inside annotations (lam_domain, pi_domain, pi_body), typing rules ax/var/weaken/product/abstraction/application/conversion, valid contexts as lists, legal = ∃ A, M : A ∨ A : M, WN = some β-normal form, SN = Acc. Exactly the β-BGK conjecture including open contexts.
Carlos Toledo’s cert-machine
Finds the whole advertised result stated or implied Their term: “MATCHES”.
The challenge statements state the headline as OpenAI wrote it. Their record

Read the complete assessments on the family page.

OpenAI’s own note on what this Lean statement covers

“The formalization proves the $\beta$-Barendregt–Geuvers–Klop conjecture for pure type systems: if every legal expression in every valid context has some terminating $\beta$-reduction sequence, then every $\beta$-reduction sequence from every such expression terminates. Reduction is allowed inside type annotations, and the specification may have arbitrary sorts and nonfunctional axioms or rules.”
Quoted from OpenAI’s Lean note for this family

An AI agent drafted an interpretation of that note, classifying this statement as “states a paper’s theorem as the paper does”. No human review of the draft is recorded.

Supporting material

The complete Lean statement file

122 lines, copied from release version fd4aeeb. A name defined in this file links to its line; pointing at the name shows its definition.

Declared in this fileOpenAI’s library at fd4aeebOther linked names open the current documentation for Mathlib, Lean’s mathematical library.

Links in the file: 133 to its own declarations, 22 to Mathlib’s documentation. 19 declared names also link to the same declaration in OpenAI’s library. OpenAI uses Mathlib version d13f23b. The linked documentation describes the current version, so names that have since changed may be missing there.

Definitions and lemmas named by the statement

If Comparator accepts a proof, it proves weak_implies_strong exactly as written here. To compare that statement with the paper, also read the definitions and lemmas listed below. Atlas found them by following names in the source text and lists each after the names it uses. For x.foo, Atlas includes every foo defined here for a type, even when the statement may use only one of them.

It reaches all 18 other declarations of the file; with the theorem itself they span 76 lines. 3 of them are named in the statement itself.

Names in the namespace OAI.PureTypeSystem are listed without it.

inductive Exprline 15library
def Expr.liftRenline 27library
def Expr.renameline 31library
def Expr.liftSubline 38library
def Expr.substline 42library
def Expr.singleline 49library
def Expr.instantiateline 53library
structure Specificationline 57in the statementlibrary
inductive Betaline 61library
def Convertsline 70library
def Normalline 72library
def WeaklyNormalizingline 74library
def StronglyNormalizingline 79library
inductive HasTypeline 82library
inductive ValidContextline 100library
def Legalline 105library
def SystemWeaklyNormalizingline 108in the statementlibrary
def SystemStronglyNormalizingline 111in the statementlibrary
theorem weak_implies_strongline 116selected theoremlibrary

