axsent 0.1.0__tar.gz

axsent-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vincent Gonzalez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

axsent-0.1.0/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: axsent
+Version: 0.1.0
+Summary: Measure what a formal library assumes: Rocq, Agda and Isabelle, from source, with nothing built
+Author-email: Vincent Gonzalez <vincegonzalez@me.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/vince-gonzalez/axsent
+Project-URL: Paper, https://doi.org/10.5281/zenodo.22148932
+Keywords: axiom provenance,formal verification,proof assistants,Rocq,Agda,Isabelle,dependency analysis
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Scientific/Engineering :: Mathematics
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+```
+╔════════════════════════════════════════════════════════════════════════════════════════════╗
+║                                                                                            ║
+║                     █████╗ ██╗  ██╗███████╗███████╗███╗   ██╗████████╗                     ║
+║                    ██╔══██╗╚██╗██╔╝██╔════╝██╔════╝████╗  ██║╚══██╔══╝                     ║
+║                    ███████║ ╚███╔╝ ███████╗█████╗  ██╔██╗ ██║   ██║                        ║
+║                    ██╔══██║ ██╔██╗ ╚════██║██╔══╝  ██║╚██╗██║   ██║                        ║
+║                    ██║  ██║██╔╝ ██╗███████║███████╗██║ ╚████║   ██║                        ║
+║                    ╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚══════╝╚═╝  ╚═══╝   ╚═╝                        ║
+║                                                                                            ║
+║                               what a formal library assumes                                ║
+║                                                                                            ║
+╚════════════════════════════════════════════════════════════════════════════════════════════╝
+```
+
+An accent is a dependence on something local that travels with whoever carries
+it. An inherited axiom is the same thing: a library speaks in the assumptions of
+wherever it came from, and most of what it carries it never chose.
+
+Rocq, Agda and Isabelle each let a development assert something without proving
+it, and each records the dependency edges that carry the assertion outward.
+`axsent` reads those declarations and those edges from source text, with no
+proof assistant installed and nothing built.
+
+```bash
+pip install axsent
+```
+
+```bash
+axsent rocq      path/to/stdlib/theories
+axsent agda      path/to/agda-stdlib/src
+axsent isabelle  path/to/afp/thys
+```
+
+## Why counts should not be totalled
+
+A library declares two kinds of assumption and both use the same keyword.
+
+**Mathematical** — excluded middle, choice, functional extensionality, proof
+irrelevance. Claims about mathematics. A result depending on one is classical
+rather than constructive.
+
+**Interface** — that native 63-bit arithmetic behaves as specified, that a
+mutable array returns what was written to it, that a foreign function returns
+what its type says. Claims about the machine and the runtime. A result
+depending on one is not thereby classical.
+
+Rocq's Corelib declares **five times** as many axioms as the Rocq standard
+library and makes no mathematical assumption at all: all 73 specify primitive
+machine arithmetic, native arrays, floats and strings. Every one of the 16
+postulating modules in the Agda standard library is a foreign-function or
+operating-system interface. A single figure hides which of the two you are
+looking at.
+
+## What it is not
+
+It does not read Lean or Metamath. [gonzalgo](https://pypi.org/project/gonzalgo/)
+and [mmforge](https://pypi.org/project/mmforge/) do that. This is a separate
+instrument for separate systems, not an extension of either.
+
+It measures at file or module granularity, not per theorem. A file requiring a
+module that declares an axiom inherits it whether or not any theorem in that
+file uses it, so every figure is an **upper bound on inheritance**, not a
+statement about use. `Print Assumptions` and `#print axioms` answer the
+per-theorem question and need a built library. This needs only the source,
+which is what makes a cross-system census tractable.
+
+## Reading the source correctly
+
+Three exclusions do real work, and each was derived from a failure rather than
+anticipated.
+
+**Rocq `Parameter` and `Hypothesis` are not axioms** inside a `Module Type` or
+`Section` — they are discharged. The Rocq standard library has 389 `Parameter`
+and 125 `Hypothesis` against 14 top-level `Axiom`; counting the former reports
+a library assuming five hundred things it does not.
+
+**Agda `postulate` must open a block.** `postulate[_|->_]` is a legal function
+*name*, and a word-boundary match counts it as an assumption.
+
+**Isabelle comments nest.** `(* outer (* inner *) still outer *)` is one
+comment; a non-greedy match closes it at the inner terminator and returns the
+rest as live code. On the Archive of Formal Proofs that single difference is 33
+reported `sorry` occurrences against 3.
+
+## The check that makes it trustworthy
+
+Agda's `{-# OPTIONS --safe #-}` is compiler-enforced and transitive: a safe
+module may not postulate and may not import a module that is not itself safe.
+The compiler has already computed the transitive answer, so `axsent agda`
+ends by checking itself against it. Any module reported as both `--safe` and
+reaching a postulate is a bug in this tool, not a finding about Agda.
+
+Nothing in Rocq, Isabelle, Lean or Metamath offers a comparable ground truth.
+Run the Agda census first for that reason alone.
+
+## Citation
+
+The method and the five-library census it produced:
+
+> Gonzalez, V. 2026. *Interface Assumptions Are Not Mathematical Assumptions:
+> An Axiom Census of Five Libraries Across Four Proof Systems.* Zenodo.
+> https://doi.org/10.5281/zenodo.22148932
+

