bitwise commutes with swapping the combinator's argument order

Identifier: F:nat-bitwise-swap
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

For every Bool -> Bool -> Bool function f and every natural m, n: bitwise(fun a b => f(b, a), m, n) = bitwise(f, n, m).

Formal statement

theorem Nat.bitwise_swap : ((x0 : ((x0 : Bool) -> ((x1 : Bool) -> Bool))) -> ((x1 : AxNat) -> ((x2 : AxNat) -> Eq.{1} AxNat (AxNat.bitwise (fun (x3 : Bool) => fun (x4 : Bool) => x0 x4 x3) x1 x2) (AxNat.bitwise x0 x2 x1))))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

3 direct dependencies 0 direct dependents

Evidence

kernel-Nat.bitwise_swap

Kind: kernel-term
Status: checked

Supports: Nat.bitwise_swap is admitted by the trusted kernel gate with the type recorded in formal.statement.

Checker command

test "$(cargo run -q --release -p axeyum-lean-kernel --example nat_theorem_inventory -- bitwise_swap 2>/dev/null | grep -Ec '^Nat\.bitwise_swap[[:space:]]')" -ge 1

Evidence notes

`build_nat_prelude` admits this theorem only through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type. `nat_theorem_inventory` exits non-zero for a name that does not exist, and `grep -Ec` consumes the pipe so the tested count decides the exit status. Anchored with `^Nat\.bitwise_swap[[:space:]]` so a sibling name cannot satisfy this row. Run `--release` -- the debug build of this inventory example SIGABRTs on stack depth (unrelated to this proof).

compute-Nat.bitwise_swap

Kind: kernel-term
Status: checked

Supports: With f = fst (fun a b => a, deliberately NON-commutative), swap(fst) = snd (fun a b => b): bitwise(swap(fst), 5, 3) = 3 and bitwise(fst, 3, 5) = 3, while the UNSWAPPED bitwise(fst, 5, 3) = 5 -- a discriminating instance where m != n and f is not commutative, so a vacuous test built from and/or/xor (all commutative) could not have caught a transposed swap.

Checker command

cargo test -p axeyum-lean-kernel --lib nat_prelude::nat_prelude_tests::bitwise_swap_applies_at_a_concrete_discriminating_instance

Evidence notes

Applies `Nat.bitwise_swap` symbolically (against free `m`, `n` at a fixed concrete `f = fst_fn`) and at the concrete instance `(m, n) = (5, 3)`, confirming both that the admitted type matches `Eq (bitwise (swap fst) 5 3) (bitwise fst 3 5)` and that the swapped/unswapped values genuinely differ (3 vs 5), so the instance is non-vacuous.

footprint-Nat.bitwise_swap

Kind: instance-pin
Status: checked

Supports: axiom_footprint: [] -- the Nat environment admits no trusted declaration

Checker command

cargo run -q --release -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free nat

Evidence notes

Reports `nat: axiom=0 opaque=0 quotient=0 total_trusted=0`, over the FULL trusted surface rather than `Declaration::Axiom` alone. The enumeration is per-environment, not per-theorem; it bounds this theorem's footprint because a proof cannot depend on a trusted declaration the environment does not contain.

Provenance

{
  "date": "2026-08-29",
  "established_by": "axeyum-lean-kernel build_nat_prelude, lane nat-bitwise-bit-swap",
  "source": "theorem name and canonical type read directly via nat_theorem_inventory, which prints render_lean of the admitted type."
}