import Mathlibnamespace OAI/-!Full annotated PTS syntax, modulo alpha-renaming via de Bruijn indices.Contexts are stored newest-first, each declaration in its prefix context.No functionality assumptions on axioms or product rules.-/namespace PureTypeSystemuniverse uinductive Expr (Sorts : Type u) : Type u  | var : Nat → Expr Sorts  | sort : Sorts → Expr Sorts  | app : Expr Sorts → Expr Sorts → Expr Sorts  | lam : Expr Sorts → Expr Sorts → Expr Sorts  | pi : Expr Sorts → Expr Sorts → Expr Sorts  deriving DecidableEqnamespace Exprvariable {S : Type u}def liftRen (ρ : Nat → Nat) : Nat → Nat  | 0 => 0  | n + 1 => ρ n + 1def rename (ρ : Nat → Nat) : Expr S → Expr S  | var n => var (ρ n)  | sort s => sort s  | app f a => app (rename ρ f) (rename ρ a)  | lam A b => lam (rename ρ A) (rename (liftRen ρ) b)  | pi A B => pi (rename ρ A) (rename (liftRen ρ) B)def liftSub (σ : Nat → Expr S) : Nat → Expr S  | 0 => var 0  | n + 1 => rename Nat.succ (σ n)def subst (σ : Nat → Expr S) : Expr S → Expr S  | var n => σ n  | sort s => sort s  | app f a => app (subst σ f) (subst σ a)  | lam A b => lam (subst σ A) (subst (liftSub σ) b)  | pi A B => pi (subst σ A) (subst (liftSub σ) B)def single (a : Expr S) : Nat → Expr S  | 0 => a  | n + 1 => var ndef instantiate (b a : Expr S) : Expr S := subst (single a) bend Exprstructure Specification (S : Type u) where  axioms : S → S → Prop  rule : S → S → S → Propinductive Beta {S : Type u} : Expr S → Expr S → Prop  | head (A b a) : Beta (.app (.lam A b) a) (b.instantiate a)  | app_left {f f' a} : Beta f f' → Beta (.app f a) (.app f' a)  | app_right {f a a'} : Beta a a' → Beta (.app f a) (.app f a')  | lam_domain {A A' b} : Beta A A' → Beta (.lam A b) (.lam A' b)  | lam_body {A b b'} : Beta b b' → Beta (.lam A b) (.lam A b')  | pi_domain {A A' B} : Beta A A' → Beta (.pi A B) (.pi A' B)  | pi_body {A B B'} : Beta B B' → Beta (.pi A B) (.pi A B')def Converts {S : Type u} : Expr S → Expr S → Prop := Relation.EqvGen Betadef Normal {S : Type u} (M : Expr S) : Prop := ∀ N, ¬ Beta M Ndef WeaklyNormalizing {S : Type u} (M : Expr S) : Prop :=  ∃ N, Relation.ReflTransGen Beta M N ∧ Normal N/-- Accessibility for the converse of reduction: strong normalization,including reductions in all type annotations. -/def StronglyNormalizing {S : Type u} (M : Expr S) : Prop :=  Acc (fun N M : Expr S => Beta M N) Minductive HasType {S : Type u} (P : Specification S) :    List (Expr S) → Expr S → Expr S → Prop  | ax {s t} : P.axioms s t → HasType P [] (.sort s) (.sort t)  | var {Γ A s} : HasType P Γ A (.sort s) →      HasType P (A :: Γ) (.var 0) (A.rename Nat.succ)  | weaken {Γ M B A s} : HasType P Γ M B → HasType P Γ A (.sort s) →      HasType P (A :: Γ) (M.rename Nat.succ) (B.rename Nat.succ)  | product {Γ A B s₁ s₂ s₃} : HasType P Γ A (.sort s₁) →      HasType P (A :: Γ) B (.sort s₂) → P.rule s₁ s₂ s₃ →      HasType P Γ (.pi A B) (.sort s₃)  | abstraction {Γ A b B s} : HasType P (A :: Γ) b B →      HasType P Γ (.pi A B) (.sort s) →      HasType P Γ (.lam A b) (.pi A B)  | application {Γ f a A B} : HasType P Γ f (.pi A B) →      HasType P Γ a A → HasType P Γ (.app f a) (B.instantiate a)  | conversion {Γ M A B s} : HasType P Γ M A → HasType P Γ B (.sort s) →      Converts A B → HasType P Γ M Binductive ValidContext {S : Type u} (P : Specification S) : List (Expr S) → Prop  | nil : ValidContext P []  | cons {Γ A s} : ValidContext P Γ → HasType P Γ A (.sort s) →      ValidContext P (A :: Γ)def Legal {S : Type u} (P : Specification S) (Γ : List (Expr S)) (M : Expr S) : Prop :=  ∃ A, HasType P Γ M A ∨ HasType P Γ A Mdef SystemWeaklyNormalizing {S : Type u} (P : Specification S) : Prop :=  ∀ Γ, ValidContext P Γ → ∀ M, Legal P Γ M → WeaklyNormalizing Mdef SystemStronglyNormalizing {S : Type u} (P : Specification S) : Prop :=  ∀ Γ, ValidContext P Γ → ∀ M, Legal P Γ M → StronglyNormalizing M/-- System-wide weak normalization implies strong normalization for every PTS,including arbitrary sort types, nonfunctional rules and annotated terms. -/theorem weak_implies_strong {S : Type u} (P : Specification S)    (h : SystemWeaklyNormalizing P) : SystemStronglyNormalizing P := by  sorryend PureTypeSystemend OAI

Every extracted statement of the accompanying papers

The statements the atlas extracted automatically from each accompanying paper’s TeX source, with links to the full sources.

Weak and strong normalization in pure type systems

Theorem (The \beta-Barendregt–Geuvers–Klop conjecture)

Section 1, Introduction Read it in the paper TeX source, line 116

Show the TeX

Let $\mathcal P=(\mathcal S,\mathcal A,\mathcal R)$ be any pure type system.
If every legal expression of $\mathcal P$, in every valid context, is weakly
$\beta$-normalizing, then every such expression is strongly
$\beta$-normalizing. No functionality assumption is imposed on
$\mathcal A$ or $\mathcal R$.

Configuration and file facts

File: lean/ComparatorChallenges/TypeSystemNormalization.lean
OpenAI’s Lean catalogue: OpenAI’s Lean catalogue does not list this as a main result; the release’s Lean notes for family 245 link it.
Solution module: OAI.Computability.TypeSystem.Normalization
Allowed axioms: propext, Quot.sound, Classical.choiceThe axioms this configuration allows a proof to use. A replay shows which of them a proof uses.
Imports: Mathlib
Imports from outside Mathlib: None
Local vocabulary: 18 local vocabulary declarations
Lines of Lean, without comments or blank lines: 76
Second proof-verification program (nanoda): Off in OpenAI's configuration.

A shareable summary of this page: the proposed paper match, what the Lean statement expresses, and which reviews are recorded.

Plectis Atlas