[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"hjROBHiUB9":3},"# Mathematical finance, formally verified\n\n[![build](https://github.com/formal-applied-math/formal-mathfin/actions/workflows/build.yml/badge.svg)](https://github.com/formal-applied-math/formal-mathfin/actions/workflows/build.yml)\n[![axioms](https://img.shields.io/badge/axioms-propext%2C%20Classical.choice%2C%20Quot.sound-blue)](MathFin/AxiomAudit.lean)\n[![blueprint](https://img.shields.io/badge/blueprint-deductive_spine-blue)](docs/blueprint.md)\n[![Lean](https://img.shields.io/badge/Lean-4.32.0-blue)](lean-toolchain)\n[![license](https://img.shields.io/badge/license-Apache_2.0-blue)](LICENSE)\n[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.20477781.svg)](https://doi.org/10.5281/zenodo.20477781)\n[![arXiv](https://img.shields.io/badge/arXiv-2606.01356-b31b1b)](https://arxiv.org/abs/2606.01356)\n[![dataset](https://img.shields.io/badge/HF-dataset-ffcc4d)](https://huggingface.co/datasets/formal-applied-math/formal-mathfin-theorems)\n[![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md)\n[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa)](CODE_OF_CONDUCT.md)\n\n> A Lean 4 library building toward a **formal theory of mathematical finance** — every result\n> machine-checked against [Mathlib](https://github.com/leanprover-community/mathlib4) and\n> [Degenne's BrownianMotion](https://github.com/RemyDegenne/brownian-motion), with an exact statement of\n> what is proved and what is assumed, and the deep connections between the field's pillars made\n> *load-bearing* rather than decorative.\n\n**`353` theorems · `340` delivery-ready · `0` sorries · axioms-clean · `lake build` is the proof.**\n\n---\n\n## What we're building\n\nFormalized finance is usually a scattering of isolated results. The ambition here is a **theory**: prove\nthe Black–Scholes world, the Itô tower, the Fundamental Theorem of Asset Pricing, and the risk-measure\nlayer — then wire them together around the field's actual organizing principles, so that the\n**architecture** is the artifact, not just the catalogue. \"Top-notch\" here is not *more theorems* — it is\nthe theorems organized around the field's spine, with the deep cross-connections proved.\n\nTwo commitments make that trustworthy:\n\n- **The build is the proof.** A clean `lake build` re-elaborates every theorem against pinned Lean +\n  Mathlib. There is no `sorry` and no project-local axiom anywhere; every `full` result depends only on\n  the three standard axioms `propext, Classical.choice, Quot.sound`, `#print axioms`-pinned as a CI\n  invariant in [`MathFin/AxiomAudit.lean`](MathFin/AxiomAudit.lean).\n- **Honest scope, enforced — never overclaimed.** Every entry declares a faithfulness status\n  (`full` / `library_wrapper` / `reduced_core`); an input-hash [verification\n  ledger](verification_ledger.json) records exactly what each was checked under; a machine-generated\n  [`formalization.yaml`](formalization.yaml) self-report discloses how each result was produced; and a\n  multi-agent [values review](docs/values-review.md) runs on a CI-enforced cadence. The README does not\n  claim a result the kernel has not accepted.\n\n## The architecture — the field's spine\n\nMathematical finance is a few deep principles whose consequences are the models. The library has the\n**four pillars**; the active program is to make the **connective tissue** between them load-bearing.