The lake check command runs a development against the official kernel and four external kernels, highlighting any discrepancies.
LEAN PROOF ASSISTANT RELEASES VERIFIED KERNELS
*Lean v4.35.0 adds sandboxed rechecking and four new kernels, including the first formally consistent kernel written in Lean. The move aims to curb bugs that have plagued the proof assistant’s core.*
Lean’s core proof checker has long been a target for AI‑driven vulnerability hunting. After two postmortems on August 1 and August 24 exposed critical bugs, the Lean FRO accelerated a hardening effort. Version 4.35.0 arrives with a sandboxed lake check command that can re‑run a development against the stripped‑down official kernel, leanchecker. More importantly, the release bundles four additional kernels—nanoda, lean4lean, con‑leche, and con‑ron—allowing developers to cross‑validate proofs with independent implementations in a single step. The move signals a shift from reactive patches to proactive, mathematically verified safety nets.
What new verification features does Lean v4.35.0 introduce?
Lean v4.35.0 ships with the lake check command, which exports a development and rechecks it with leanchecker, the official kernel stripped of ancillary code. The process runs inside a sandbox by default; users can bypass it with lake check --inadvisably-no-sandbox. The release also adds four external kernels—nanoda, lean4lean, con-leche, and con-ron—accessible via lake check --paranoid. In paranoid mode the suite runs a hardened‑memory‑allocator variant of the official kernel, turning memory corruption into a checked abort rather than a silent mis‑answer. The new tooling lets developers validate proofs against multiple independent checkers in a single command.
Why are verified kernels critical for Lean?
AI agents have repeatedly exposed vulnerabilities in Lean’s proof checker, prompting two postmortems on August 1 and August 24. A verified kernel eliminates an entire class of bugs: implementation mistakes in the kernel itself. Con-leche, the first kernel written in Lean and proven consistent, offers this guarantee without a performance hit—executing 0.69× the instructions of the official kernel and completing a full Mathlib check in about 100 seconds on eight threads. By cross‑checking proofs with both con-leche and its Rust translation con-ron, developers gain protection against unsoundness that might linger in the compiler or runtime, dramatically raising confidence in large formal developments.
How does con-leche achieve formal consistency?
Con-leche’s consistency proof was authored by Claude (Fable and Opus) under heavy supervision by Joachim Breitner at the Lean FRO. Consistency means every environment con-leche accepts maps to a model in set theory, following Mario Carneiro’s model of Lean’s type theory. The proof is checked by the official Lean kernel and assumes the underlying set theory’s consistency. To guard against bugs in the compiler and runtime, Joachim used AI to translate con-leche to Rust and then applied Aeneas, a Lean‑based verifier, to prove that the Rust version refines con-leche’s checking algorithm. This layered approach isolates potential unsoundness to the surrounding toolchain rather than the kernel logic itself.
What scalability challenges remain for external kernel checking?
The Lean community now handles codebases measured in millions of lines: Anthropic’s FLT exceeds 13 M LoC, Mathlib sits at 2.5 M LoC, Tau Ceti tops 3 M LoC, and the General Courtade–Kumar theorem repository surpasses 50 M LoC. Proposals for libraries in the 1 B+ LoC range are already circulating. The current external‑kernel workflow—exporting whole projects and rechecking them—does not scale to such sizes. Developers need binary export formats and incremental checking to avoid re‑processing unchanged parts. The Lean FRO acknowledges these limits and is working on binary formats and incremental pipelines to keep verification feasible as the ecosystem expands.
Frequently asked questions
What is the lake check command in Lean v4.35.0?
Lake check exports a development and rechecks it with leanchecker, the official kernel, inside a sandbox. Users can disable the sandbox with --inadvisably-no-sandbox or run all kernels with --paranoid.
Which new kernels are included with Lean v4.35.0?
The release adds four kernels: nanoda, lean4lean, con-leche, and con-ron. Con-leche is written in Lean and proven consistent; con-ron is its Rust translation verified by Aeneas.
How does con-leche achieve formal consistency?
Con-leche’s consistency proof, authored by Claude under Joachim Breitner’s supervision, shows every accepted environment has a set‑theoretic model. The proof is checked by the official kernel and assumes the set theory’s consistency.
The Lean FRO’s verified‑kernel rollout marks a decisive step toward trustworthy formal verification at scale. By coupling sandboxed rechecking with multiple independently verified kernels, the ecosystem gains a robust defense against both implementation bugs and compiler‑runtime glitches. Yet the team admits that binary export formats and incremental checking are still work in progress, a necessity as Lean’s libraries swell into the billions of lines of code. Until those pipelines mature, developers are urged to run lake check --paranoid on every project and report any divergence to contact@lean-fro.org.
Sources: https://leodemoura.github.io/blog/2026-10-15-lean-now-ships-with-verified-kernels/