axsent-0.1.0/README.md

@@ -0,0 +1,104 @@
+```
+╔════════════════════════════════════════════════════════════════════════════════════════════╗
+║                                                                                            ║
+║                     █████╗ ██╗  ██╗███████╗███████╗███╗   ██╗████████╗                     ║
+║                    ██╔══██╗╚██╗██╔╝██╔════╝██╔════╝████╗  ██║╚══██╔══╝                     ║
+║                    ███████║ ╚███╔╝ ███████╗█████╗  ██╔██╗ ██║   ██║                        ║
+║                    ██╔══██║ ██╔██╗ ╚════██║██╔══╝  ██║╚██╗██║   ██║                        ║
+║                    ██║  ██║██╔╝ ██╗███████║███████╗██║ ╚████║   ██║                        ║
+║                    ╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚══════╝╚═╝  ╚═══╝   ╚═╝                        ║
+║                                                                                            ║
+║                               what a formal library assumes                                ║
+║                                                                                            ║
+╚════════════════════════════════════════════════════════════════════════════════════════════╝
+```
+
+An accent is a dependence on something local that travels with whoever carries
+it. An inherited axiom is the same thing: a library speaks in the assumptions of
+wherever it came from, and most of what it carries it never chose.
+
+Rocq, Agda and Isabelle each let a development assert something without proving
+it, and each records the dependency edges that carry the assertion outward.
+`axsent` reads those declarations and those edges from source text, with no
+proof assistant installed and nothing built.
+
+```bash
+pip install axsent
+```
+
+```bash
+axsent rocq      path/to/stdlib/theories
+axsent agda      path/to/agda-stdlib/src
+axsent isabelle  path/to/afp/thys
+```
+
+## Why counts should not be totalled
+
+A library declares two kinds of assumption and both use the same keyword.
+
+**Mathematical** — excluded middle, choice, functional extensionality, proof
+irrelevance. Claims about mathematics. A result depending on one is classical
+rather than constructive.
+
+**Interface** — that native 63-bit arithmetic behaves as specified, that a
+mutable array returns what was written to it, that a foreign function returns
+what its type says. Claims about the machine and the runtime. A result
+depending on one is not thereby classical.
+
+Rocq's Corelib declares **five times** as many axioms as the Rocq standard
+library and makes no mathematical assumption at all: all 73 specify primitive
+machine arithmetic, native arrays, floats and strings. Every one of the 16
+postulating modules in the Agda standard library is a foreign-function or
+operating-system interface. A single figure hides which of the two you are
+looking at.
+
+## What it is not
+
+It does not read Lean or Metamath. [gonzalgo](https://pypi.org/project/gonzalgo/)
+and [mmforge](https://pypi.org/project/mmforge/) do that. This is a separate
+instrument for separate systems, not an extension of either.
+
+It measures at file or module granularity, not per theorem. A file requiring a
+module that declares an axiom inherits it whether or not any theorem in that
+file uses it, so every figure is an **upper bound on inheritance**, not a
+statement about use. `Print Assumptions` and `#print axioms` answer the
