Physics as Code: From Scans to Theorems with ITP APIs in $SU(5)$ Model Building

Ph ysics as Co de: F rom Scans to Theorems with ITP APIs in S U (5) Mo del Building Sv en Kripp endorf ∗ Joseph T o ob y-Smith † ∗ D AMTP and Ca v endish Lab oratory , Univ ersity of Cambridge Wilb erforce Road, CB3 0W A, Cam bridge † Departmen t of Computer Science, Universit y of Bath, Bath BA2 7A U, UK Abstract A recurring c hallenge in theoretical ph ysics is to mak e reliable global statemen ts ab out b ounded but combinatorially large model spaces. Exhaustiv e scans quic kly become opaque or impractical, while statistical exploration does not b y itself provide theorem-back ed guaran tees. This motiv ates w orkﬂo ws in whic h the mo del-building problem itself is formalized inside an in teractive theorem pro ver (ITP). In this pap er w e dev elop an API-based metho dology for formalizing suc h bounded model- building questions inside Lean, an interactiv e theorem prov er. The central step is to represen t the relev ant charge sp ectra, predicates, and reduction mov es as reusable ITP deﬁnitions, and then to derive the classiﬁcation from pro ved reduction theorems rather than from an ad ho c scan. W e demonstrate the strategy in a concrete S U (5) case study motiv ated b y F-theory model building with additional Ab elian symmetries. A t the c harge-sp ectrum lay er, we classify b ounded spectra that admit a top-quark Y uk a wa coupling, av oid a selected set of dangerous op erators, and satisfy a minimal charge-spectrum completeness condition. Our main result shows that ev ery such sp ectrum in the b ounded searc h space arises from ﬁnitely many minimal top-Y uk aw a witnesses together with controlled comple- tions and certiﬁed closure steps. This classiﬁcation represents a formally v eriﬁed description of the full viable class in the charge-spectrum setting studied here. The developmen t is implemen ted inside PhysLib as reusable infrastructure rather than as a one-oﬀ v eriﬁcation script. It provides a proof of principle for how in teractiv e theorem prov ers can turn combinatorially diﬃcult mo del-building problems into correctness-ﬁrst, reusable workﬂo ws, and w e discuss ho w the resulting certiﬁed classiﬁcation can serve as reliable input for downstream analyses. 1 Con ten ts 1 In tro duction 3 2 F rom the Ph ysics Question to a F ormal Classiﬁcation Problem 6 2.1 The running example and its physics origin . . . . . . . . . . . . . . . . . . . . . . . 6 2.2 Wh y brute-force scans are not enough for a certiﬁed classiﬁcation . . . . . . . . . . . 7 2.3 Minimal witnesses and controlled completions . . . . . . . . . . . . . . . . . . . . . . 8 2.4 A mathematical summary in PhysLib-st yle notation . . . . . . . . . . . . . . . . . . 8 3 F ormal V o cabulary: a PhysLib API for Charge Sp ectra 10 3.1 Charge sp ectra as the basic ob ject . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 3.2 Structural relations and instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3.3 In terface deﬁnitions: the verbs of the API . . . . . . . . . . . . . . . . . . . . . . . . 12 3.4 F ormalizing the b ounded mo del space . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.5 Co de organization and reusability in PhysLib . . . . . . . . . . . . . . . . . . . . . . 15 4 Certiﬁed Reduction: F rom Minimal T op-Y uk a w a Witnesses to Complete Charge Sp ectra 15 4.1 Minimal top-Y uk aw a witnesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 4.2 F rom witnesses to complete charge spectra . . . . . . . . . . . . . . . . . . . . . . . . 17 4.3 Main theorem: completeness of the certiﬁed viable c harge-sp ectrum class . . . . . . . 17 4.4 Pro of strategy and why it matters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 4.5 Lean statements and pro of commen tary . . . . . . . . . . . . . . . . . . . . . . . . . 19 5 F rom Certiﬁed Reduction to Executable Classiﬁcation 20 5.1 F rom the certiﬁed reduction to a concrete closure computation . . . . . . . . . . . . 21 5.2 What is prov ed and what is computed . . . . . . . . . . . . . . . . . . . . . . . . . . 22 5.3 F rom c harge sp ectra to fuller phenomenological data . . . . . . . . . . . . . . . . . . 22 5.4 Viable and non-viable regions of the b ounded mo del class . . . . . . . . . . . . . . . 23 5.5 T ypical w orkﬂow snipp et and practical use . . . . . . . . . . . . . . . . . . . . . . . . 23 6 Conclusions and Outlook 25 2 1 In tro duction The larger scien tiﬁc goal. A cen tral long-term goal of string phenomenology is to understand whether string theory can provide a viable uniﬁed description of gra vity and the other fundamental forces that is consistent with exp erimen tal constraints. A ddressing that question requires statements ab out whole classes of low-energy eﬀective ﬁeld theories rather than isolated examples. One would lik e to know whether a given construction admits phenomenologically viable v acua at all, whether certain classes are excluded, ho w viability dep ends on assumptions, and how surviving mo dels are distributed across a b ounded region of model space. This viewp oint lies naturally b etw een the string landsc ap e , which aims to describ e the space of consistent v acua [1, 2, 3], and the swampland pr o gr amme , which seeks criteria separating eﬀective theories that can arise from quantum gravit y from those that cannot [4, 5]. In practice, how ev er, progress is often driv en by explicit constructions, bounded scans, and statistical or sampling-based mo dels. These to ols are v aluable, but their conclusions inherit the limits of the assumptions and guarantees that accompany them. In some settings rigorous global statemen ts are p ossible — for example, under suitable assumptions one can prov e ﬁniteness state- men ts for parts of the ﬂux landscap e [6]. More broadly , one is still faced with large com binatorial mo del spaces for whic h case-b y-case analysis, sampling, or statistical surrogates do not by them- selv es pro vide the desired lev el of control. This has motiv ated substantial w ork based on coun ting, b ounded enumeration, and geometric b ounds [7, 8, 9]. Our aim is diﬀerent: not merely to certify a ﬁnal list of outputs, but to formalize and certify the reduction mechanism that pro duces that list inside an in teractive theorem prov er. The same tension app ears w ell beyond string phenomenology , across b ey ond-the-Standard-Mo del settings where gauge sectors, c harge assignments, couplings, and consistency conditions proliferate combinatorially . A representativ e example: GUT mo del searc h with additional Ab elian symmetries. A representativ e example, and the one used throughout this pap er, is S U (5) mo del building with additional Ab elian symmetries, follo wing the notation and phenomenological setup of [10] and re- lated F-theory constructions suc h as [11, 12]. Ev en in this comparatively concrete setting, one m ust c ho ose c harges, determine whic h op erators are allow ed or forbidden, and imp ose a minimal c harge-sp ectrum completeness condition requiring b oth Higgs sectors and b oth matter sectors to b e present. Historically , single- U (1) mo dels and a few classes with tw o additional U (1) symmetries could still b e analysed systematically , but b ey ond that the combinatorial growth rapidly b ecomes prohibitiv e. W e use this setting as a proxy for a broader issue: ho w to turn a b ounded searc h o ver man y candidate mo dels int o a structural classiﬁcation with explicit guaran tees, rather than an implemen tation-dep enden t scan of isolated examples. F actoring out the combinatorics. The key idea is to prov e statemen ts that shrink the relev ant searc h problem b efore an y explicit enumeration takes place. Here “com binatorics” refers to the rapid gro wth of candidate charge sp ectra together with the op erators, exclusions, and completion mo ves that m ust be c hec ked. The p oin t is not merely to scan faster, but to identify reusable structure that remov es large parts of the search space a priori . In the presen t context, monotonicity means that certain predicates b eha ve predictably under enlargement of a charge sp ectrum; for example, once a coupling is presen t, it remains present in an y larger sp ectrum con taining the relev ant c harges. Closur e means that after one has found a certiﬁed seed or certiﬁed completion, the admissible enlargemen t mov es used in the argument remain inside a controlled candidate class. Sc aling therefore no longer means sp ending more compute on a larger scan. It means pro ving the 3 reduction once and reusing it as the b ounded class is enlarged. Our suggestion is to build this logic directly into the mo del-building w orkﬂow in a reusable formal form. The prop osed mec hanism: theorem-bac ked APIs in an interactiv e theorem pro v er. W e implement this viewp oin t by treating the ph ysics subproblem as an applic ation pr o gr amming interfac e (API) design problem inside Lean, an interactiv e theorem pro ver [13]. The basic ob ject of the API mak es the physical data explicit, and the interface deﬁnitions enco de the questions ph ysicists actually ask — whether a term is allow ed, whether a sp ectrum is complete, whether dangerous op erators app ear, and so on. On top of this interface one pro v es reusable lemmas and r e duction the or ems , by which w e mean theorems showing that every ob ject satisfying the target predicates can b e generated from smaller certiﬁed witnesses by controlled completion and enlargement steps. The p oin t is not to replace the usual ph ysics language, but to recast it in a form precise enough to supp ort pro of reuse. This p erspective builds on the emerging use of Lean and library-based formalization in high- energy physics and related areas [14, 15, 16, 17]. The deliverable is therefore not only a pro of-c heck ed argumen t but a reusable semantic lay er that later formalizations can extend without rebuilding the whole reasoning stac k. That is the route to scalabilit y we advocate: in vest once in stable deﬁnitions and reductions, then reuse them across larger bounded classes and related mo del-building problems. W e also note recent formalization eﬀorts in physics and neigh b ouring domains, including quantum information [18], formal QFT [19], agentic autoformalization for quan tum computation [20], and in ph ysical c hemistry [21]. What w e