ℝ.
Op Specs
An Op Spec is the definition of one operator, with parameters. Here is RMSNorm in two variants, fromspecs/TheFormalEra/Ops/Norm.lean:
softmax_shift (subtracting any reference value leaves softmax unchanged) and flashAttn_eq (online softmax with block skipping equals the attention head).
The full list of operators is on Op Specs.
Model Specs
A Model Spec fixes every configuration constant of one checkpoint and assembles Op Specs into a compute graph. The constants are transcribed from the checkpoint’s publishedconfig.json; for example, Qwen3.8-27B in specs/TheFormalEra/Spec/Registry.lean:
input_norm, attn.qkv_proj, attn.core, mlp.act, and so on. A node references an Op Spec and supplies its parameters (H = 5120, eps = 1e-6). The graph also records the value flow: which node’s output feeds which node’s input in every layer.
--lean, the command also prints the Op Spec’s Lean definition:
Shape and value domains
Disposable inference systems are built for one model, so its dimensions are constants. Only runtime dimensions are symbolic. Each Model Spec has a default shape domain:
and a value domain used only for the overflow check: inputs are
bf16 activations with |x| ≤ 65504, and weights with |w| ≤ 64.
A proof holds for every point in the domain. An annotation may narrow the domain (domain={"T": (1, 8192)}), never widen it: widening is an error.
Why Lean 4
- The spec, the lifted kernel semantics and the equivalence proof live in one system. The theorem says “kernel semantics = spec” with no translation step in between.
- The Lean 4 kernel checks every proof, so a closed-source engine does not reduce what you can trust.
- Mathlib supplies the real numbers, sums, matrices and
Real.exp, with a large library of proved facts. - You never need to write Lean.
theformalera spec showand the Spec Hub site render the formulas.
The oracle
The spec library also builds an executable,theformalera-spec, that evaluates any Model Spec on concrete weights and tokens. Its evaluators are proved equal to the spec (runTrace_fst, and the @[csimp] theorems linear_eq_linearPar, seqMap_eq_seqMapPar). This is what model conformance compares PyTorch implementations against.