[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"Xy6cxLdJ9k":3},"# ForShor\n\n[![Lean](https://img.shields.io/badge/Lean-v4.28.0-blue)](https://leanprover.github.io/)\n[![Mathlib](https://img.shields.io/badge/mathlib4-required-9cf)](https://github.com/leanprover-community/mathlib4)\n[![License](https://img.shields.io/badge/license-Apache_2.0-green)](LICENSE)\n\nA formal verification of **Shor's algorithm** in Lean 4 — including its **resource estimation**.\n\nThe development verifies an implementation of order finding built on fast (Toom-Cook) multiplication, from a high-level gate language down to a low-level abstract machine, and proves that the whole circuit uses only `O(n^(2+ε))` gates.\n\n## Main results\n\n**Correctness** (`FastMultiplication/ShorVerification/ShorCorrectness.lean`): the ideal order-finding circuit recovers the multiplicative order with at least the standard inverse-polylogarithmic probability.\n\n```lean\ntheorem Shor_correct (T : ℕ → ℕ) (inst : ShorOrderFindingInstance)\n    (ψ0 : qs.State) (hψ0 : ‖ψ0‖ = 1) :\n    probability_of_success ... ≥ κ / (Nat.log2 inst.N : ℝ)^4\n```\n\n**Resource estimation** (`FastMultiplication/ShorVerification/GateCount/Shor_GateCount.lean`): for every `ε > 0` there is a recursion parameter `k` such that the compiled Shor circuit uses `O(n^(2+ε))` elementary gates.\n\n```lean\ntheorem exists_shorGateCountBound (qs : QSemantics) ... (ε δ : ℝ) (hδ : 0 \u003C δ) (hε : 0 \u003C ε) :\n    ∃ k : ℕ, ∃ hk : 1 \u003C k, ∃ ops : Prog k,\n      PhaseProductProgramOK k hk ops ∧ ShorGateCountBound qs ε δ k hk ops\n```\n\nHere `ShorGateCountBound` says the count of elementary gates in the fully lowered order-finding circuit is at most `C · n^(2+ε)`, where `n` is the size of the modulus register (typeclass arguments elided):\n\n```lean\ndef ShorGateCountBound (qs : QSemantics) (ε δ : ℝ) (k : ℕ) (hk : 1 \u003C k) (ops : Prog k) : Prop :=\n  ∃ C : ℝ, 0 \u003C C ∧\n  ∃ n₀ : ℕ, 1 ≤ n₀ ∧\n    ∀ (inst : ShorOrderFindingInstance) (work : Reg) (flag : ℕ) (b0 : qs.Basis),\n      let n := regSize inst.y\n      n₀ ≤ n →\n      ShorApproxSetup qs (shorEta δ (regSize inst.y)) inst.a inst.N inst.x inst.y work flag b0 →\n      (shorOrderFindingGateCount qs k hk ops inst.a inst.N inst.x inst.y work flag : ℝ)\n        ≤ C * shorGateRate ε n\n```\n\nThe two quantities being compared are honest counts, not abstract measures: `shorOrderFindingGateCount` counts the `LowGate` operations of the compiled circuit under the cost model `shorGateCostModel`, and `shorGateRate ε n` is just `n^(2+ε)`.\n\n```lean\nnoncomputable def shorOrderFindingGateCount ... : ℕ :=\n  LowGate.gateCount shorGateCostModel (orderFindingApproxLow qs k hk ops a N x y work flag)\n\nnoncomputable def shorGateRate (ε : ℝ) (n : ℕ) : ℝ :=\n  Real.rpow (((max 1 n : ℕ) : ℝ)) (2 + ε)\n```\n\n### Status\n\nAll components are proved: phase-product compilation, QFT decomposition, lowering correctness, modular-exponentiation error bounds, and the full resource-estimation stack. Two statements are still `sorry`:\n\n- `Shor_correct` — the final assembly of the top-level success-probability bound.\n- `CF_recovers_denominator` — the classical continued-fraction postprocessing fact.\n\n## Repository layout\n\n| Directory | Contents |\n| --- | --- |\n| `FastMultiplication/ShorVerification/Basic.lean` | Semantic core: registers, the high-level `Gate` language, `QSemantics`, and general semantic facts. |\n| `FastMultiplication/ShorVerification/MathBackbone/` | Symbolic source programs and table generation, Toom-Cook interpolation algebra, and the classical Shor/order-finding math. |\n| `FastMultiplication/ShorVerification/AlgorithmCorrectness/` | Phase-product compiler correctness, the QFT split identity, and modular-multiplication/exponentiation error bounds. |\n| `FastMultiplication/ShorVerification/AbstractMachine/` | The low-level `LowGate` machine, recursive lowering from `Gate`, and whole-program lowering correctness. |\n| `FastMultiplication/ShorVerification/GateCount/` | Resource estimation: the gate cost model and counting bounds for the phase product, the QFT, and the complete Shor circuit. |\n| `FastMultiplication/ShorVerification/ShorCorrectness.lean` | Order-finding circuits, the measurement interface, and the top-level theorem `Shor_correct`. |\n| `docs/` | An interactive visualization of the proof architecture. |\n\nFor a detailed file-by-file guide, see [ARCHITECTURE.md](ARCHITECTURE.md).\n\n## Proof architecture\n\nThe dependency story in one paragraph: `MathBackbone/Table_Generation` produces the symbolic source programs and phase-point structure, and `MathBackbone/Toom_Cook_formula.lean` supplies the interpolation algebra. `AlgorithmCorrectness/PhaseProduct` uses both to prove the high-level Toom-Cook phase identity and the correctness of the compiled signed phase-product circuit; `AlgorithmCorrectness/QFT` proves the QFT split identity. `AbstractMachine` lifts these to the full `Gate` language via the lowering theorems. Finally, the lowering results, the modular-exponentiation bounds, and the classical math in `MathBackbone/ShorAlgorithm.lean` feed into `ShorCorrectness.lean`, while `GateCount/` supplies the resource estimates for the compiled circuit.\n\nYou can explore the proof graph interactively:\n\n```sh\ncd docs && python3 -m http.server 8765\n# then open http://localhost:8765\n```\n\n## Building\n\nThe project uses Lean `v4.28.0` (pinned in `lean-toolchain`) and depends on [mathlib4](https://github.com/leanprover-community/mathlib4). With [elan](https://github.com/leanprover/elan) installed:\n\n```sh\nlake exe cache get   # fetch prebuilt mathlib oleans\nlake build\n```\n\n## License\n\nReleased under the Apache License 2.0. See [LICENSE](LICENSE).\n",1786349536149]