CAPRI is a contract-aware proof repair workflow for Isabelle that uses large language models (LLMs) to propose proof repairs while an independent checker enforces a machine-readable edit contract. The evaluation covered five workflows on twelve failed proofs from four developments, with three replicates per task and condition, totaling 180 runs and 138 valid repairs. Of 144 terminal candidates accepted by Isabelle, six had modified protected text; all arose in iterative workflows that could edit a complete theory. A proof-body-only interface produced 29/36 valid repairs and no contract violations, compared with 31/36 for the corresponding full-theory workflow. One-shot repair produced 22/36, while a later prospectively frozen iterative workflow produced 32/36.
Researchers introduced CAPRI, a contract-aware repair workflow for Isabelle proofs that combines LLM-generated proof proposals with an independent checker enforcing a machine-readable edit contract. The system retains prompts, proposals, candidate repositories, diagnostics, verdicts, and hashes for audit. In an evaluation of five workflows on twelve failed proofs from four developments, with three replicates per task and condition (180 runs total), 138 valid repairs were achieved. Six of 144 terminal candidates accepted by Isabelle had modified protected text, all from iterative workflows that could edit a complete theory. A proof-body-only interface produced 29/36 valid repairs with no contract violations, compared with 31/36 for the corresponding full-theory workflow. One-shot repair produced 22/36, and a later prospectively frozen iterative workflow produced 32/36.
The key technical contribution is the separation of proof checking (by Isabelle) from edit-contract enforcement (by an independent checker), enabling auditable LLM-assisted proof repair. The proof-body-only interface eliminates contract violations by restricting edits to the proof body, while iterative full-theory workflows risk modifying protected text. The prospectively frozen iterative workflow improves repair rate over one-shot repair (32/36 vs 22/36) while maintaining contract compliance.
This work addresses a critical gap in AI-assisted formal verification: ensuring that LLM-generated changes do not alter developer-authorized code. The audit trail and contract enforcement mechanism could become a standard requirement for enterprise adoption of LLM-based proof assistants and code repair tools, particularly in safety-critical domains.
CAPRI provides a verifiable and auditable method for using LLMs in formal verification, reducing the risk of unauthorized code changes. This could lower the cost of formal proof development and increase trust in AI-assisted software verification, making it attractive for industries requiring high assurance (e.g., aerospace, finance, security).
Next signals include adoption of contract-aware repair workflows in other proof assistants (e.g., Coq, Lean), integration with continuous integration pipelines, and extension of edit contracts to broader code repair tasks. The post hoc OpenRouter campaign mentioned in the evidence may yield further results on model performance.