AI-Assisted Completion of CertiGC Proofs: An Experience Report

2026-06-19

AI Summary

This work addresses the breakdown of the graph isomorphism correctness theorem in the formal verification of the CertiGC garbage collector when extending from an immutable to a mutable environment, where the original assumption of “global absence of backward edges” no longer holds. To resolve this, the authors present the first integration of an AI agent (Codex) with the interactive theorem prover Rocq, leveraging the Verified Software Toolchain (VST) and CertiGraph frameworks to restructure the proof architecture. They introduce and formally verify a backward-edge invariant, thereby repairing the VST relational proof, restoring the graph isomorphism theorem, and eliminating erroneous assumptions between specification and theorem. This effort not only removes an outdated hypothesis but also yields a maintainable verification artifact, demonstrating the feasibility and effectiveness of large language models in assisting complex systems formal verification.

Abstract

This experience report describes the Codex-assisted completion and stabilization of a substantial Rocq (formerly Coq) proof development for CertiGC, the verified generational garbage collector in the CertiGraph project. The development extends the collector from an effectively immutable setting to a mutable one by adding remembered-set forwarding to the collection path and re-establishing the top-level graph-isomorphism correctness theorem. The central technical issue was not low-level proof scripting alone: mutable updates invalidate the old global no-backward-edge assumption, so the proof had to be reorganized around a recorded-backward-edge invariant stating that every backward edge is recorded in the appropriate remembered-set component. This case differs from recent AI-assisted formal-proof accounts: unlike the adaptation of a nearby compilerproof architecture or a fresh metatheory formalization, it completes a long-running verification in a mature codebase built on the Verified Software Toolchain (VST) and CertiGraph, both mechanized in Rocq. The Rocq kernel remained the arbiter of correctness, while our role shifted toward adjudicating invariant proposals, constraining specification changes, reviewing theorem statements, and deciding when proof cleanup was justified. The Codex-assisted phase repaired the VST relation proofs first, then restored the mathematical graph-isomorphism theorem, and only then audited the premise path from the VST specification to the theorem. That audit found and removed a stale no-backward-edge condition from the VST-facing proof path. This report presents the workflow, resulting proof artifact, and lessons for agentic proof maintenance.

Problem

• generational garbage collector
• mutable updates
• backward edges
• graph isomorphism
• formal verification

Innovation

• AI-assisted proof
• remembered-set invariant
• mutable garbage collection
• graph isomorphism
• formal verification