demonstrate in this paper. W e instantiate this programme in a concrete string- inspired S U (5) setting with additional Ab elian symmetries, mentioned ab o v e, closely following the notation and op erator language of [10] within the broader F-theory GUT context of [11, 12]. A t the c harge-sp ectrum lay er, the b ounded problem is to classify those sp ectra that admit a top Y uk aw a coupling, forbid a selected set of dangerous sup erpotential and Kähler p oten tial op erators, and satisfy a minimal completeness condition requiring b oth Higgs sectors and b oth matter sectors to b e presen t. Separately , we trac k one-step Y uk aw a-induced regeneration only in the sup erp oten tial sector. The example is intended as a pro of of principle for the formal workﬂo w rather than as a complete phenomenological analysis, but it is already large enough to sho w ho w the reduction c hanges the problem from an opaque search o v er raw candidates to a theorem-bac k ed classiﬁcation of the viable charge spectra. Main result. Within the b ounded class studied here, every viable complete mo del arises from ﬁnitely man y minimal top-Y uk a wa witnesses together with controlled completions. In this sense, the theorem replaces exhaustiv e generation ov er a combinatorially explo ding ambien t class by a certiﬁed construction of exactly the viable complete mo dels. This has an immediate practical consequence. Later phenomenological reﬁnements can b e ap- plied to a theorem-back ed reduced class rather than to an intractably large raw search space. The dev elopment is implemented as a reusable Lean comp onen t inside Ph ysLib, so the main point is not only one classiﬁcation theorem, but a reusable formal in terface that can guide future formalizations in larger charge spaces and related b ey ond-the-Standard-Mo del settings. The rest of the paper is organized as follows. Section 2 stays at the ph ysics level: it ﬁxes the running S U (5) example, form ulates the b ounded classiﬁcation problem, and motiv ates the reduction strategy without y et introducing Lean deﬁnitions. Section 3 then translates those ingredients in to a reusable PhysLib API. Section 4 states the certiﬁed reduction theorem and explains how the pro of 4 Ph ysical mo del-building question Whic h b ounded charge spectra are phenomenologically viable? Mo del class C S U (5) charge spectra with additional U (1) data Ph ysics requiremen ts P top Y uk aw a present, dan- gerous op erators absent Lean core ob ject ChargeSpectrum Lean predicates AllowsTerm , IsComplete , Y uk aw a-regeneration predicates F ormalized classiﬁca- tion problem in Lean classify those x ∈ U ( I ) that satisfy the target predicates Certiﬁed classiﬁcation output U ( I ) : b ounded model class V ( I ) : certiﬁed viable class Pro v able endp oin t Soundness: if x ∈ V ( I ) , then x is viable and complete. Completeness: every viable complete x ∈ U ( I ) lies in V ( I ) . Figure 1: W orkﬂow of the certiﬁed classiﬁcation. A physical mo del-building question is decomposed in to a mo del class C and a set of physics requirements P . Both are formalized in Lean: the mo del class through the core ob ject ChargeSpectrum , and the target requiremen ts through Lean predicates. This yields a formal classiﬁcation problem on the b ounded class U ( I ) , whose output is the certiﬁed viable class V ( I ) , together with soundness and completeness guarantees. is assembled from witness, completion, and closure lemmas. Section 5 turns that certiﬁed reduction in to a concrete computation and clariﬁes what is prov ed versus what is merely ev aluated. W e then summarize lessons learned and outline p ossible extensions. Figure 1 giv es a roadmap for the certiﬁed workﬂo w developed in the remainder of the pap er. The co de itself can b e found at https://github.com/leanprover- community/physlib . 5 2 F rom the Physics Question to a F ormal Classiﬁcation Problem The purp ose of this section is to bridge from the informal ph ysics question to the formal clas- siﬁcation problem later implemented in Ph ysLib. Although the motiv ating example comes from sup ersymmetric S U (5) mo del building with additional Ab elian symmetries, the reduction pattern itself is more general and not tied only to string-sp eciﬁc input. The target classiﬁcation problem is to c haracterize, within a b ounded search space of c harge sp ectra, exactly those sp ectra that admit the top Y uk aw a coupling, a void the selected dangerous op erators, a void one-step Y uk aw a-induced regeneration in the superp otential sector, and satisfy the minimal charge-spectrum completeness condition. 2.1 The running example and its ph ysics origin In this subsection w e follo w the notation and phenomenological setup of [10] within the broader F-theory context of [11, 12]. In that literature, one considers charges for matter m ultiplets in the 10 and ¯ 5 represen tations together with charges for the Higgs m ultiplets, and asks whic h charge assignmen ts are compatible with a c hosen set of phenomenological requirements. In the present pap er the broad question is: Giv en a b ounded set of allow ed charges, whic h charge sp ectra can giv e rise to phe- nomenologically viable mo dels? This style of question is familiar from earlier mo del-building w ork: one imp oses selection-rule con- strain ts, requires a top Y uk a wa sector, forbids a chosen list of dangerous operators, and studies the surviving charge assignmen ts. A t this stage it is useful to sa y informally what w e mean by a char ge sp e ctrum . F or us, a c harge sp ectrum records whic h distinct Higgs and matter charges o ccur in the relev ant sectors. A t this lev el it do es not record m ultiplicities of curves carrying the same c harge. A conv enien t to y sp ectrum at the lev el used in this pap er is simply the record that the charge − 1 o ccurs in the 10 -sector, the c harge 0 occurs in the 5 -sector, and the Higgs charges are q ( H u ) = − 2 and q ( H d ) = − 3 . It should b e read as a record of distinct charge v alues present in eac h sector, not as a full multiplicit y assignmen t. This to y example is deliberately to o small to b e realistic, but it already illustrates the ﬁnite c harged data that later b ecomes the formal ob ject. The present pap er fo cuses on the char ge-sp e ctrum layer of the problem. A full phenomenological pip eline must later incorp orate further ingredien ts such as ﬂux data, c hiralit y assignments, anomaly cancellation, and conditions suc h as the absence of exotics. The p oin t here is not to address those later stages, but to isolate one lay er on which a mathematically controlled theorem can already b e pro ved. This is enough to demonstrate the workﬂo w while keeping the ﬁrst ob ject conceptually clean. F or the notation and op erator language used b elo w, we stay close to [10] and the related F- theory discussion in [11]. At the level treated in this pap er, the formal ob ject records only the sp ectrum of distinct charges, not multiplicities. The phenomenological exclusion imp osed at the c harge-sp ectrum level is chosen to match the Lean predicate IsPhenoConstrained . Concretely , we 6 forbid the dangerous sup erpotential op erators µ 5 H u ¯ 5 H d , (1) β i ¯ 5 i M 5 H u , (2) Λ ij k ¯ 5 i M ¯ 5 j M 10 k , (3) W 1 ij kl 10 i 10 j 10 k ¯ 5 l M , (4) W 2 ij k 10 i 10 j 10 k ¯ 5 H d , (5) W 4 i ¯ 5 i M ¯ 5 H d 5 H u 5 H u , (6) and, following Eq. (3.12) of [11], also the dangerous Kähler-p otential operators K 1 ij k 10 i M 10 j M 5 k M , (7) K 2 i ¯ 5 H u ¯ 5 H d 10 i M . (8) These eigh t operator lab els are exactly the ones later bundled into IsPhenoConstrained . The re- generation analysis is a separate ingredient: here we only test whether dangerous sup erp otential op erators can b e re-generated, up to the chosen level, b y Y uk aw a-induced singlet insertions. Later, in the formal API, all op erator labels — including W3 , topYukawa , and bottomYukawa — are pack- aged into a ﬁnite datatype of p oten tial-term lab els. A simple b ounded example to keep in mind is the toy charge men u ab o ve: even there one already has to c ho ose optional Higgs entries and subsets of allow ed matter charges, and the combinatorics b ecome m uch w orse once the charge men us gro w. 2.2 Wh y brute-force scans are not enough for a certiﬁed classiﬁcation A conceptually straightforw ard baseline is to enumerate all charge assignmen ts in a b ounded mo del class and then ﬁlter them by the desired constraints. This quickly b ecomes unsatisfactory for tw o reasons. • Conceptual opacit y and implementation dep endence. Even in a ﬁnite searc h space, the correctness of a brute-force algorithm can dep end on implementation details: how sp ectra are generated, whic h branches are pruned, whether symmetries are quotien ted correctly , and whether all relev ant cases are actually reached. A raw scan do es not by itself make these p oin ts transparent. • P o or scaling of the searc h space. As the allow ed c harge menu gro ws, the n umber of candidate spectra and asso ciated c hecks grows rapidly . What is manageable in a tin y example b ecomes opaque or infeasible in a broader b ounded class. These com binatorial eﬀects b ecome even more sev ere once the goal is not just to search, but to pro ve an exhaustive classiﬁcation. Historically , one could still mak e fairly explicit global statements for v ery small classes, in particular for single- U (1) models, and with substan tial eﬀort some classes with t wo additional U (1) symmetries could also be treated. Bey ond that, how ev er, the com binatorics b ecome to o sev ere for direct scanning to remain a satisfactory route to global statements . A theorem-bac ked classiﬁcation has a diﬀerent scientiﬁc status from an opaque scan. Exclusion from the ﬁnal class is then not merely the outcome of a script, but the consequence of a prov ed statemen t that every spectrum satisfying the target conjunction arises from certiﬁed witnesses and completions inside the b ounded search space. This is also where scaling changes c haracter: one scales by reusing the prov ed reduction, not by rerunning a larger opaque enumeration. 