\n\n| Pillar | The principle | In the library |\n|---|---|---|\n| **I — No-arbitrage as convex duality** | the separating hyperplane *is* the equivalent martingale measure | the FTAP tower · [`ConvexDuality`](MathFin/Foundations/ConvexDuality.lean) · state prices |\n| **II — Stochastic calculus** | every model is `dX = b dt + σ dB`; Itô makes functionals computable | the Itô tower: from-scratch L² integral, Itô's formula, quadratic variation, and its jump analogue — and it *names* the `σ`, down to `dŜ = σŜ dB` for the discounted price |\n| **III — Probabilistic ⟷ analytic duality** | the price is both a risk-neutral expectation and a PDE solution | the BS-PDE keystone (Feynman–Kac and Itô routes) |\n| **IV — Intensity & exponential families** | closed forms and the \"exp of an integrated intensity\" | Gaussian closed forms · the exponential-discount root · credit/mortality unification |\n\n**The bridges are where the depth lives** — each makes two pillars one theorem:\n\n| Bridge | Connects | Status |\n|---|---|---|\n| **Convex duality** | I ↔ IV (pricing ↔ risk) | ✅ **WIRED** — the FTAP and the coherent-risk representation are proved to be the *same* Hahn–Banach theorem |\n| **Feynman–Kac** | II ↔ III | ✅ **WIRED** — the Black–Scholes PDE from the risk-neutral expectation |\n| **Lattice limit (CLT)** | discrete ↔ continuous | ✅ **WIRED** — CRR binomial → Black–Scholes, by characteristic functions and Lévy continuity through put-call parity. Donsker's invariance principle itself is *not* formalized; this seam is the pricing limit, not the functional CLT |\n| **Numéraire** | IV ↔ I | ✅ **WIRED** — the price-invariance seam `N₀·𝔼^{Qᴺ}[X/N_T] = B₀·𝔼^Q[X/B_T]` (`changeOfNumeraire`), with BS-stock / Margrabe-`S²` / Kelly-EMM instances |\n| **Girsanov** | I ↔ II | ✅ **WIRED** — the EMM is an *explicit* change of measure, and the distributional Girsanov is closed for **bounded** predictable θ: `B^θ` is a `Q`-Brownian motion in full — zero start, Gaussian **and** independent increments. That is strictly inside the integrand class: `itoIntegralCLM_T` is defined on all of `L²`-predictable, and boundedness is a real extra hypothesis, so unbounded `L²`/progressive θ is open, as is Novikov's condition itself ([scope](#scope-whats-not-done)) |\n| **Martingale representation** | I ↔ II | ✅ **WIRED** — the same seam from the other side: the Itô integral is proved *onto* the centered `𝓕ᴮ_T`-measurable claims, so every square-integrable claim has a unique hedge, and the pricing measure is pinned on that filtration for measures that price the traded gains at zero |\n\n→ The full spine, seam by seam: **[`docs/mathematical-architecture.md`](docs/mathematical-architecture.md)**.\n\n## Landmark results\n\n| Result | Statement | Lean |\n|---|---|---|\n| **Pricing = risk, one theorem** | the FTAP separating functional and the coherent-risk representation are the same finite-dimensional Hahn–Banach separation | [`exists_pos_separating_of_cone_disjoint_simplex`](MathFin/Foundations/ConvexDuality.lean) · [`coherentRisk_isLUB`](MathFin/RiskMeasures/AcceptanceSet.lean) |\n| **BS PDE from Feynman–Kac** | the Black–Scholes PDE derived from the risk-neutral expectation by heat-kernel differentiation — independent of the closed form and of Itô | [`bsV_satisfies_bs_pde_via_feynmanKac`](MathFin/BlackScholes/PDEFromFeynmanKac.lean) |\n| **CRR → Black–Scholes** | the n-step binomial call price converges to `S₀Φ(d₁) − Ke^{−rT}Φ(d₂)` (characteristic functions + Lévy continuity + put-call parity) | [`binomialPrice_call_tendsto_bs_closed`](MathFin/Binomial/CRRClosedForm.lean) |\n| **Continuous-time Itô formula** | `f(T,B_T) − f(0,B_0) − ∫₀ᵀ(f_t + ½f_xx) ds` is a continuous **local martingale** — Itô's lemma as a semimartingale decomposition — for a general `C³` `f` with no growth bound, on a from-scratch L² Itô