Moving cached state between holders, checked against a finite reference
The kernel’s Lean theorems and the workflows run against its reference
- Lean theorems about the kernel
- 9
- Workflows run, each agreeing
- 12
A small, finite domain; no distributed system was tested.
A kernel that moves cached state between holders agrees with an exhaustive reference on every workflow the lab reports, on a small finite domain, and carries Lean theorems about single ownership; a larger figure from the lab's earlier documents was dropped because no file backs it
What it does not claim
It proves agreement with the lab's own reference and kernel, not liveness of a distributed system, behaviour under network partitions or secure custody in hardware. The domain is small and finite. The larger figure once quoted for it is not claimed. The lab's code is not public yet.
The limits, in the lab’s words:
The claim above is narrowed to what the tree actually carries.
It proves agreement with the encoded reference and the stated Lean kernel, NOT distributed-system liveness, partition behaviour or secure hardware custody.
Excerpts, word for word from the published file, where the full text can be read.
When a serving system moves cached state from one holder to another, a bug can leave two holders holding it, or let a stale transfer land. The lab wrote a small kernel for these moves, with one live holder at a time, a closed-off middle step and refusal of stale transfers, and checked it two ways: Lean theorems about the kernel, and an executable reference that tries every case in a small finite domain.
What it shows
In this model: a kernel that hands cached state from one holder to another through an escrow step no one can read, binding each move to an epoch and a generation so that an old transfer is refused.
The lab's Lean file carries 9 theorems about the kernel. Its bench runs and reports 12 non-trivial workflows across abort, commit and evict-and-reallocate families, each agreeing with the reference.
A number that was dropped
An earlier, widely quoted figure for this result counted complete-domain decisions in the hundreds of thousands. The lab looked for the file behind it, found none, and dropped the figure; its limits, quoted on this page, say so.
Why it matters, and to whom
For teams that move KV cache between servers or between tiers, ownership bugs are where a cache serves the wrong customer or corrupts a request. A small kernel with one holder at a time, whose reported workflows agree with an exhaustive reference on a small domain, is a pattern worth knowing; the lab's code is not public yet.
Why now
Serving systems now move cached state between machines, for example between prefill and decode servers, so ownership of that state crosses process boundaries more often than before.
How it was checked
The lab elaborates its Lean library before counting declarations, so the count is regenerated rather than read from text, and its bench runs the workflows against the finite reference.
How to reproduce
The measured results name the lab's command and commit, and the lab's claim and limits are published word for word. Each is listed with its hash in the site's receipt manifest.
The result, in the lab’s exact words
Read it with this condition: the agreement is with the lab's own reference over a small finite domain (a few holders, two tickets, bounded epochs and generations); it says nothing about a real distributed system, network partitions or hardware custody.
A state-movement kernel enforcing exactly one live ownership capability, an unreadable escrow phase, epoch and generation binding and stale-transfer refusal, with 9 Lean theorems and an executable finite reference.
Quoted word for word from the lab’s published claim and limits.
Prior art
- Theorem Proving in Lean 4, "Axioms and Computation": the proof checker the kernel's theorems are written for
Evidence
- The measured results behind this page, read from the lab’s own files at a named version.
- The lab’s current claim and limits, word for word.
- Every file this site publishes.