Lean Proof Assistant Officially Ships with Verified Kernels

The automated reasoning ecosystem has reached a major milestone as the Lean project officially rolls out its software featuring fully verified kernels. Driven by the reality that modern AI agents are increasingly efficient at discovering vulnerabilities in proof checkers, the engineering team has overhauled how developments are rechecked. Lean version 4.35.0 now introduces the lake check command, allowing users to export their developments and validate them through isolated, sandboxed external kernels.

src="https://leodemoura.github.io/static/images/leo.jpg" alt="Leonardo de Moura speaking about kernel verification" class="w-full h-auto rounded-2xl shadow-lg border border-black/10 dark:border-white/10 object-contain max-h-[550px] mx-auto block" loading="lazy" /Leonardo de Moura speaking about kernel verification

This release ships with four distinct external kernels, offering unprecedented layers of security against implementation bugs. Among them stands con-leche, engineered using AI supervision and proven consistent in set theory. Because programming mistakes in core checkers can quietly invalidate massive mathematical proofs, having a formally verified kernel eliminates an entire class of systemic errors without sacrificing performance. Operating on the full Mathlib export, con-leche processes instructions efficiently and checks the entire repository in just over a minute using multi-threading.

To mitigate runtime and compiler risks, developers have also introduced con-ron, a Rust translation verified using Aeneas. By running developments through multiple independent kernels using the paranoid command flag, engineering teams gain robust protection against unexpected compiler quirks or memory corruption issues. This redundant verification approach marks a maturation point for formal methods, shifting the focus from trusting a single monolithic checker to a multi-kernel verification pipeline.

Despite these massive strides, scaling remains a formidable challenge for the community. With major repositories stretching from millions to tens of millions of lines of code—and community proposals targeting the billion-line threshold—traditional export formats quickly hit performance walls. The roadmap ahead involves optimizing binary export formats, implementing incremental checking, and expanding compiler verification to support massive industrial codebases.

src="https://leodemoura.github.io/static/images/rss.png" alt="RSS Feed Icon for updates" class="w-full h-auto rounded-2xl shadow-lg border border-black/10 dark:border-white/10 object-contain max-h-[550px] mx-auto block" loading="lazy" /RSS Feed Icon for updates

Ultimately, this architectural shift elevates formal verification from an academic pursuit into a hardened engineering discipline. As mission-critical systems and advanced mathematics increasingly rely on automated proof assistants, establishing absolute trust in the foundational kernel is non-negotiable. Developers are encouraged to adopt the new validation tools in their current projects to catch inconsistencies early.