integral. Where the partials are bounded, that residual is *identified*: `= ∫₀ᵀ f_x(s,B_s) dB_s` | [`ito_formula_unrestricted`](MathFin/Foundations/ItoFormulaUnrestrictedLocMart.lean) · [`ito_formula_td_L2_bddDeriv`](MathFin/Foundations/ItoFormulaTD.lean) |\n| **GBM decomposed, coefficients named** | `dŜ = σŜ dB + mŜ dt` for `Ŝ(t) = S₀e^{(m−σ²/2)t+σB_t}`, the stochastic term the genuine Itô integral of a *named* integrand — so the diffusion coefficient of the discounted price is sayable, not merely known to exist | [`ito_formula_gbm`](MathFin/Foundations/ItoFormulaGBM.lean) · [`discountedGBM_eq_itoIntegral`](MathFin/Foundations/ItoFormulaGBM.lean) |\n| **The EMM via Girsanov** | the risk-neutral measure is *constructed* as an explicit density change of the physical measure; the discounted stock is a proven `Q`-martingale — retiring the Wald shortcut | [`bs_discounted_isQMartingale`](MathFin/Foundations/Girsanov.lean) |\n| **Itô–Lévy L² isometry** | the compensated-Poisson stochastic integral built to an L²-isometric continuous linear operator, on a from-scratch density argument | [`assembly_isometry`](MathFin/Foundations/PoissonCompensatedIntegralOperator.lean) |\n| **SDE existence + uniqueness** | the Picard contraction in the predictable `L²` space, and pathwise uniqueness by an `L²`-energy Grönwall argument | [`picardMap_contraction`](MathFin/Foundations/SDEExistence.lean) · [`IsL2SolutionPair.uniqueness`](MathFin/Foundations/SDEUniqueness.lean) |\n| **Martingale representation** | the Itô integral `φ ↦ ∫₀ᵀ φ dB` is onto the centered `𝓕ᴮ_T`-measurable part of `L²(μ)` — by orthogonal decomposition against its closed range plus totality of the step Doléans exponentials, with no Malliavin calculus; the finance reading is that every square-integrable claim has a unique hedge | [`itoIntegralCLM_T_surjective_onto_centered`](MathFin/Foundations/MartingaleRepresentation.lean) · [`exists_replicating_strategy`](MathFin/Foundations/MarketCompleteness.lean) |\n| **Jump risk is never free** | the Merton (1976) jump-diffusion price dominates Black–Scholes | [`bsV_le_mertonCallPrice`](MathFin/BlackScholes/MertonDominance.lean) |\n\n## A theorem, up close\n\n```lean\n-- Coherent risk = sup of expected loss over the representing measures (the ADEH representation).\n-- Closedness of the acceptance set is *derived* from the four axioms, not assumed.\ntheorem coherentRisk_isLUB {ι : Type*} [Fintype ι] [Nonempty ι] {ρ : (ι → ℝ) → ℝ}\n    (hρ : IsCoherentRisk ρ) (X : ι → ℝ) :\n    IsLUB ((fun q => ∑ i, q i * (- X i)) '' representingSet ρ) (ρ X)\n\n-- Black–Scholes delta, in one line of the \"magic identity\" collapse: ∂V/∂S = Φ(d₁).\nlemma hasDerivAt_bsV_S {K r σ : ℝ} (hK : 0 \u003C K) (hσ : 0 \u003C σ) {S τ : ℝ} (hS : 0 \u003C S) (hτ : 0 \u003C τ) :\n    HasDerivAt (fun s => bsV K r σ s τ) (Phi (bsd1 S K r σ τ)) S\n```\n\nSee [`MathFin/Examples.lean`](MathFin/Examples.lean) for a curated tour.\n\n## Status at a glance\n\n| | |\n|---|---:|\n| theorems (machine-checked) | **353** |\n| delivery-ready (`full` + `library_wrapper`) | **340** |\n| full derivations | 322 |\n| library wrappers | 18 |\n| reduced cores (honest special cases) | 13 |\n| placeholders / sorries | **0** |\n| Lean modules · lines of Lean | 270 · ~57,750 |\n| verification ledger | 353 fresh, 0 stale |\n| axioms used | `propext, Classical.choice, Quot.sound` only |\n| Lean / Mathlib | `v4.32.0` / `81a5d257`, pinned ([`lean-toolchain`](lean-toolchain), [`lake-manifest.json`](lake-manifest.json)) |\n\nThe library is organized by theme under [`MathFin/`](MathFin): `Foundations/` (133 modules — the\nstochastic core), `BlackScholes/` (51), `FixedIncome/` (24), `Binomial/` (18), `Portfolio/` (14),\n`RiskMeasures/` (9), `Actuarial/` (6), `Performance/` (4), `Futures/` (3), `Bridges/` (2), `DeFi/` (1).