Trivial lemma

The check is trivial_lemma. It is verify-stage. Severity of a candidate tautology is warning, not fail. Identity-body is info. The hop walks the lemma funclit and the host AST. It does not call Z3. It does not call Kind2.

Four heuristics. H1: substituting the model return into the assertion yields a syntactic tautology. H2: the model body is literally return <param>. H3: the model returns a literal and the lemma checks equality with the same literal. H4: no requires plus a non-trivial body is a counterexample-target lemma, and the hop does not flag it. A // reqproof:trivial-by-design marker silences the rest. The detector prefers a miss over a false flag.

The help file teaches the silent lemma first. One funclit proves the model equals the arithmetic it already is. Nothing in the suite asked whether production add was ever in the claim.

// reqproof:lemma arithmetic_restatement func(a, b int) bool {
//   return AddModel(a, b) == a + b
// }
func AddModel(a, b int) int { return a + b }

# proof audit --check trivial_lemma
# [VERIFICATION] trivial_lemma
# pkg/mathx/add.go:1: lemma "arithmetic_restatement" is a candidate tautology (body_substitution)
# silent lemma: last PROVE still on (a+b) == (a+b)

Pick one resolution, not a stack of them: rewrite the model so it calls production code, delete the lemma, or add // reqproof:trivial-by-design if the restatement is the documentation you meant. Do not raise severity in proof.yaml and call that a rewrite. A quieter hop with the same funclit is the same cheat.

proof audit --check trivial_lemma --verbose

The teaching graph is still one AddModel whose last PROVE sat on (a+b) == (a+b). Close it by pointing the lemma at production add, by deleting the restatement, or by marking it trivial-by-design if the restatement is the documentation. Do not delete the lemma annotations to make the warning disappear. With no lemmas the check passes, and the restatements did not go anywhere. They just stopped being counted.

// reqproof:lemma add_matches_production func(a, b int) bool {
//   return Add(a, b) == a + b
// }
func Add(a, b int) int { return implAdd(a, b) }

# proof audit --check trivial_lemma
# no candidate-tautology lemmas detected. this hop is quiet

A lemma written only to touch a branch, asserting something trivially true, is the same class of cheat on lemma branch coverage. That hop will count the visit. This hop is the one that names the restatement. The solver hop stays on Z3/Kind2 on one function. The hash hop stays on lemma binding freshness. Jama still authors. Proof vs Jama.

Warning, not fail. Not blocking. No project loaded is a pass whose summary says skipped. A scan error is a warn, not a rewrite. No candidate tautology is a pass. Identity-body is info. Orphan // reqproof:* comments are INFO and do not change the verdict. The hop is syntactic. It does not re-run Kind2. It does not re-run Z3. It does not write the lemma. It does not prove the Go. A // reqproof:trivial-by-design marker is a silence, not a proof that the restatement was the right documentation. H4 leaves speculative counterexample lemmas unflagged when they have no requires and a non-trivial body. A lemma with requires skips H1 because the precondition is the claim. The detector prefers a miss. Raising severity to error in proof.yaml is a strictness setting, not a remediation. We have not scored this floor against a frozen Jama pack or a ReqIF export. The loss is named, not scored.

The solver hop stays on Z3/Kind2 on one function. The engagement stays on software correctness audit. Jama still authors.

What is a trivial lemma? Same question. Same URL.

Is this Z3 or Kind2 on one function? No. That hop runs the solver. This hop asks whether the lemma was a tautology before the solver ran. See Z3/Kind2 on one function.

Is this lemma branch coverage? No. That hop is an AST node with an empty covered_by. This hop is a lemma whose assertion is the model body. A trivial funclit still counts as a visit. See lemma branch coverage.

Is this lemma binding freshness? No. That hop is a separate-file binding whose SHA-256 no longer matches the live function. This hop is a live lemma that proves nothing. See lemma binding freshness.

Is this formalization lemma verdict consistency? No. That hop is a SYS-REQ that still says valid while the lemma cache is timeout. This hop is a candidate tautology in the source. See formalization lemma verdict consistency.

Does a tree with no lemmas pass? Yes. The hop reports no candidate tautologies. That is not a proof that the Go is correct. It is a proof that this hop had nothing to join.

Does a green hop prove the code matches the shall? No. The hop observes syntax. It does not prove the Go.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.