bitwise f 0 n = if f false true then n else 0

Identifier: F:nat-bitwise-zero-left
Proof route: kernel-lean
External status: proved
Axiom footprint: Empty

Recorded description

For every bit-combining function f and every natural n, the general bitwise combinator applied to (f, 0, n) equals n when f false true holds and 0 otherwise.

Formal statement

theorem Nat.bitwise_zero_left : ((x0 : ((x0 : Bool) -> ((x1 : Bool) -> Bool))) -> ((x1 : AxNat) -> Eq.{1} AxNat (AxNat.bitwise x0 AxNat.zero x1) (Bool.rec.{1} (fun (x2 : Bool) => AxNat) AxNat.zero x1 (x0 Bool.false Bool.true))))

Dependencies

The graph shows direct ledger edges. Follow a node to open its artifact page.

0 direct dependencies 0 direct dependents

Evidence

kernel-Nat.bitwise_zero_left

Kind: kernel-term
Status: checked

Supports: forall f n, bitwise f 0 n = if f false true then n else 0

Checker command

test "$(cargo run -q -p axeyum-lean-kernel --example nat_theorem_inventory -- bitwise_zero_left 2>/dev/null | grep -Ec '^Nat\.bitwise_zero_left[[:space:]]')" -ge 1

Evidence notes

`build_nat_prelude` admits this theorem through the trusted `Kernel::add_declaration` gate, which re-checks the proof term against the stated type, so producing this row at all is a machine-checked proof. The statement is universally quantified over BOTH the combinator `f : Bool -> Bool -> Bool` and `n : Nat`, and holds unconditionally -- no hypothesis on `f` (in particular, no `f false false = false`) is needed, because fuel is `m = 0` at this call, so the outer `Nat.rec` hits `bitwiseAux`'s fuel-exhaustion row directly and that row IS this statement's RHS by construction: the proof is `Eq.refl`. `nat_theorem_inventory` exits non-zero for a name that does not exist, and `grep -Ec` consumes the pipe and the count is tested, so the exit status depends on what the run found. Anchored with `^Nat\.bitwise_zero_left[[:space:]]` (verified exactly 1 row).

compute-Nat.bitwise_zero_left

Kind: kernel-term
Status: checked

Supports: the theorem specializes correctly at both an absorbing and a non-absorbing f

Checker command

cargo test -p axeyum-lean-kernel --lib nat_prelude::nat_prelude_tests::bitwise_computes_and_its_boundary_theorems_apply

Evidence notes

Instantiates the universal theorem at two concrete `f` witnesses built inline (`and_fn`, `or_fn` -- this prelude declares no top-level `Bool.and`/`Bool.or`) and a concrete `n = 7`, confirming the ADMITTED TYPE at each instantiation `def_eq`s the expected specialization: at `and_fn` (absorbing on this side) `bitwise and_fn 0 7` reduces to `0`, at `or_fn` (identity on this side) it reduces to `7` -- with negative controls asserting each instantiation does NOT also state the other's value, so a definition that ignored `f` entirely (always returning `n`, or always `0`) cannot pass both.

footprint-Nat.bitwise_zero_left

Kind: exhaustive-enumeration
Status: checked

Supports: axiom_footprint: [] -- the Nat prelude's trusted surface is empty

Checker command

cargo run -q -p axeyum-lean-kernel --example nat_axiom_inventory -- --require-axiom-free nat

Evidence notes

`nat_axiom_inventory --require-axiom-free nat` enumerates the built Nat environment and exits non-zero unless it admits no Axiom, Opaque or Quotient declaration. `Nat.bitwiseAux` uses the same structural fuel device as `Nat.landAux`/`Nat.lorAux`/`Nat.ldiffAux` rather than Mathlib's well-founded `Nat.bitwise`, so nothing here needs `WellFounded`/`Quot.sound`/`propext`; this command is what makes the axiom-freedom claim falsifiable rather than asserted. Measured with `Nat.bitwise` landed: `nat: axiom=0 opaque=0 quotient=0 total_trusted=0`.

Provenance

{
  "date": "2026-08-28",
  "established_by": "axeyum-lean-kernel build_nat_prelude, lane nat-bitwise-general",
  "source": "one of two f-general boundary theorems `declare_bitwise_all` (`crates/axeyum-lean-kernel/src/nat_prelude/bitwise.rs`) admits alongside the `Nat.bitwise`/`Nat.bitwiseAux` definitions"
}