\n\n## Quick start\n\n```bash\n# Pull the pinned image (~3 min) instead of building locally (~15 min)\ndocker compose -f docker/docker-compose.yml pull verify\n\n# Build the whole library — a clean exit means every theorem typechecks\ndocker compose -f docker/docker-compose.yml run --rm --entrypoint bash verify -lc 'lake build'\n\n# Fast authoring loop (5–30s feedback via the persistent REPL daemon)\ndocker compose -f docker/docker-compose.yml up -d lean-repl\n./scripts/lean-check.sh MathFin/\u003CSection>/\u003CModule>.lean\n```\n\nSee [`CONTRIBUTING.md`](CONTRIBUTING.md) for the full workflow and\n[`docs/onboarding.md`](docs/onboarding.md) for a guided path into the codebase.\n\n## How verification works\n\n- **The build is the proof.** `lake build` re-elaborates every theorem against the pinned toolchain; a\n  clean exit is the canonical verification.\n- **Axiom audit.** [`AxiomAudit.lean`](MathFin/AxiomAudit.lean) (headliners) and\n  [`AxiomAuditGen.lean`](MathFin/AxiomAuditGen.lean) (generated over the whole corpus) pin `#print axioms`\n  as `#guard_msgs` build invariants — no `sorry`, no project-local axioms.\n- **Verification ledger.** [`verification_ledger.json`](verification_ledger.json) records the input-hash\n  (snippet + transitive imports + toolchain pins) each entry last verified under; only entries whose\n  inputs changed re-run.\n- **Kernel replay.** A `leanchecker` job re-checks proof terms *below* the elaborator. It is\n  best-effort and `workflow_dispatch`-only: the full-Mathlib environment does not fit in a 16 GB\n  hosted runner, and the README says so rather than implying a green replay it cannot run.\n- **CI gates.** Every push runs the Python gates (status taxonomy, forbidden tactics, ledger freshness,\n  generated-artifact freshness) and the environment linter *before* the Lean build.\n- **Values review.** Sessions that change proof content close with a multi-agent review over eight\n  judgment lenses, logged in [`docs/values-review.md`](docs/values-review.md). It is an upgrade engine\n  producing a ranked backlog, not a pass/fail stamp; only its cadence is machine-enforced.\n\n## Provenance — who proved what\n\nSome entries are drafted by an automated pipeline rather than by hand, and the library says which.\n[`formalization.yaml`](formalization.yaml) is generated from the corpus (never hand-edited, freshness\nCI-enforced) and records the methods in use: interactive human authoring, and a two-stage machine\nautoformalization loop that drafts a statement, gates it adversarially, and proves it. Machine-drafted\nentries carry a `provenance` marker in their benchmark entry, so the disclosure is counted from the\ncorpus rather than asserted.\n\nAutomation is held to the same bar as hand-authored work: a proof that a machine found is refactored to\nthe conceptually right argument before it merges, and a statement that is *faithful but empty* — an\ninstantiation of an already-∀-quantified lemma, or a Mathlib result restated in finance names — is\nrejected rather than counted.\n\n## What's covered\n\nA breadth-and-depth library across eleven areas. Headlines per area (full per-theorem audit + status in\n[`docs/coverage.md`](docs/coverage.md)):\n\n- **Black–Scholes & exotics** — the full Greek matrix (δ, γ, vega, θ, ρ, vanna, volga, charm), digitals,\n  BS-Merton dividends, Garman–Kohlhagen FX, implied-vol uniqueness, the PDE, Breeden–Litzenberger;\n  Margrabe exchange, chooser, capped/bull/butterfly, lookback, geometric-Asian, barrier parity, quanto.