7 2.3 Minimal witnesses and con trolled completions The main reduction strategy follows a very ph ysical wa y of thinking ab out mo del building. In practice, one rarely starts from the full am bient search space of all p ossible mo dels. Instead, one ﬁrst identiﬁes the minimal ingredients that realize the local structure one cares ab out, and then asks ho w these ingredien ts can b e completed into full mo dels without sp oiling the desired prop erties. Our pro of strategy mirrors exactly this in tuition. First, we isolate minimal witnesses : small c harge sp ectra that already realize the k ey local structure of interest. In the present pap er this means minimal sp ectra that allo w the top Y uk aw a term. Here “minimal” should b e understo od literally: a witness is minimal if it allo ws the top Y uk a wa coupling, but no prop er sub-sp ectrum do es. Equiv alen tly , one cannot remov e any charged ingredien t from the witness and still retain the desired top-Y uk aw a structure. In the toy example ab o ve, supp ose the top Y uk aw a is realized by a neutral coupling of the form 10 − 1 10 − 1 H u . Here 10 q denotes a 10 -curve of c harge q , so in particular 10 − 1 means a 10 -curve of c harge − 1 . Then the sp ectrum consisting only of the c harge − 1 for the relev ant 10 -curve together with the Higgs-up c harge − 2 is a minimal witness for the top Y uk aw a: if one remo ves either constituent, the coupling is no longer av ailable. Second, we study c ontr ol le d c ompletions . Once such a minimal witness is ﬁxed, one asks which additional Higgs and matter curv es can b e added so as to pro duce a complete mo del while preserving the relev an t viabilit y predicates. In the toy example, this means adding the further matter and Higgs sectors required for completeness — for instance, adding the missing ¯ 5 matter sector and the do wn- t yp e Higgs sector — without introducing forbidden op erators. In the actual theorem this completion step is not arbitrary: it is constrained b y the same physics logic that guides ordinary mo del building. This is an imp ortan t p oin t conceptually . The pro of do es not replace a physicist’s wa y of thinking b y something alien. Rather, it formalizes a familiar mo del-building strategy: identify the smallest lo cal seed with the desired coupling structure, then enlarge it in controlled wa ys until a complete mo del is obtained. In this sense, the pro of remains guided b y ph ysics intuition. This already previews the pro of structure of the later pro of: ﬁrst isolate minimal witnesses, then c haracterize admissible completions, and ﬁnally pro ve closure and exhaustiv eness in the b ounded search space. F or instance, one may think of the b ounded one- U (1) and tw o- U (1) cases as concrete instances of the general witness-and-completion pattern. There is also a suggestiv e analogy with generativ e models. A learned generative mo del starts from a restricted seed distribution and pro duces candidate outputs by a controlled generation mech- anism. Here to o the theorem identiﬁes a ﬁnite family of admissible seeds — the minimal witnesses — and a controlled completion procedure that generates the candidate class. The crucial diﬀerence is that in the presen t setting the generation mechanism is theorem-bac k ed and exhaustive within the b ounded search space rather than merely statistical. 2.4 A mathematical summary in Ph ysLib-st yle notation W e now rewrite the discussion in a notation that is already close to the even tual formalization in Ph ysLib. Let Z denote the ambien t charge t yp e, and let S ¯ 5 , S 10 ⊂ Z 8 b e ﬁnite sets of allow ed charges. These determine a b ounded mo del class of charge sp ectra, U ( S ¯ 5 , S 10 ) := ofFinset S ¯ 5 S 10 . Concretely , this means that every Higgs and matter charge app earing in the sp ectrum must b e dra wn from the c hosen b ounded menus for the appropriate representation. Inside this b ounded mo del class we w ant to characterize those sp ectra x satisfying the following target conjunction: Allo wsT erm x topY uk a wa ∧ ¬ IsPhenoConstrained x ∧ ¬ Y uk a waGeneratesDangerousA tLev el x 1 ∧ IsComplete x. (9) This conjunction deﬁnes the charge sp ectra that we ultimately w ant to classify . The individual predicates hav e direct physical meanings: • AllowsT erm x topY uk aw a says that the charge sp ectrum x admits the top Y uk aw a coupling. • IsPhenoConstrained x bundles the selected dangerous op erators in tro duced earlier and forbids them already at the charge-spectrum level. • Y uk aw aGeneratesDangerousAtLev el x 1 sa ys that a dangerous op erator is re-generated after one Y uk aw a-induced singlet insertion. • IsComplete x enco des the minimal requiremen t that b oth Higgs sectors and b oth matter sectors are present. It is also useful to make the op erator regeneration step explicit. Supp ose an op erator O carries total charge q ( O ) , and singlets S k with charges q ( S k ) acquire v acuum exp ectation v alues. If in tegers n k ≥ 0 exist such that q ( O ) + X k n k q ( S k ) = 0 , (10) then O can b e re-generated with suppression Y k  ⟨ S k ⟩ M GUT  n k . (11) F or a single singlet this reduces to the standard F roggatt–Nielsen expression  ⟨ S ⟩ M GUT  n . In particular, “level 1 ” means that one Y uk aw a-generated singlet insertion already suﬃces to regen- erate a dangerous op erator. W e hav e already referred informally to a reduction theorem; here is the precise meaning in the presen t setting. Rather than classifying all x ∈ U ( S ¯ 5 , S 10 ) satisfying the target conjunction in Eq. (9) by brute force, one prov es that every such x arises from ﬁnitely many minimal witnesses together with con trolled completions. In other w ords, the full viable class at this la yer is generated from a ﬁnite seed class in a mathematically con trolled and exhaustiv e manner. The formal task is therefore to deﬁne these predicates precisely , pro ve the reduction statemen t, and then execute the resulting ﬁnite classiﬁcation. The next sections explain how these deﬁnitions are enco ded in PhysLib and how the pro of is organized. 9 3 F ormal V o cabulary: a Ph ysLib API for Charge Sp ectra Section 2 reform ulated the physics question as a classiﬁcation problem for the viabilit y-and-completeness condition summarized in Eq. (9). W e now introduce the formal vocabulary in whic h that condition is stated inside PhysLib. This section is delib erately architectural: the goal is to build a reusable API, not y et to jump straigh t to the main theorem. The immediate case study is the S U (5) bounded c harge-sp ectrum problem, but the in terface is inten tionally more general and can serve as a guide for future formalizations of other b ounded mo del-building questions. F rom the physics p oint of view, the goal is simple: we w an t a formal language that talks ab out exactly the same ob jects and questions that app ear in ordinary model building. A c harge spectrum should b e an explicit ob ject. Questions such as whether a term is allow ed, whether a sp ectrum is complete, or whether it b elongs to a b ounded class should b ecome reusable deﬁnitions. In that sense, the formalization do es not replace the w ay ph ysicists think; it rewrites that familiar reasoning in a form precise enough to supp ort pro ofs. Throughout this section it is helpful to keep in mind one tin y toy sp ectrum, as ab o ve. Let the c harge t yp e b e Z = Z , and consider a sp ectrum with the following data: q H d = − 3 , q H u = − 2 , Q ¯ 5 = { 0 } , Q 10 = {− 1 } . In w ords, this toy sp ectrum contains a down-t yp e Higgs sector of c harge − 3 , an up-type Higgs sector of charge − 2 , one 5 -matter charge 0 , and one 10 -matter charge − 1 . W e denote this sp ectrum b y x toy . In the Lean-oriented notation used b elo w, the same ob ject is written as x toy := ⟨ some ( − 3) , some ( − 2) , { 0 } , {− 1 }⟩ . Here some q means that the corresp onding Higgs c harge is present and equal to q , while none w ould mean that the corresp onding Higgs sector is absen t. The sets { 0 } and {− 1 } are singleton ﬁnite sets con taining exactly the indicated charges. W e will o ccasionally use this notation b ecause it mirrors the co de directly . 3.1 Charge sp ectra as the basic ob ject The basic physical ob ject in our story is a ﬁnite pac k age of Higgs and matter charges. This is exactly what a ph ysicist writes down when sp ecifying a candidate charge assignmen t. The API is therefore centered on a single basic ob ject, the charge sp ectrum. In the present case it records the optional Higgs charges and the ﬁnite sets of distinct matter c harges in the 5 and 10 sectors. In the implemen tation used for this pap er, this deﬁnition lives cen trally in the c harge-sp ectrum part of Ph ysLib, so that later formalizations can imp ort the same con ven tions rather than restating them lo cally . T wo mo delling c hoices are imp ortan t. • The Higgs c harges are stored as optional v alues, b ecause a sector may b e absen t. • The matter charges are stored as Finset s. A Finset is a ﬁnite set in Lean: it records which distinct charges o ccur, but not multiplicities. This matc hes the level of structure needed for the selection-rule questions treated here. W e also parameterize the ob ject by a general charge t yp e Z . This is imp ortan t conceptually: the same formal in terface can b e used for one U (1) , several U (1) s, or suitable discrete symmetry data, pro vided the required algebraic op erations are av ailable. 10 W e now display the core Lean structure. Its type is ChargeSpectrum Z , and its ﬁelds enco de exactly the data just describ ed in physics notation: optional Higgs c harges and ﬁnite sets of distinct matter c harges. W e display the deﬁnition explicitly b ecause later predicates and theorems refer bac k to these ﬁelds, and in Lean one can alwa ys chase such deﬁnitions back from a later goal to the underlying structure. Snipp et 1 s t r u c t u r e ChargeSpectrum ( Z : T y p e := Z ) w h e r e / - - T h e c h a r g e o f t h e ` H d ` p a r t i c l e . - / q H d : O p t i o n Z / - - T h e n e g a t i v e o f t h e c h a r g e o f t h e ` H u ` p a r t i c l e . T h a t i s t o s a y , t h e c h a r g e o f t h e ` H u ` w h e n c o n s i d e r e d i n t h e 5 - b a r r e p r e s e n t a t i o n . - / q H u : O p t i o n Z / - - T h e f i n i t e s e t o f c h a r g e s o f t h e m a t t e r f i e l d s i n t h e ` Q 5 ` r e p r e s e n t a t i o n . - / Q 5 : F i n s e t Z / - - T h e f i n i t e s e t o f c h a r g e s o f t h e m a t t e r f i e l d s i n t h e ` Q 1 0 ` r e p r e s e n t a t i o n . - / Q 1 0 : F i n s e t Z Structure of the basic PhysLib charge-spectrum ob ject. This is the p oin t where the physics conv en tions are made explicit. In particular, the imple- men tation stores the up-type Higgs c harge in the 5 conv ention, so help er functions can recov er the corresp onding 5 charge by negation when required. That kind of small interface decision matters: once the conv ention is ﬁxed centrally , the later deﬁnitions and pro ofs do not ha ve to re-enco de it. The toy sp ectrum x toy ab o v e is an example of exactly this ob ject type. It is nothing more m ysterious than a ﬁnite c harge assignment written as structured data. This is a go od example of a general theme in the pap er: the co de-lev el ob ject is simply the familiar physics ob ject with its con ven tions made explicit. 