Repair formal proofs for a verified garbage collector
Codex edited files and ran builds to repair CertiGC proofs; it handled local repair well, but humans had to check that its invariants preserved the specification.
What they did
Codex had repository access, edited Rocq proof files, ran targeted make builds, and used a rocq-mcp server to inspect proof states. It repaired the VST proofs first, then the graph-isomorphism theorem. It proposed the recorded-backward-edge invariant, and the author reviewed it. He required discussion before any Definition changed and refused new VST preconditions without evidence.
How it went
The branch compiled and merged upstream as PR 30. The main theorem was accepted April 29, and a later audit removed a stale no-backward-edge premise. It was a single case, not a controlled study.
Worth knowing
Expect heavy supervision: about 59 active Codex hours, 415 human prompts and 13,305 tool calls over ten days, with no measured speedup.
Labels
Codex had repository access, edited Rocq proof files, ran targeted make builds, and used a rocq-mcp server to inspect proof states.
It repaired the VST proofs first, then the graph-isomorphism theorem.
Codex had repository access, edited Rocq proof files, ran targeted make builds, and used a rocq-mcp server to inspect proof states.
It proposed the recorded-backward-edge invariant, and the author reviewed it. He required discussion before any Definition changed and refused new VST preconditions without evidence.
The “Material” label failed its quality check and is not used for selection.
Details
- Agents
- Codex
- Source
- other
- Source date
- undated
- Accounts
- 1
- In registry since
- Oct 12, 2026