\n- **Bachelier & Black-76** — arithmetic-BM pricing + Greeks; the futures-options formula + swaption.\n- **Binomial / lattice** — replication + uniqueness, American/Bermudan via the Snell envelope, **CRR →\n  Black–Scholes** convergence, Merton 1973 dominance, André's reflection principle, barrier/lookback.\n- **Fixed income & credit** — bonds, duration/convexity, Redington immunization, yield-curve bootstrap,\n  zero-coupon and forward rates, FRAs, vanilla interest-rate swaps, the T-forward measure, reduced-form\n  hazard credit, first-to-default, Vasicek (ODE + SDE law), KMV–Merton default.\n- **Portfolio & performance** — Markowitz (2- and N-asset), CAPM + equilibrium, two-fund separation,\n  risk parity, Black–Litterman, tangency; Sharpe/Sortino/Treynor/Information ratios, Kelly.\n- **Risk measures** — Gaussian VaR/CVaR closed forms, the coherent (ADEH) axioms + **the representation\n  as a sup over measures**, spectral measures, Rockafellar–Uryasev, Herfindahl–Hirschman.\n- **Stochastic foundations** — the **Itô tower** (from-scratch L² integral, isometry, quadratic\n  variation, Itô's formula — stating *which* integrand, down to `dŜ = σŜ dB` for geometric Brownian\n  motion) and its jump analogue, the **compensated-Poisson (Itô–Lévy) integral** built\n  to an L²-isometric continuous linear operator, the **SDE tower** (Picard existence, `L²`-Grönwall\n  uniqueness, pathwise decomposition), the **FTAP tower** (finite-Ω multi-period, general-Ω one-period,\n  d-asset), Girsanov, **martingale representation** and the market completeness it delivers,\n  Feynman–Kac, and **the convex-duality unification**.\n- **Market microstructure** — the Avellaneda–Stoikov market-making problem: the Riccati value function,\n  its approximate-HJB solution, and the constant half-spread / linear-skew closed forms, single-asset\n  and multi-asset (matrix Riccati by spectral reduction).\n- **Actuarial & DeFi** — Gompertz mortality, survival models, annuities, net premium, compound-Poisson\n  MGF; constant-product (Uniswap-v2) AMMs.\n\n## Scope: what's not done\n\nHonesty is the point, so the gaps are explicit:\n\n- **13 `reduced_core` entries** — special cases or algebraic/structural cores whose fully general form is\n  not yet formalized (the 2-D Itô formula, Lévy's characterisation, Novikov's condition, the\n  fully-general `L²`/progressive Girsanov, some Markov/Poisson cores). Tracked per-entry in\n  [`docs/coverage.md`](docs/coverage.md).\n- **18 `library_wrapper` entries** — thin restatements consuming a Mathlib/BrownianMotion lemma. They are\n  delivery-ready but are not original derivations, and are counted separately for that reason.\n- **Girsanov's general case, and Novikov separately.** The ladder is closed through bounded\n  predictable θ (constant → simple-adapted → adapted-continuous → predictable). That is *narrower*\n  than the integrand class the ladder is built on: `itoIntegralCLM_T` maps all of `Lp ℝ 2 (trimMeasure_T T)`,\n  and on a finite measure `L² ⊋ L^∞`, so a square-integrable predictable θ need not be bounded.\n  Unbounded, merely progressively-measurable θ remains open. **Novikov's condition is not derived either** — its entry is a structure spec carrying a\n  uniform `L¹` bound in place of `𝔼[exp(½∫₀ᵀθ²ds)] \u003C ∞` (the genuine condition needs `∫θ dB`, and no θ\n  or `B` appears in the structure), so the martingale conclusion is read off by projection. The open\n  case is therefore *two* gaps, not one hypothesis away from a proved theorem.\n- **The second FTAP is not proved unconditionally.