3.2 Structural relations and instances After ﬁxing the basic ob ject, the next step is to endow it with the elementary relations physicists already use informally . In mo del building, w e often sa y that one sp ectrum is obtained from another b y remo ving some sectors. The formalization should supp ort exactly this language. T wo elementary structural notions are needed immediately . First, there is an empty c harge sp ectrum, in which b oth Higgs sectors are absen t and b oth matter sectors are empt y . Second, there is a subset relation, expressing that one spectrum is obtained from another by deleting Higgs sectors or matter charges. These tw o notions provide the formal language for later statemen ts about minimalit y and completion. Snipp et 2 i n s t a n c e emptyInst : E m p t y C o l l e c t i o n ( C h a r g e S p e c t r u m Z ) w h e r e e m p t y C o l l e c t i o n := ⟨ n o n e , n o n e , { } , { } ⟩ i n s t a n c e hasSubset H a s S u b s e t ( C h a r g e S p e c t r u m Z ) w h e r e S u b s e t x y := x . q H d . t o F i n s e t ⊆ y . q H d . t o F i n s e t ∧ x . q H u . t o F i n s e t ⊆ y . q H u . t o F i n s e t ∧ x . Q 5 ⊆ y . Q 5 ∧ x . Q 1 0 ⊆ y . Q 1 0 Empt y sp ectrum and subset relation for charge sp ectra. 11 F or example, let y toy b e the sp ectrum obtained from x toy b y removing the down-t yp e Higgs sector while leaving the other data unchanged. In ordinary mathematical notation, this means q H d absen t , q H u = − 2 , Q ¯ 5 = { 0 } , Q 10 = {− 1 } . In the Lean-oriented notation this is written as y toy := ⟨ none , some ( − 2) , { 0 } , {− 1 }⟩ . Th us y toy ⊆ x toy : it is obtained from x toy b y deleting one sector. These instances do tw o things at once. They giv e the ob ject the notation one exp ects mathemat- ically — in particular an empty sp ectrum and a subset relation — and they connect the developmen t to standard Lean and Mathlib pro of patterns for set-like ob jects. This is already one place where the wider library starts to matter: once these structural instances are declared, later argumen ts can reuse generic notation, rewriting lemmas, and monotonicity patterns instead of reproving elemen- tary facts for this one case. Muc h of the leverage of an API-based formalization b egins precisely here. 3.3 In terface deﬁnitions: the v erbs of the API Once the basic ob ject has b een ﬁxed, the next step is to formalize the questions ph ysicists actually ask ab out it. This is really the natural wa y we think in model building: do es a giv en c harge assignmen t allow a desired coupling, do es it forbid dangerous op erators, is it complete, and can it b e extended? The only diﬀerence is that these questions are no w written as reusable deﬁnitions in co de. W e will rep eatedly use tw o kinds of interface deﬁnitions: • data-v alued deﬁnitions , which return new ob jects such as b ounded classes of c harge sp ectra, p o w ersets, m ultisets, or completion candidates; • prop ert y predicates , whic h return prop ositions and are used in theorems. In Lean, a pr e dic ate is simply a deﬁnition with output t yp e Prop . F or example, “this c harge sp ectrum is complete” or “this sp ectrum allows the top Y uk aw a” are predicates in exactly that sense. Since the b ounded classiﬁcation problem only inv olv es ﬁnitely man y operator t yp es, we pac k age them in to a ﬁnite formal vocabulary . At this p oin t there are tw o lev els of language in pla y: the ph ysical op erator names ( µ , W 1 , and so on) and the Lean datatype that lab els them. The role of PotentialTerm is simply to pac k age those ﬁnitely many relev ant op erator lab els into one uniform formal datatype so that the predicates b elo w can talk ab out them systematically . Snipp et 3 i n d u c t i v e PotentialTerm | µ | β | Λ | W 1 | W 2 | W 3 | W 4 | K 1 | K 2 | t o p Y u k a w a | b o t t o m Y u k a w a d e r i v i n g D e c i d a b l e E q , F i n t y p e Finite formal v o cabulary of op erator terms used in the b ounded problem. Once that op erator v o cabulary is ﬁxed, the ﬁrst basic predicate asks whether a giv en named term is neutral with resp ect to the charge data enco ded by the sp ectrum. 12 Snipp et 4 d e f AllowsTerm ( x : C h a r g e S p e c t r u m Z ) ( T : P o t e n t i a l T e r m ) : P r o p := 0 ∈ o f P o t e n t i a l T e r m x T Neutralit y predicate for a term relativ e to a charge sp ectrum. The top Y uk a wa coupling is then just one distinguished element of this ﬁnite v o cabulary . F or the toy sp ectrum x toy , AllowsTerm xtoy topYukawa asks whether the c harges of a p ossible top-Y uk a wa coupling sum to zero, so that the coupling is allo wed. The next predicate bundles the ﬁrst-la yer dangerous-op erator exclusions in to a single condition. These op erators are group ed b ecause, in the standard S U (5) interpretation, they capture the ﬁrst phenomenologically dangerous channels one w ants to exclude already at the charge-spectrum stage, including R -parity-violating terms and proton-deca y-related couplings. Snipp et 5 d e f IsPhenoConstrained ( x : C h a r g e S p e c t r u m Z ) : P r o p := x . A l l o w s T e r m µ ∨ x . A l l o w s T e r m β ∨ x . A l l o w s T e r m Λ ∨ x . A l l o w s T e r m W 2 ∨ x . A l l o w s T e r m W 4 ∨ x . A l l o w s T e r m K 1 ∨ x . A l l o w s T e r m K 2 ∨ x . A l l o w s T e r m W 1 Bundled ﬁrst-la yer dangerous-op erator exclusion predicate. This is a go o d example of why it is useful to deﬁne these predicates explicitly in the API. They are not only chec k ed in a ﬁnal computation; later lemmas and reduction statements also refer to the dangerous-op erator chec k as a single reusable condition, which one can, for example pro of results ab out. A third basic question is whether the c harge sp ectrum is complete at the c harge-sp ectrum level, meaning that b oth Higgs sectors and b oth matter sectors are actually present: Snipp et 6 d e f IsComplete ( x : C h a r g e S p e c t r u m Z ) : P r o p := x . q H d . i s S o m e ∧ x . q H u . i s S o m e ∧ x . Q 5  = ∅ ∧ x . Q 1 0  = ∅ Charge-sp ectrum completeness predicate. F or the toy sp ectrum x toy , this predicate holds: b oth Higgs sectors are presen t and b oth matter sectors are nonempt y . By con trast, y toy is not complete, b ecause the do wn-type Higgs sector is absen t. This is exactly the kind of simple structural statement that later b ecomes part of theorems ab out minimalit y and completion. 3.4 F ormalizing the b ounded mo del space The b ounded charge sets are not themselves a basic predicate of the API. Rather, once such b ounding data are ﬁxed, Ph ysLib can deﬁne the b ounded class of c harge sp ectra built from them and then state further deﬁnitions, predicates and lemmas relativ e to that class. Physically , this is the mo del space obtained once a construction tells us that only ﬁnitely many 5 -c harges and ﬁnitely many 10 -c harges are admissible. This is what ofFinset do es: 13 Snipp et 7 d e f ofFinset ( S 5 S 1 0 : F i n s e t Z ) : F i n s e t ( C h a r g e S p e c t r u m Z ) := l e t S q H d := { n o n e } ∪ S 5 . m a p ⟨ O p t i o n . s o m e , O p t i o n . s o m e _ i n j e c t i v e Z ⟩ l e t S q H u := { n o n e } ∪ S 5 . m a p ⟨ O p t i o n . s o m e , O p t i o n . s o m e _ i n j e c t i v e Z ⟩ l e t S Q 5 := S 5 . p o w e r s e t l e t S Q 1 0 := S 1 0 . p o w e r s e t ( S q H d . p r o d u c t ( S q H u . p r o d u c t ( S Q 5 . p r o d u c t S Q 1 0 ) ) ) . m a p t o P r o d . s y m m . t o E m b e d d i n g Bounded class construction from ﬁnite allow ed 5 - and 10 -c harge menus. In practice, ofFinset is mainly used to state assumptions and deﬁnitions for the b ounded problem, not as something one naively enumerates in ev ery large case. The deﬁnition should b e read comp onen t by comp onen t. • SqHd is the ﬁnite set of allow ed c hoices for the do wn-type Higgs sector: either it is absent ( none ) or its charge is one of the allow ed 5 -charges. • SqHu is the analogous set of allow ed choices for the up-t yp e Higgs sector, again stored in the 5 conv en tion. • SQ5 is the p o werset of S ¯ 5 , so it consists of all ﬁnite subsets of allo wed 5 -matter charges. • SQ10 is the p o werset of S 10 , so it consists of all ﬁnite subsets of allo wed 10 -matter charges. The Cartesian pro duct of these four ﬁnite choice spaces therefore en umerates every c harge sp ec- trum whose Higgs and matter c harges are dra wn from the c hosen b ounded sets. In other words, ofFinset S ¯ 5 S 10 is the exact formal analogue of the b ounded class describ ed in Section 2. The toy spectrum also makes this concrete. If S ¯ 5 = {− 3 , − 2 , 0 } , S 10 = { 0 , − 1 } , then x toy is a member of ofFinset S ¯ 5 S 10 , since all of its Higgs and matter charges are dra wn from those b ounded sets. The deﬁnition ofFinset is therefore not an arbitrary programming help er: it is the formal ob ject that turns the physically giv en charge men u in to the exact b ounded class ov er whic h the later theorem is stated. T wo further notions matter for the later reduction theorem. • A Finset , as seen ab o ve, is used for honest ﬁnite sets, where duplicates are irrelev an t by design. • A Multiset is a ﬁnite collection with multiplicities. Multisets are useful when constructing candidate classes from several seeds or completion pro cedures, b ecause the same sp ectrum can arise more than once b efore a ﬁnal deduplication step. The next tw o deﬁnitions implemen t the witness-and-completion strategy from Section 2. The ﬁrst constructs minimal top-Y uk a wa seed sp ectra inside the b ounded class; the second enlarges such seeds to ward complete sp ectra. They are written as m ultiset-v alued constructions because duplicates can arise b efore ﬁnal deduplication. 