Skip to content
agentusehub

Repair formal proofs for a verified garbage collector

Codex edited files and ran builds to repair CertiGC proofs; it handled local repair well, but humans had to check that its invariants preserved the specification.

Time saved
Not reported
Setup time
Not reported
Running cost
Not reported
Cost range
Not reported

Use case overview

Codex edited files and ran builds to repair CertiGC proofs; it handled local repair well, but humans had to check that its invariants preserved the specification.

Reported experience

  1. What they did

    Codex had repository access, edited Rocq proof files, ran targeted make builds, and used a rocq-mcp server to inspect proof states. It repaired the VST proofs first, then the graph-isomorphism theorem. It proposed the recorded-backward-edge invariant, and the author reviewed it. He required discussion before any Definition changed and refused new VST preconditions without evidence.

  2. How it went

    The branch compiled and merged upstream as PR 30. The main theorem was accepted April 29, and a later audit removed a stale no-backward-edge premise. It was a single case, not a controlled study.

  3. Worth knowing

    Expect heavy supervision: about 59 active Codex hours, 415 human prompts and 13,305 tool calls over ten days, with no measured speedup.

Example prompts

Try with Codex
In my [Coq/Lean/Isabelle] project at [folder], the proof [file or lemma] is broken after [change you made]. Edit the files, run the build, and repair the proof with the smallest local changes. Do not weaken or change any specification or invariant without asking me first, and finish with a list of every statement you altered so I can review it.
Software & DevOps

Spend leftover AI quota on reviewable PRs

RemainderBot uses a founder's goals and task lists to write PRs with spare Claude and Codex quota, producing 111 PRs including call prep and prototypes.

Claude · Codex