** What is proved is that a probability measure\n  `Q ≪ μ` which prices the traded Itô gains at zero agrees with `μ` on `𝓕ᴮ_T`. Gains-neutrality is an\n  explicit hypothesis (`PricesGainsAtZero`), not a consequence of being a martingale measure for a\n  price process: the wealth process martingale representation builds integrates against `B`, and\n  nothing in `IsEMM S Q` makes that a `Q`-fair game. Only `complete ⟹ unique` is delivered; the\n  converse needs the Jacod–Yor extreme-point characterisation.\n- **The replicating hedge is unique but unnamed.** For a general square-integrable claim, market\n  completeness gives a unique `φ` with `H = 𝔼[H] + ∫₀ᵀ φ dB` and says nothing about what `φ` is.\n  Naming it is Clark–Ocone ([#182](https://github.com/formal-applied-math/formal-mathfin/issues/182)) and\n  is open. The Itô *formula's* integrand is named throughout — that is how `dŜ = σŜ dB` is stated —\n  but that is the weaker of the two facts.\n- **Known upstream/limit gaps** — e.g. the superhedging strong-duality *equality* needs a\n  finite-dimensional Farkas / polyhedral-cone closedness absent from Mathlib at this pin\n  ([#39](https://github.com/formal-applied-math/formal-mathfin/issues/39)).\n\nThe frontier is in the [open issues](https://github.com/formal-applied-math/formal-mathfin/issues) and\n[`docs/roadmap.md`](docs/roadmap.md). For genuinely *unsolved* problems — as opposed to unformalized\nknown mathematics — [`docs/open-problems.md`](docs/open-problems.md) is a survey built over three\nadversarial rounds, where each entry carries an evidence class and the date of the most recent source\nasserting it is still open.\n\n## Documentation\n\n| File | Contents |\n|---|---|\n| [`docs/mathematical-architecture.md`](docs/mathematical-architecture.md) | **The field's spine** — the four pillars, the connective bridges, and which seams are wired vs open. |\n| [`docs/architecture.md`](docs/architecture.md) | The engineering design: structural-principle modules, the three honesty tiers, the bridge methodology. |\n| [`docs/blueprint.md`](docs/blueprint.md) | The deductive spine — a dependency graph from Brownian motion to Black–Scholes, each node linked to its proof. |\n| [`docs/coverage.md`](docs/coverage.md) | Per-theorem audit: faithfulness status, verification evidence, claim wording. |\n| [`docs/open-problems.md`](docs/open-problems.md) | Unsolved problems in the field, by evidence class, with where this library has leverage. |\n| [`docs/roadmap.md`](docs/roadmap.md) | Strategic depth-vs-breadth framing and the tactical phase log. |\n| [`docs/hjm-program.md`](docs/hjm-program.md) | The HJM formalization program: stochastic Fubini as a shared primitive, the drift condition as its consumer. |\n| [`docs/values-review.md`](docs/values-review.md) | The judgment layer: the eight review lenses and the upgrade log. |\n| [`docs/onboarding.md`](docs/onboarding.md) · [`docs/troubleshooting.md`](docs/troubleshooting.md) | Getting in, and getting unstuck. |\n| [`docs/bridges.md`](docs/bridges.md) · [`docs/leaps.md`](docs/leaps.md) · [`docs/patterns.md`](docs/patterns.md) | The Foundations→pricing bridges, the deductive leaps, and distilled Lean proof patterns. |\n\n## Contributing · citation · license\n\nContributions welcome — see [`CONTRIBUTING.md`](CONTRIBUTING.md) and the\n[good first issues](https://github.com/formal-applied-math/formal-mathfin/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22).\nPlease cite via the [Zenodo DOI](https://doi.org/10.5281/zenodo.20477781) or the\n[paper](https://arxiv.org/abs/2606.01356) ([`CITATION.cff`](CITATION.cff)). Licensed under\n[Apache 2.0](LICENSE).\n",1786727900186]