14 Snipp et 8 d e f minimallyAllowsTermsOfFinset ( S 5 S 1 0 : F i n s e t Z ) : ( T : P o t e n t i a l T e r m ) → M u l t i s e t ( C h a r g e S p e c t r u m Z ) | t o p Y u k a w a => l e t S q H u := S 5 . v a l l e t Q 1 0 := t o M u l t i s e t s T w o S 1 0 l e t p r o d := S q H u × s Q 1 0 l e t F i l t := p r o d . f i l t e r ( f u n x => - x . 1 + x . 2 . s u m = 0 ) ( F i l t . m a p ( f u n x => ⟨ n o n e , x . 1 , ∅ , x . 2 . t o F i n s e t ⟩ ) ) - - r e m a i n i n g c a s e s o m i t t e d f o r r e a d a b i l i t y d e f completionsTopYukawa ( S 5 : F i n s e t Z ) ( x : C h a r g e S p e c t r u m Z ) : M u l t i s e t ( C h a r g e S p e c t r u m Z ) := ( S 5 . v a l × s S 5 . v a l ) . m a p f u n ( q H d , q 5 ) => ⟨ q H d , x . q H u , { q 5 } , x . Q 1 0 ⟩ Minimal top-Y uk aw a witnesses and their ﬁrst completion step. The ﬁrst of these deﬁnitions is a function from a p oten tial term to the m ultiset of minimal witness spectra. The clause topYukawa => is Lean pattern matc hing for the top-Y uk aw a case, the notation × s denotes the relev ant Cartesian pro duct of ﬁnite collections, and the ﬁnal map pac k ages the resulting c harge data into ChargeSpectrum ob jects. These deﬁnitions again hav e a direct physics reading: the ﬁrst pro duces the minimal seed sp ectra that already realize the top Y uk a wa structure inside the b ounded charge menu, while the second enlarges suc h a seed b y adding the further Higgs and matter data needed to mov e to w ard a complete sp ectrum. In the last line of completionsTopYukawa , x is the seed sp ectrum b eing completed, qHd and q5 are the newly c hosen down-Higgs and ¯ 5 -matter c harges, and x.qHu and x.Q10 are inherited unchanged from the seed. So these are not arbitrary generators: they are formal versions of the witness-and-completion strategy introduced in Section 2. 3.5 Co de organization and reusability in Ph ysLib The developmen t is meant to b e read b oth as mathematics and as reusable co de. The c harge- sp ectrum ob ject, its structural instances, and the ﬁrst-lay er predicates form a compact PhysLib API surface that later formalizations can imp ort without re-declaring conv en tions. This dev elopment liv es inside PhysLib not merely as a case-sp eciﬁc script but as part of an op en-source, comm unity- main tained library [14, 15, 18]. That matters b ecause later contributors can extend the same basic ob ject with new predicates, help er constructions, and lemmas, rather than rebuilding the formal language from scratch. Seen this wa y , the reusable lay er has three parts: the core ob ject, the predicates on that ob ject, and the supp orting lemma base that records how those predicates b ehav e under minimality , com- pletion, enlargement, and b ounded restriction. This point matters for the next section: the main theorem is not deriv ed from raw deﬁnitions alone, but from a stream of auxiliary lemmas that ﬁt the vocabulary together and make later reduction argumen ts p ossible and easier. 4 Certiﬁed Reduction: F rom Minimal T op-Y uk a wa Witnesses to Complete Charge Sp ectra Section 3 in tro duced the formal vocabulary . W e no w use it to state the main certiﬁed reduction result. Throughout this section, it is imp ortan t to keep the scop e precise: “com plete” and “viable” refer to the char ge-sp e ctrum layer in tro duced in Section 2. The theorem therefore classiﬁes complete 15 viable c harge sp ectra in a b ounded mo del class; it do es not yet include later ingredients such as ﬂux data, anomaly cancellation, or the absence of exotics. By c ertiﬁe d we mean the followi ng. The ﬁnal candidate class is not merely pro duced by a search routine. Rather, membership in that class is prov ed inside the interactiv e theorem pro ver to b e equiv alent to the target physical predicate pack age within the b ounded mo del class. This changes the status of the computation: the output is not just a list suggested b y a script, but a formally v eriﬁed classiﬁcation of the complete viable charge sp ectra under the stated assumptions. 4.1 Minimal top-Y uk a wa witnesses W e b egin with the ﬁrst reduction step. A minimal top-Y ukawa witness is a c harge sp ectrum that allo ws the top Y uk aw a term and has no prop er sub-spectrum with the same prop ert y . Such witnesses isolate the smallest lo cal charge conﬁgurations that can supp ort the desired coupling. In the present setting, the relev ant coupling is 10 10 5 H u . Because the implemen tation stores H u in the 5 con ven tion, the neutralit y condition takes the form − q H u + q (1) 10 + q (2) 10 = 0 . (12) Minimalit y is with resp ect to the stored char ge data . F ormally , a c harge sp ectrum x is a minimal top-Y uk a wa witness if Allo wsT erm x topY uk a wa holds, but for every proper sub-sp ectrum x ′ ⊊ x , the predicate Allo wsT erm x ′ topY uk a wa fails. In other words, one cannot remov e any Higgs or matter-c harge entry from x and still retain the top Y uk a wa. A small subtlety is worth stating explicitly . Since the matter sectors are stored as Finset s of distinct charges, minimalit y is a statement ab out distinct charge v alues rather than ﬁeld multi- plicities. Th us a diagonal top Y uk a wa using the same 10 -charge twice is represented by a witness con taining that charge only once in the 10 -sector. By contrast, an oﬀ-diagonal coupling uses tw o distinct 10 -charges and therefore requires b oth to b e present in the witness. F or example, in the toy setting of Section 3 with Z = Z , the sp ectrum x top := ⟨ none , some ( − 2) , ∅ , {− 1 }⟩ is a minimal top-Y uk aw a witness. The neutralit y condition is simply − ( − 2) + ( − 1) + ( − 1) = 0 , so the top Y uk a wa is allow ed. But if one remo ves the Higgs-up entry or the 10 -c harge, the coupling is no longer av ailable. Conceptually , this is the ﬁrst place where the API viewpoint pays oﬀ. Rather than b eginning from all complete charge sp ectra, we b egin from the smallest ob jects that already certify the lo cal prop ert y of interest. This is enco ded in minimallyAllowsTermsOfFinset ab o v e. 16 4.2 F rom witnesses to complete c harge sp ectra A viable complete charge spectrum must contain more than a top-Y uk aw a witness. It must also b e complete at the charge-spectrum lev el and a v oid the dangerous operators singled out ab o ve. The second reduction step is therefore to start from a minimal witness and study its allow ed completions. This is enco ded in completionsTopYukawa ab o ve. If x is a minimal top-Y uk aw a witness and y is a viable complete c harge sp ectrum with x ⊆ y , then the formal completion routines seek an in termediate sp ectrum z with x ⊆ z ⊆ y , IsComplete z , constructed by adding the missing Higgs and matter sectors in a controlled w ay . Here “con trolled” means that the enlargement is not arbitrary: the added sectors must still preserve the relev ant viabilit y predicates, namely absence of the selected dangerous op erators and absence of their one- step Y uk aw a-induced regeneration. W e restate this familiar mo del-building picture here delib erately , b ecause the next lemmas are b est understo od as its formal counterpart rather than as an unrelated pro of trick. This is exactly the same st yle of reasoning used in ordinary mo del building. One ﬁrst identiﬁes the smallest lo cal seed carrying the desired coupling structure, and then asks how the remaining sec- tors can b e added without sp oiling the phenomenological constrain ts. The p oin t of the formal proof is not to replace this physics in tuition, but to make it precise enough that it b ecomes exhaustiv e. The toy example again makes this concrete. Starting from x top = ⟨ none , some ( − 2) , ∅ , {− 1 }⟩ , one p ossible completion step is to add a do wn-type Higgs of c harge − 3 and a 5 -matter charge 0 , yielding our toy sp ectrum x toy = ⟨ some ( − 3) , some ( − 2) , {− 1 } , {− 1 }⟩ . A t the c harge-sp ectrum lev el this is now complete: b oth Higgs sectors are present and b oth matter sectors are nonempty . Whether suc h an enlargement is al lowe d in the theorem dep ends, of course, on the viabilit y predicates; the p oin t of the example is only to illustrate what a completion mov e lo oks lik e. This is also the sense in which the later theorem expresses closur e : once one starts from a certiﬁed seed, the p ermitted enlargement mo ves remain inside a mathematically controlled candidate class. 4.3 Main theorem: completeness of the certiﬁed viable c harge-sp ectrum class In the concrete F-theory developmen t, the b ounded input is not given directly by arbitrary ﬁnite sets S ¯ 5 and S 10 , but by a co dimension-one conﬁguration I (follo wing the notation used in [10, 22]): here this means the F-theory input record that pac k ages the allow ed 5 - and 10 -charge men us used to build the b ounded class. W e therefore write U ( I ) := ofFinset I . allow edBarFiv eCharges I . allow edT enCharges for the ambien t b ounded mo del class and V ( I ) := viableCharges I for the concrete candidate class constructed in Ph ysLib. In what follows we will restrict to this case, ho wev er muc h of what w e sa y is including in PhysLib in a reusable w ay for generic S ¯ 5 and S 10 . The central concrete theorem can then b e stated as follows. 17 Theorem 1 (Completeness of the certiﬁed viable charge-spectrum class) . L et I b e a c o dimension- one c onﬁgur ation and let x ∈ U ( I ) . Then x ∈ V ( I ) ⇐ ⇒ Allo wsT erm x topY uk aw a ∧ ¬ IsPhenoConstrained x ∧ ¬ Y uk a waGeneratesDangerousA tLev el x 1 ∧ IsComplete x. (13) Equivalently, x ∈ V ( I ) if and only if x is a viable c omplete char ge sp e ctrum in the b ounde d mo del class U ( I ) . In p articular, ther e is no further viable c omplete char ge sp e ctrum in U ( I ) outside the c onstructe d class. This is the statement that c hanges the in terpretation of the computation. The ﬁnal ﬁnite list is not merely an exp erimen tal output. It is a certiﬁed description of the en tire viable class inside the c hosen b ounded mo del class. 4.4 Pro of strategy and why it matters The pro of has four conceptual steps. 1. Sho w that any sp ectrum allo wing the top Y uk aw a contains a minimal top-Y uk aw a witness. 