JouleProof · a Transaction Science pillar

The energy-optimized formal prover.

AI theorem-proving has one recipe — a model writes proofs in Lean, a verifier checks every step, and the loop trains on what compiles. The axis no one optimizes is the only one that makes verifying real code affordable: joules per verified proof. JouleProof reports the joules next to the pass rate, and sends each obligation to the cheapest tier that can close it.

T0–T3

Solver tiers

Grader (the verifier)

Correctness traded

same verified output · an order of magnitude less energy

The bet

Make verification cheap, not just capable.

The technique is not the gate. The recipe — a prover model, a formal language, a verifier as the grader, autoformalized data, and search — is published and increasingly open. What is gated is energy: the flywheel costs millions of tokens per hard proof, and "verify every line of generated code" is impossible at that price.

So energy efficiency is not an optimization on top of the market — it is the precondition for the market. JouleProof attacks the actual cost center and reports the result as a first-class number. Correctness is never on the table: the verifier is the grader, so a proof is machine-checked or it is not recorded. JouleProof only changes which tier pays for the proof.

The ladder

The cheapest sufficient solver wins.

Every proof obligation goes to the minimum viable tool and escalates only on failure. The joules spent on a cheaper tier that ran and failed before the winner are recorded as the disclosed cost of escalation — never hidden. A caller may also declare a joule ceiling: no rung is begun whose nominal cost would take the run past it, and a run halted for budget is recorded as exactly that — never as a verdict on the goal.

Automation

Lean tactics

Lean's built-in automation — simp, omega, ring, aesop, polyrith. Deterministic, CPU, effectively free. A large fraction of the subgoals in any real proof close here, and a frontier forward pass is never spent on what aesop discharges instantly.

SMT

decision procedures

Z3 / CVC5 for the decidable fragments they cover — orders of magnitude cheaper than model search where it applies.

Small model

distilled prover

A small, in-domain distilled prover (1–7B / few active params) for the steps that genuinely need learned search. Energy scales with active params × tokens, so this is far cheaper per proof than a frontier model.

Frontier model

last resort

A frontier reasoning model — the last resort, for high-level strategy and the genuinely hard leaves only. The most expensive rung, so the router sends as little here as it can.

The flywheel

The data flywheel becomes an energy flywheel.

Verified proofs are content-addressed and memoized — premise selection over the library plus an accumulating proof database. An identical goal is reused for zero new joules, and the more that has been proved, the cheaper every future proof gets. The cache is durable, because the asset that compounds is the corpus of verified proofs, not the routing trick.

Efficiency, on its own, diffuses. What lasts is the accumulated verified data and the integration around it — so the cache is built to persist.

The receipt

A verified proof that carries its own energy.

Each proof seals as a signed receipt: the machine-checked artifact, the tier that closed it, the joules it cost, the energy a frontier-only run would have spent, and — when the run declared one — the joule ceiling it was obtained under. A verified result that travels with a verifiable record of what it cost — the measurable claim, signed.

proved · closed at T0:automation · 50 uj
baseline (frontier-only): 50,000,000 uj
spec: Ungrounded   (proof attested, statement not validated against intent)
stand-in: no       (closed_by_stub omitted — a real decider closed it)
signature: verified ✓

Honesty

What's recorded, not glossed.

Four things are first-class in the receipt and its accounting rather than smoothed over in the framing.

Proof ≠ spec

A machine can prove a formal goal perfectly while that goal fails to encode what anyone meant — a verified proof of the wrong specification is worthless. Every goal carries a spec-grounding (Ungrounded / HumanReviewed / CrossChecked), and the prover never upgrades it on its own. A receipt attests the proof; Ungrounded says, in the artifact itself, that the statement was not validated against intent.

The multiple shrinks with difficulty

Routing wins the easy cases, but the few goals that reach the frontier model dominate the joules — so the energy multiple is smaller on harder work. The accounting reports energy per closing tier, so that degradation is visible, never averaged away.

Energy is reported at all

Per-proof energy is something the field leaves out — it is inferable only from device-days. A signed, per-proof joule receipt, with honest provenance (HwShunt / ModelBased / Estimator), is itself the contribution.

Signed ≠ proved

A reference stand-in exercises the ladder and discharges nothing, yet a receipt it closes is honestly signed and still verifies — substantively empty, which is worse than forged. So a stand-in must declare itself, the mark survives the proof cache, and the signed receipt carries closed_by_stub whenever one closed the goal. Verifying the envelope establishes the signature; this field says whether the verdict was earned.

JouleProof claims no secret technique. It claims the discipline the field skipped: attack the real cost center, and report it.

The standard

An open standard underneath.

The vendor-neutral core is published as proof — a Transaction Science open standard, "a carrier for verified work." It fixes the content-addressed proof obligation, the cheapest-sufficient cascade with disclosed escalation and an optional joule ceiling, the honest energy-provenance model, the declaration of stand-in solvers, and the signed receipt — Apache-2.0 for the reference code, CC-BY-4.0 for the specification. The protocol is ownerless: any prover can emit a proof receipt, and any auditor can verify it with the family's shared JCR-1 tooling.

JouleProof is the steward and the services layer over that standard — not its proprietor. What endures is not the format, which diffuses by design; it is the accumulating corpus of verified proofs and the integration around it.

proof/1 receipt profileJCR-1 interoperableApache-2.0 / CC-BY-4.0C1–C5 conformance

Read the proof standard

Reference

The router, the cache, the receipt — real and tested.

The orchestration is the wedge: routing trivial goals away from the model is the immediate, large energy cut, and the harness measures it. The bottom two rungs are real, with energy measured from execution — an in-process propositional decider at T0, and a resident Z3 process at T1 (assert the negation; unsat means proved). The model rungs are declared stand-ins until their backends are wired: they exercise the cascade, the accounting and the receipt, discharge nothing, and any receipt they close is marked as such. The real ladder ends at T1 and answers Unproved rather than escalate into one. Measuring rather than asserting is the point: it was the measurement that exposed Z3's per-spawn startup cost and argued for keeping the solver resident.

proof-schema

Content-addressed goals, the tier ladder, the honest joule (HwShunt / ModelBased / Estimator, coupling enforced), spec-grounding, the verdict, and the Solver trait every backend implements.

proof-cascade

The escalation engine with an optional joule ceiling, the content-addressed proof cache (durable, stand-in mark preserved), batch energy accounting against a frontier-only baseline, and a hardware energy meter (HwShunt) where an energy interface is present.

proof-solvers

Two real rungs with measured energy — an in-process propositional decider (T0) and Z3, shelled or kept resident (T1) — which refuse rather than fake. The model rungs are stand-ins that declare themselves, and the real ladder never escalates into one.

proof-receipt

The signed proof/1 receipt — canonical det-CBOR in a COSE_Sign1 / Ed25519 envelope, byte-compatible with the family's JCR-1 verifiers. Refuses to seal an unproved goal.

proof-conformance

C1–C5 and the negative pack, plus a joule-ceiling check (C6), all real, with the published vectors in conformance/v1/.

proof-cli

A headless run of a proof workload reporting joules-per-proof, the tier each goal closed at, and the energy a frontier-only run would have spent — with --measure for a real hardware reading of a T0 proof.