Check reference
Spot lemmas that only restate their model
A solver can quickly prove a statement that adds no assurance about production behavior. trivial_lemma identifies some common ways that happens.
A heuristic check of the claim's substance
The check scans lemma annotations and applies syntactic heuristics, without running Z3. It looks for model-body substitution that collapses an assertion, identity bodies and hardcoded constants. Findings differ in severity: identity patterns can be informational while stronger candidate-tautology patterns warn. Malformed annotations that prevent scanning are reported rather than treated as a clean corpus.
Illustrative example: proving a copied expression
Model: AddModel(a, b) returns a + b
Assertion: AddModel(a, b) equals a + b
After substitution: (a + b) equals (a + b)
The assertion checks the model against its own expression. It does not establish that the deployed billing function uses the correct inputs, applies the correct cap or handles machine-integer overflow. A mathematically true statement can still be the wrong evidence for the requirement.
Replace repetition with a behavioral obligation
Locate the production function and state what must hold about its observable result under reviewed preconditions. For a capped allocation, useful claims might concern staying within capacity and preserving the requested allocation when it is already valid. Check the translator's supported semantics and bind the claim to the actual implementation. Keep tests for integration behavior outside the proof's scope.
proof audit --check trivial_lemma --verbose
An intentional documentation lemma can use reqproof:trivial-by-design. Review that as an explicit choice about evidence, not a mechanism for relabeling a weak proof as strong.
A clean scan does not establish usefulness
The detector deliberately excludes some patterns, including certain counterexample-seeking lemmas and body substitutions with preconditions. A tautology can evade syntactic heuristics, and an identity can be a legitimate requirement. Review the claim, assumptions and production connection even when no warning appears. Never add a meaningless precondition simply to avoid detection; it changes what the lemma says.
Follow the evidence
Ask which production defect the lemma would reject, then inspect whether its formula really rejects it.
Review one potentially trivial lemma. Bring the claim and production function so we can assess which defect the lemma would reject and whether its assumptions make that evidence meaningful.