2. Sho w that any viable complete c harge sp ectrum con taining such a witness also contains a con trolled completion of that witness. 3. Pro ve closure lemmas for adding allow ed 5 - and 10 -charges while preserving the viability predicates. 4. Conclude that every viable complete charge sp ectrum in the b ounded mo del class is generated b y the certiﬁed closure pro cedure. The ﬁrst step isolates the lo cal seed, the second upgrades it to a complete charge-spectrum ob ject, and the last tw o show that no viable enlargemen t is missed. F or the toy example, one should picture exactly the sequence x top ⊆ x toy ⊆ y , where x top is a minimal top-Y uk aw a witness, x toy is the concrete completion introduced earlier, and y is any larger viable complete sp ectrum in the b ounded model class. The theorem sa ys that every suc h y is reached b y the certiﬁed completion-and-closure mec hanism. The reason to highligh t this part of the proof is that it is the bridge b et ween physics and computation. Without it, the executable routine would just be one more search heuristic. With it, the routine b ecomes the implementation of a pro v ed classiﬁcation strategy . In that sense, the result resem bles a generative pro cedure only sup erﬁcially: one starts from seeds and enlarges them, but here the generation mechanism is mathematically controlled and exhaustiv e rather than heuristic or statistical. A useful wa y to view the result is as a short lemma str e am . The early lemmas isolate minimal witnesses, the intermediate lemmas control the eﬀect of completions, and the ﬁnal closure lemmas sho w that the whole viable class is generated b y rep eated certiﬁed enlargement steps. The main theorem is the endp oin t of that stream rather than a disconnected one-shot argument. 18 4.5 Lean statemen ts and pro of commen tary A t the level of the formal dev elopment, the completeness result is organized in t wo stages. First, one pro ves an abstract endp oin t theorem for an arbitrary multiset of c harge sp ectra satisfying the required witness, completion, and closure hypotheses. Second, one sp ecializes that abstract theorem to the concrete Ph ysLib construction viableCharges I relev an t for the S U (5) F-theory setting. This separation is conceptually useful: the ﬁrst theorem captures the reusable reduction mechanism, while the second theorem pack ages the concrete classiﬁcation used in the present case study . The abstract endp oint theorem has the follo wing shap e: Snipp et 9 l e m m a minimallyAllowsTercompleteness_of_isPhenoClosedQ5_isPhenoClosedQ10 { S 5 S 1 0 : F i n s e t Z } { c h a r g e s : M u l t i s e t ( C h a r g e S p e c t r u m Z ) } ( c h a r g e s _ t o p Y u k a w a : ∀ x ∈ c h a r g e s , x . A l l o w s T e r m . t o p Y u k a w a ) ( c h a r g e s _ n o t _ i s P h e n o C o n s t r a i n e d : ∀ x ∈ c h a r g e s , ¬ x . I s P h e n o C o n s t r a i n e d ) ( c h a r g e s _ y u k a w a : ∀ x ∈ c h a r g e s , ¬ x . Y u k a w a G e n e r a t e s D a n g e r o u s A t L e v e l 1 ) ( c h a r g e s _ c o m p l e t e : ∀ x ∈ c h a r g e s , x . I s C o m p l e t e ) ( c h a r g e s _ i s P h e n o C l o s e d Q 5 : I s P h e n o C l o s e d Q 5 S 5 c h a r g e s ) ( c h a r g e s _ i s P h e n o C l o s e d Q 1 0 : I s P h e n o C l o s e d Q 1 0 S 1 0 c h a r g e s ) ( c h a r g e s _ e x i s t : C o n t a i n s P h e n o C o m p l e t i o n s O f M i n i m a l l y A l l o w s S 5 S 1 0 c h a r g e s ) { x : C h a r g e S p e c t r u m Z } ( h s u b : x ∈ o f F i n s e t S 5 S 1 0 ) : x ∈ c h a r g e s ↔ A l l o w s T e r m x . t o p Y u k a w a ∧ ¬ I s P h e n o C o n s t r a i n e d x ∧ ¬ Y u k a w a G e n e r a t e s D a n g e r o u s A t L e v e l x 1 ∧ I s C o m p l e t e x := b y . . . Abstract completeness theorem for a candidate class satisfying witness, completion, and closure hypotheses. This statemen t is b est read from top to b ottom. The ﬁrst four hypotheses say that every element of the candidate class already has the desired physical prop erties. The next tw o hypotheses express closure under admissible 5 - and 10 -enlargemen ts. The ﬁnal h yp othesis sa ys that the class contains the required completions of all minimal top-Y uk a wa witnesses. Under exactly these assumptions, mem b ership in the candidate class is equiv alent to the full target predicate inside the b ounded mo del class. The concrete F-theory theorem is then obtained b y instan tiating this abstract result with the m ultiset viableCharges I : Snipp et 10 l e m m a mem_viableCharges_iff { I } { x : C h a r g e S p e c t r u m } ( h s u b : x ∈ o f F i n s e t I . a l l o w e d B a r F i v e C h a r g e s I . a l l o w e d T e n C h a r g e s ) : x ∈ v i a b l e C h a r g e s I ↔ A l l o w s T e r m x t o p Y u k a w a ∧ ¬ I s P h e n o C o n s t r a i n e d x ∧ ¬ Y u k a w a G e n e r a t e s D a n g e r o u s A t L e v e l x 1 ∧ I s C o m p l e t e x := c o m p l e t e n e s s _ o f _ i s P h e n o C l o s e d Q 5 _ i s P h e n o C l o s e d Q 1 0 ( a l l o w s T e r m _ t o p Y u k a w a _ o f _ m e m _ v i a b l e C h a r g e s I ) ( n o t _ i s P h e n o C o n s t r a i n e d _ o f _ m e m _ v i a b l e C h a r g e s I ) ( n o t _ y u k a w a G e n e r a t e s D a n g e r o u s A t L e v e l _ o n e _ o f _ m e m _ v i a b l e C h a r g e s I ) ( i s C o m p l e t e _ o f _ m e m _ v i a b l e C h a r g e s I ) ( i s P h e n o C l o s e d Q 5 _ v i a b l e C h a r g e s I ) ( i s P h e n o C l o s e d Q 1 0 _ v i a b l e C h a r g e s I ) ( c o n t a i n s P h e n o C o m p l e t i o n s O f M i n i m a l l y A l l o w s _ o f _ s u b s e t ( c o n t a i n s P h e n o C o m p l e t i o n s O f M i n i m a l l y A l l o w s _ v i a b l e C o m p l e t i o n s I ) ( v i a b l e C o m p l e t i o n s _ s u b s e t _ v i a b l e C h a r g e s I ) ) h s u b Concrete F-theory sp ecialization identifying membership in viableCharges I with the target predicate pack- 19 age. This second theorem is the formal version of the completeness statement given in Section 4. It sho ws that the concrete class generated in the S U (5) F-theory dev elopment is exactly the class of viable complete charge sp ectra in the b ounded model class. In precisely that sense, viableCharges I should not b e read as the output of a bare scan: it is accompanied b y a proof that no further viable complete charge spectrum in the b ounded mo del class has b een missed. F rom the ph ysics p oin t of view, the pro of follows the same logic as the mo del-building strategy describ ed ab o v e. Starting from a b ounded c harge sp ectrum satisfying the target predicates, one ex- tracts a minimal top-Y uk aw a witness, upgrades it to a controlled completion, and then reconstructs the full sp ectrum using the closure lemmas. The Lean developmen t therefore do es not merely verify the endp oin t; it mirrors the structure of the physical reasoning itself. After the theorem statements, it is useful to see one short pro of-st yle lemma from the same lemma stream. A basic certiﬁed fact about the concrete viable class is that every elemen t of viableCharges I is complete: Snipp et 11 l e m m a isComplete_of_mem_viableCharges ( I : C o d i m e n s i o n O n e C o n f i g ) : ∀ x ∈ v i a b l e C h a r g e s I , I s C o m p l e t e x := b y r e v e r t I d e c i d e Short proof-style example from the certiﬁed-reduction pip eline. Ph ysically , this lemma says that ev ery sp ectrum in the certiﬁed viable class already con tains b oth Higgs sectors and b oth matter sectors; no incomplete c harge sp ectrum can survive into the ﬁnal list. The tactic revert I mo ves the parameter I back in to the goal so that the statemen t is presented in the right general form, and decide then closes the goal automatically b ecause the completeness fact has b een reduced to a decidable statemen t enco ded in the deﬁnitions. This completes the reduction step. Section 5 turns to the executable classiﬁcation built on top of this theorem and explains how the certiﬁed candidate class is turned in to the ﬁnal ﬁnite list of viable charge spectra. 5 F rom Certiﬁed Reduction to Executable Classiﬁcation Section 4 established the theorem-back ed reduction. The role of the presen t section is to ex- plain ho w that prov ed reduction is turned into a concrete computation of the ﬁnite viable class viableCharges I , to separate the computed lay er from the prov ed one, and to show how this out- put interfaces with a broader phenomenological workﬂo w. There are three levels in pla y throughout this discussion. First, there are the generic c harge- sp ectrum routines in the underlying library . Second, there is their concrete sp ecialization to a co dimension-one conﬁguration I in the S U (5) F-theory setting. Third, there are later do wnstream phenomenological reﬁnemen ts built on top of the certiﬁed c harge-sp ectrum output. Keeping these three levels distinct helps clarify b oth the mathematics and the practical use of the formalization. 