ProofCoder hands proof search to an agent: Rocq verification success rises from 47% to 60% at about half the inference cost
Synopsis
ProofCoder, a proof-synthesis system for Rocq software verification, stops letting an external controller dictate when to retrieve premises, backtrack or repair; instead the model writes down its reading of the proof state before each tool call and decides whether to continue, query or roll back to a given line. On 280 verification lemmas from the AutoRocq benchmark, its best configuration raises proof success from AutoRocq's 47% to 60% at roughly half the inference cost, and removing continuous reasoning leaves the agent solving fewer lemmas at higher cost with four to six times more backtracking.
Interpretation
ProofCoder recasts interactive theorem proving as an edit-and-feedback loop like a coding agent, with the model deciding when to retrieve, inspect the proof state, edit the script or roll back to an earlier point. Earlier LLM proof systems placed the model inside a controller-driven search loop where an external algorithm decided when to retrieve context, backtrack or repair; AutoRocq gave the model tools for planning, tactic generation and querying the environment but still bounded it with a semi-constrained protocol. On 280 verification lemmas from the AutoRocq benchmark, the best configuration raises proof success from AutoRocq's 47% to 60% while cutting inference cost to about half.
The proof script is treated as an editable artifact that the agent reads and writes through a small tool set, stating in natural language its reading of the current goal and the cause of a failure before each action. The interface separates read-only operations from a single mutating one: check_state replays the script to a given tactic index and returns that proof state, call_command runs Rocq commands such as Search, Print and Locate, read_proof_file reads workspace files, and edit_proof keeps the first n lines and appends a new fragment. Experiments run on 200 SV-COMP lemmas and 80 Linux-kernel Verker lemmas with claude-sonnet-4.5 and gpt-6-sol at temperature 0, under a primary budget of 200k non-cached tokens per attempt.
Ablations identify continuous reasoning and localized repair as the main sources of the gain, with localized repair mattering more. Without continuous reasoning, the tactic-level configuration drops from 119 to 115 solved lemmas on SV-COMP and from 46 to 40 on Verker while cost more than doubles on both; replacing localized repair with a restart after every failure drops the whole-proof configuration from 120 to 81 on SV-COMP and from 48 to 24 on Verker. These ablations run with gpt-6-sol and are compared against other ProofCoder variants on the same OpenCode infrastructure, isolating framework differences.
Perspective
The results cover 200 SV-COMP lemmas selected by term-count complexity and 80 Verker kernel lemmas from the AutoRocq benchmark, using claude-sonnet-4.5 and gpt-6-sol, with a primary budget of 200k non-cached tokens per attempt plus 5M-token and 30-minute caps. The authors list evaluation on additional proof assistants and verification-aware languages, richer verifier interactions and collaborative multi-agent proof search as future work.
The SV-COMP subset has no ground-truth proofs, so provability is not established for all lemmas; the authors confirm only that 88 of them were solved by AutoRocq or its baselines in the original evaluation. ProofCoder and AutoRocq use different agent frameworks, so differences in context management or tool-call serialization may affect performance. On Verker with claude-sonnet-4.5, both ProofCoder configurations solve fewer loop-invariant lemmas than AutoRocq, and a small number of lemmas are solved only by AutoRocq.