20 5.1 F rom the certiﬁed reduction to a concrete closure computation A t the generic c harge-sp ectrum level, the computed ﬁnite class viableCharges I is built in three stages. First, one constructs the completed minimal witnesses: these are the smallest charge sp ectra that already con tain the top Y uk aw a structure and ha ve b een completed to the charge-spectrum lev el while still satisfying the phenomenological exclusions. Second, one forms all admissible one-step enlargemen ts of these sp ectra inside the b ounded model class. Third, one iterates this enlargement step until no new viable sp ectra app ear. Since the am bient b ounded model class is ﬁnite, rep eated admissible one-step enlargemen ts mus t stabilize after ﬁnitely man y rounds. The completeness the- orem of Section 4 identiﬁes this stabilized ﬁxed p oin t with the full viable class. The ﬁrst stage is implemented b y the multiset Snipp et 12 d e f completeMinSubset ( S 5 S 1 0 : F i n s e t Z ) : M u l t i s e t ( C h a r g e S p e c t r u m Z ) := ( ( m i n i m a l l y A l l o w s T e r m s O f F i n s e t S 5 S 1 0 t o p Y u k a w a ) . b i n d < | c o m p l e t i o n s T o p Y u k a w a S 5 ) . d e d u p . f i l t e r f u n x => ¬ I s P h e n o C o n s t r a i n e d x ∧ ¬ Y u k a w a G e n e r a t e s D a n g e r o u s A t L e v e l x 1 Completed minimal witnesses used as the seed class for the executable closure routine. This should b e read as follo ws. One starts from the minimal top-Y uk aw a witnesses inside the b ounded c harge men u, applies the completion routine to eac h of them, remov es duplicates, and then ﬁlters out any sp ectrum that is already excluded b y the phenomenological predicates. The result is therefore the ﬁnite seed class from which the later closure pro cedure b egins. A one-step enlargement should b e understo o d mathematically as the passage from a given sp ec- trum to an immediate admissible sup er-spectrum inside the b ounded mo del class: one adjoins one new allo wed charge datum, or missing sector datum, in suc h a wa y that the resulting sp ectrum still lies in the b ounded mo del class and still satisﬁes the viabilit y predicates. The help er rou- tine minimalSuperSet returns exactly these admissible immediate sup er-spectra for a giv en input sp ectrum. The second and third stages are implemented recursiv ely: Snipp et 13 u n s a f e d e f viableChargesMultiset ( S 5 S 1 0 : F i n s e t Z ) : M u l t i s e t ( C h a r g e S p e c t r u m Z ) := ( a u x ( c o m p l e t e M i n S u b s e t S 5 S 1 0 ) ( c o m p l e t e M i n S u b s e t S 5 S 1 0 ) ) . d e d u p w h e r e / - - A u x i l i a r y r e c u r s i v e f u n c t i o n t o d e f i n e ` v i a b l e C h a r g e s M u l t i s e t ` . - / a u x : M u l t i s e t ( C h a r g e S p e c t r u m Z ) → M u l t i s e t ( C h a r g e S p e c t r u m Z ) → M u l t i s e t ( C h a r g e S p e c t r u m Z ) := f u n a l l a d d => / - N o t e t h a t a u x t e r m i n a t e s s i n c e t h a t e v e r y i t e r a t i o n t h e s i z e o f ` a l l ` i n c r e a s e s , u n l e s s i t t e r m i n a t e s t h a t r o u n d , b u t ` a l l ` i s b o u n d e d i n s i z e b y t h e n u m b e r o f a l l o w e d c h a r g e s g i v e n ` S 5 ` a n d ` S 1 0 ` . - / i f a d d = ∅ t h e n a l l e l s e l e t s := a d d . b i n d f u n x => ( m i n i m a l S u p e r S e t S 5 S 1 0 x ) . v a l l e t s 2 := s . f i l t e r f u n y => y / ∈ a l l ∧ ¬ I s P h e n o C o n s t r a i n e d y ∧ ¬ Y u k a w a G e n e r a t e s D a n g e r o u s A t L e v e l y 1 a u x ( a l l + s 2 ) s 2 Recursiv e executable closure routine for the certiﬁed viable class. Mathematically , the recursion main tains t wo m ultisets: • all , containing ev erything found so far; 21 • add , containing only the newly added sp ectra from the previous round. F rom each element of add , the routine constructs its admissible one-step enlargements via minimalSuperSet . It then discards an ything already seen or already ruled out b y the phenomenological predicates, pro- ducing the next incremen t s2 . If no new sp ectra app ear, the recursion stops; otherwise the new sp ectra are added and the pro cess rep eats. F or example, if add con tains a single completed seed z , then the next round examines all admissible immediate sup er-sp ectra of z , discards those already seen or already excluded, and app ends only the gen uinely new viable sp ectra. This is the executable analogue of the closure argument prov ed in Section 4. The scien tiﬁc p oin t is therefore not merely that we hav e written a recursive routine, but that the routine is kno wn to stabilize on a ﬁnite b ounded mo del class and, more imp ortan tly , that its ﬁxed p oin t has a pro ved ph ysical meaning. The keyw ord unsafe concerns the executable recursive implemen tation and termination pack aging in Lean; it do es not weak en the mathematical certiﬁcation, whic h comes from the separate completeness theorem. In the concrete S U (5) F-theory developmen t one ﬁrst computes with the generic recursiv e routine viableChargesMultiset S5 S10 , but the ob ject that later app ears in theorem statemen ts is the pac k aged sp ecialization viableCharges I . This distinction matters: the recursiv e multiset routine is con venien t for ev aluation, whereas viableCharges I is the theorem-facing ob ject whose mem b ership c haracterization is used in pro ofs. The result viableCharges I explicitly contains the output of viableChargesMultiset S5 S10 for the suitable S 5 and S 10 . 5.2 What is prov ed and what is computed This distinction is central to the pap er and deserves explicit emphasis. • Pro ved. The semantics of the charge-spectrum ob ject, the viabilit y predicates, the reduc- tion from arbitrary viable complete sp ectra to minimal witnesses plus controlled completions, the closure lemmas for admissible enlargements, and the completeness theorem identifying mem b ership in viableCharges I with the target predicate pac k age inside the b ounded mo del class. • Computed. F or a chosen b ounded input, ev aluation pro duces the explicit ﬁnite multiset of viable charge spectra from which the concrete ob ject viableCharges I is pack aged. The scien tiﬁc claim is therefore not merely that a Lean expression ev aluates to some concrete m ultiset M I , but that ∀ x ∈ U ( I ) , x ∈ M I ↔ P I ( x ) , where P I ( x ) denotes the conjunction of the target charge-spectrum predicates. In other words, the ev aluated ﬁnite m ultiset has a prov ed semantic meaning: it is exactly the viable class at the c harge-sp ectrum lay er for the c hosen b ounded input. 5.3 F rom c harge sp ectra to fuller phenomenological data The c harge-sp ectrum classiﬁcation is only one mo dule in a broader phenomenological pipeline. T o reach fully ﬂedged models one m ust t ypically add ﬂux and c hirality data, imp ose anomaly cancellation, and require an exotic-free MSSM sp ectrum or related low-energy conditions. In the language of the earlier F-theory analyses, this means combining the charge-spectrum ob ject with data such as • chiralities M a , M i , 22 • hypercharge-ﬂux restrictions N a , N i , • anomaly cancellation constrain ts, • and the detailed sp ectrum conditions deﬁning the desired low-energy model. The p oin t of the presen t API-based organization is precisely that these later ingredien ts need not be mixed in to the ﬁrst formal ob ject from the outset. Instead, the certiﬁed charge-spectrum classiﬁcation provides an upstream reduction on whic h later modules can build. F rom the practical p oin t of view, this means that later phenomenological la yers can start from a theorem-back ed reduced class rather than from the full am bient b ounded mo del class. F rom the conceptual p oin t of view, it means that one can separate the formal burden into manageable la yers while preserving a clear scientiﬁc interpretati on at each stage. 5.4 Viable and non-viable regions of the b ounded mo del class A t the charge-spectrum lay er, the elementary ob jects b eing classiﬁed are simply the b ounded spectra x ∈ U ( I ) or, in the generic library notation, the b ounded sp ectra in ofFinset S ¯ 5 S 10 . The completeness theorem partitions this b ounded mo del class into t wo theorem-bac ked regions: • those sp ectra that lie in the certiﬁed viable class, • and those sp ectra that do not. It is in this precise sense that one can sp eak of viable and non-viable b ounded c harge assignments. This matters scientiﬁcally b ecause emptiness statemen ts now acquire a clean interpretation. If no b ounded spectrum with a giv en pattern of c harges surviv es in to the certiﬁed viable class, that is a mathematically justiﬁed absence result for the c harge-sp ectrum lay er. Conv ersely , the surviving sp ectra are not merely examples found by searc h; they are the complete b ounded list of sp ectra satisfying the target predicate. This is also the natural p oin t at which n umerical summaries can b e rep orted. In a concrete b ounded instance, one may rep ort a decomp osition of the ambien t b ounded mo del class in to sp ectra that fail already at the top-Y uk a wa stage, sp ectra excluded by the phenomenological predicates, and sp ectra surviving to the certiﬁed viable class. Such coun ts are secondary to the theorem, but once the theorem is in place they b ecome scientiﬁcally in terpretable rather than merely descriptiv e. 5.5 T ypical workﬂo w snipp et and practical use This workﬂo w snipp et illustrates the practical meaning of the previous sections: the formal theorems are not merely descriptiv e, but directly supp ort executable routines that return the certiﬁed viable class for a c hosen b ounded input. It is useful again to separate the generic library-level workﬂo w from the concrete F-theory sp ecialization. A t the generic charge-spectrum level one sp eciﬁes b ounded c harge men us and then ev aluates the certiﬁed viable class generated by the witness–completion–closure pro cedure: 23 Snipp et 14 - - c h o o s e b o u n d e d c h a r g e s e t s d e f S 5 : F i n s e t Z := . . . d e f S 1 0 : F i n s e t Z := . . . - - i n s p e c t t h e c o m p l e t e d m i n i m a l w i t n e s s e s # e v a l c o m p l e t e M i n S u b s e t S 5 S 1 0 - - c o m p u t e t h e c e r t i f i e d v i a b l e s p e c t r a i n t h e b o u n d e d u n i v e r s e # e v a l v i a b l e C h a r g e s M u l t i s e t S 5 S 1 0 Generic library-lev el workﬂo w from bounded charge menus to the certiﬁed viable class. In the concrete S U (5) F-theory setting, one instead starts from a co dimension-one conﬁguration I , whic h pac k ages the allow ed 5 - and 10 -charges: Snipp et 15 - - c h o o s e a c o d i m e n s i o n - o n e c o n f i g u r a t i o n d e f I : C o d i m e n s i o n O n e C o n f i g := . . . - - e x a c t r a c t t h e c e r t i f i e d v i a b l e c h a r g e s p e c t r a f o r t h i s c o n f i g u r a t i o n # e v a l v i a b l e C h a r g e s I Concrete conﬁguration-lev el workﬂo w for extracting viableCharges I . F or a sp eciﬁc v alue of I , corresp onding to .same : CodimensionOneConfig in Lean w e can give some explicit num b ers. In this case S ¯ 5 , S 10 = {− 3 , − 2 , − 1 , 0 , 1 , 2 , 3 } , the cardinality of the am bient bounded mo del class ofFinset _ _ is 1,048,576, and the cardinality of the certiﬁed viable class viableCharges I is 102. This is where the passage from theorem to practice b ecomes explicit. The formal deﬁnitions and theorems developed in the previous sections are not merely documentation of a search strategy; they directly supp ort executable routines that return the ﬁnite viable class with a prov ed interpretation. Once this upstream classiﬁcation is in hand, a higher-level API can reﬁne it by adding ﬂux, c hirality , or anomaly data: Snipp et 16 - - s c h e m a t i c d o w n s t r e a m r e f i n e m e n t - - # e v a l v i a b l e Q u a n t a I . . . Do wnstream reﬁnement sketc h built on top of the certiﬁed charge-spectrum output. In this w ay the theorem-back ed c harge-sp ectrum la yer b ecomes a practical en try p oin t for later phenomenological analysis rather than a disconnected formal exercise. The ov erall division of lab our is therefore clear. The interactiv e theorem prov er certiﬁes the reduction from the full b ounded mo del class to the viable class. The executable routine enumerates that class in ﬁnite form. Later mo del-building lay ers can then use this certiﬁed output as their starting data. In this wa y , the formal reduction theorem b ecomes op erational: it turns a b ounded but com binatorially diﬃcult physics question in to a ﬁnite executable classiﬁcation with a pro ved 24 in terpretation, and thereb y provides certiﬁed input for later phenomenological analysis. This is the point at whic h the methodological diﬀerence b ecomes visible: comparable b ounded c harge classiﬁcations ha ve previously been obtained with dedicated scan co de, but here the classiﬁcation is coupled to Lean pro ofs that certify the output under the stated assumptions. 6 Conclusions and Outlo ok In this paper we hav e used a concrete S U (5) mo del-building problem with additional Ab elian symmetries to illustrate a broader p oin t: interactiv e theorem pro vers can b e used not only to v erify the endp oin t of a computation, but to organize the ph ysics problem itself into a reusable formal language. In the present case, this mean t in tro ducing a precise ob ject language for charge sp ectra, formalizing the relev an t phenomenological predicates, identifying minimal top-Y uk a wa witnesses, and pro ving a certiﬁed reduction from arbitrary viable complete c harge sp ectra in a b ounded model class to a ﬁnite witness–completion–closure construction. Figure 1 shows a diagrammatic ov erview of our results. The scientiﬁc signiﬁcance of this result is not that it solves the full phenomenology problem. Rather, it shows that one can replace brute-force exploration of a com binatorially growing b ounded mo del space b y a theorem-back ed classiﬁcation at the charge-spectrum lay er. The resulting exe- cutable routine is therefore not just a search script, but a ﬁnite computation with a prov ed inter- pretation: the output is exactly the viable complete class under the stated assumptions. In that sense, the main achiev emen t is metho dological but already scientiﬁcally meaningful. It turns a fa- miliar mo del-building workﬂo w into a form in which completeness statemen ts, absence results, and reusable reductions can b e expressed with mathematical precision. A second lesson is that the pro of strategy remains strongly guided by physics in tuition. The dev elopment does not succeed by abandoning the usual mo del-building picture, but by formalizing it: one b egins with the smallest lo cal sectors realizing the desired coupling structure, studies their con trolled completions, and prov es closure under admissible enlargemen ts. This is imp ortan t con- ceptually . It suggests that formalization in theoretical ph ysics need not b egin from an alien language, but can often start from the same structural reasoning physicists already use when constructing and excluding mo dels. The case study should nev ertheless b e viewed as a represen tative proof of principle rather than a ﬁnal phenomenological analysis. The completeness theorem pro ved in this pap er concerns the c harge-sp ectrum lay er only . It do es not yet fold in chiralit y assignments, anomaly cancellation, detailed low-energy conditions, or the full presen tation of ﬂux-related ingredien ts that already exist elsewhere in PhysLib but are not dev elop ed in this man uscript. The p oin t of the present API organization is precisely that suc h ingredients can b e attac hed later as further formal lay ers on top of a certiﬁed upstream reduction. There are several natural next directions. One immediate exp ository direction is to connect the c harge-sp ectrum classiﬁcation more explicitly to the ﬂux-related and anomaly-related comp onen ts already presen t in Ph ysLib, and to invite further comm unity contributions on top of this shared infrastructure. On the physics side, the same arc hitecture can then b e applied to broader b ounded classes, including larger charge men us and more general b eyond-the-Standard-Model settings where the com binatorics b ecome even more severe. On the formal side, the presen t implementation already pro vides a reusable ob ject language and lemma base that later formalizations can extend rather than rebuild. A further p ersp ectiv e concerns AI-assisted research. None of the formal dev elopment itself de- p ends on AI: interactiv e theorem proving is already a viable human workﬂo w. The p oin t is rather 25 that, when AI to ols are used for drafting, prop osing lemmas, or exploring downstream analyses, a formal API inside an in teractive theorem pro ver provides the stable semantics and chec king lay er that such to ols typically lac k. This suggests a division of lab our in whic h h umans or AI agents pro- p ose constructions, conjectures, reductions, or do wnstream analyses, while the prov er enforces that the central deﬁnitions and transformations remain correct. In this wa y , ITP-based APIs may b e- come a natural interface b et ween exploratory search, executable computation, and reliable scientiﬁc reasoning. More broadly , we hop e this work helps illustrate a p ossible route to ward scalable formal metho ds in theoretical ph ysics. The v alue of theorem proving here is not simply that one more result has b een certiﬁed. It is that a b ounded but non trivial mo del-building problem can be reformulated so that the com binatorics are reduced b y pro of, the executable search acquires a precise interpretation, and the resulting structure b ecomes reusable. If this strategy can b e extended to ric her phenomenological settings, then interactiv e theorem prov ers may b ecome not only to ols for chec king arguments, but activ e comp onen ts of how theoretical-ph ysics w orkﬂows are designed. A c kno wledgmen ts AI language to ols were used for drafting and editing parts of the prose in this manuscript. The for- malization, co de developmen t, and interactiv e-theorem-pro ver conten t were pro duced and chec k ed b y the authors. W e thank T yler Josephson, Andreas Sc hac hner for discussions and the Ph ys- Lib communit y for discussions, infrastructure, and the reusable formal environmen t on which this w ork builds. SK has b een partially supp orted b y STF C consolidated grants ST/T000694/1 and ST/X000664/1. References [1] L. Susskind, “ The An thropic landscap e of string theory,” arXiv:hep-th/0302219 . [2] M. R. Douglas, “ The Statistics of string / M theory v acua,” JHEP 05 (2003) 046, arXiv:hep-th/0303194 . [3] B. S. A chary a and M. R. Douglas, “ A Finite landscap e?,” arXiv:hep-th/0606212 . [4] H. Ooguri and C. V afa, “ On the Geometry of the String Landscap e and the Swampland,” Nucl. Phys. B 766 (2007) 21–33, arXiv:hep-th/0605264 . [5] E. Palti, “ The Sw ampland: In tro duction and Review,” F ortsch. Phys. 67 no. 6, (2019) 1900037, arXiv:1903.06239 [hep-th] . [6] T. W. Grimm and J. Monnee, “ Finiteness theorems and counting conjectures for the ﬂux landscap e,” JHEP 08 (2024) 039, arXiv:2311.09295 [hep-th] . [7] G. J. Loges and G. Shiu, “ 134 billion intersecting brane mo dels,” JHEP 12 (2022) 097, arXiv:2206.03506 [hep-th] . [8] N. Gendler, N. MacF adden, L. McAllister, J. Moritz, R. Nally , A. Sc hachner, and M. Stillman, “ Counting Calabi-Y au Threefolds,” arXiv:2310.06820 [hep-th] . [9] A. Chandra, A. Constantin, C. S. F raser-T aliente, T. R. Harv ey , and A. Luk as, “ En umerating Calabi-Y au Manifolds: Placing Bounds on the Number of Diﬀeomorphism Classes in the Kreuzer-Sk arke List,” F ortsch. Phys. 72 no. 5, (2024) 2300264, arXiv:2310.05909 [hep-th] . 26 [10] S. Kripp endorf, S. Schafer-Nameki, and J.-M. W ong, “ F roggatt-Nielsen meets Mordell-W eil: A Phenomenological Survey of Global F-theory GUT s with U(1)s,” JHEP 11 (2015) 008, arXiv:1507.05961 [hep-th] . [11] E. Dudas and E. Palti, “ F roggatt-Nielsen mo dels from E(8) in F-theory GUT s,” JHEP 01 (2010) 127, arXiv:0912.0853 [hep-th] . [12] S. Kripp endorf, D. K. May orga Pena, P .-K. Oehlmann, and F. Ruehle, “ Rational F-Theory GUT s without exotics,” JHEP 07 (2014) 013, arXiv:1401.5084 [hep-th] . [13] L. De Moura, S. Kong, J. A vigad, F. V an Do orn, and J. v on Raumer, “The lean theorem pro ver (system description),” in International Confer enc e on Automate d De duction , pp. 378–388, Springer. 2015. [14] J. T o ob y-Smith, “ HepLean: Digitalising high energy physics,” Comput. Phys. Commun. 308 (2025) 109457, arXiv:2405.08863 [hep-ph] . [15] Ph ysLib Con tributors, “Ph yslib.” https://github.com/leanprover- community/physlib , 2026. GitHub rep ository , accessed March 2026. [16] A. Meiburg, “Lean-quan tuminfo.” https://github.com/Timeroot/Lean- QuantumInfo , 2026. GitHub rep ository , accessed March 2026. [17] J. T o ob y-Smith, “A p ersp ectiv e on interactiv e theorem prov ers in ph ysics,” A dvanc e d Scienc e n/a no. n/a, e17294. https://advanced.onlinelibrary.wiley.com/doi/abs/10.1002/advs.202517294 . [18] A. Meiburg, L. A. Lessa, and R. R. Soldati, “ A F ormalization of the Generalized Quantum Stein’s Lemma in Lean,” arXiv:2510.08672 [quant-ph] . [19] M. R. Douglas, S. Hoback, A. Mei, and R. Nissim, “ F ormalization of QFT,” arXiv:2603.15770 [hep-th] . [20] Y. Ren, J. Li, and Y. Qi, “ MerLean: An Agentic F ramework for Autoformalization in Quan tum Computation,” arXiv:2602.16554 [cs.LO] . [21] T. Josephson, “Automating reasoning in chemical science and engineering,” ChemRxiv 2025 no. 0908, (2025) , https://chemrxiv.org/doi/pdf/10.26434/chemrxiv-2025-q9bb1 . https://chemrxiv.org/doi/abs/10.26434/chemrxiv- 2025- q9bb1 . [22] C. Lawrie, S. Sc hafer-Nameki, and J.-M. W ong, “ F-theory and All Things Rational: Surv eying U(1) Symmetries with Rational Sections,” JHEP 09 (2015) 144, arXiv:1504.05593 [hep-th] . 27

Physics as Code: From Scans to Theorems with ITP APIs in $SU(5)$ Model Building

Original Paper

Comments & Academic Discussion

Leave a Comment

Original Paper

Related Papers

Comments & Academic Discussion

Leave a Comment