+per-theorem question and need a built library. This needs only the source,
+which is what makes a cross-system census tractable.
+
+## Reading the source correctly
+
+Three exclusions do real work, and each was derived from a failure rather than
+anticipated.
+
+**Rocq `Parameter` and `Hypothesis` are not axioms** inside a `Module Type` or
+`Section` — they are discharged. The Rocq standard library has 389 `Parameter`
+and 125 `Hypothesis` against 14 top-level `Axiom`; counting the former reports
+a library assuming five hundred things it does not.
+
+**Agda `postulate` must open a block.** `postulate[_|->_]` is a legal function
+*name*, and a word-boundary match counts it as an assumption.
+
+**Isabelle comments nest.** `(* outer (* inner *) still outer *)` is one
+comment; a non-greedy match closes it at the inner terminator and returns the
+rest as live code. On the Archive of Formal Proofs that single difference is 33
+reported `sorry` occurrences against 3.
+
+## The check that makes it trustworthy
+
+Agda's `{-# OPTIONS --safe #-}` is compiler-enforced and transitive: a safe
+module may not postulate and may not import a module that is not itself safe.
+The compiler has already computed the transitive answer, so `axsent agda`
+ends by checking itself against it. Any module reported as both `--safe` and
+reaching a postulate is a bug in this tool, not a finding about Agda.
+
+Nothing in Rocq, Isabelle, Lean or Metamath offers a comparable ground truth.
+Run the Agda census first for that reason alone.
+
+## Citation
+
+The method and the five-library census it produced:
+
+> Gonzalez, V. 2026. *Interface Assumptions Are Not Mathematical Assumptions:
+> An Axiom Census of Five Libraries Across Four Proof Systems.* Zenodo.
+> https://doi.org/10.5281/zenodo.22148932
+

axsent-0.1.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "axsent"
+version = "0.1.0"
+description = "Measure what a formal library assumes: Rocq, Agda and Isabelle, from source, with nothing built"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.9"
+authors = [{ name = "Vincent Gonzalez", email = "vincegonzalez@me.com" }]
+keywords = [
+    "axiom provenance",
+    "formal verification",
+    "proof assistants",
+    "Rocq",
+    "Agda",
+    "Isabelle",
+    "dependency analysis",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Science/Research",
+    "Programming Language :: Python :: 3",
+    "Topic :: Scientific/Engineering :: Mathematics",
+    "Topic :: Software Development :: Quality Assurance",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/vince-gonzalez/axsent"
+Paper = "https://doi.org/10.5281/zenodo.22148932"
+
+[project.scripts]
+axsent = "axsent.cli:main"
+
+[tool.setuptools]
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests"]

axsent-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

axsent-0.1.0/src/axsent/__init__.py

@@ -0,0 +1,70 @@
+"""Measure what a formal library assumes, in systems that are not Lean or Metamath.
+
+Rocq, Agda and Isabelle each let a development assert something without proving
+it, and each records the dependency edges that carry the assertion outward.
+This reads those declarations and those edges from source text, with no proof
+assistant installed and nothing built.
+
+    axsent rocq      <path>    top-level Axiom, via Require Import/Export
+    axsent agda      <path>    postulate blocks, via open import
+    axsent isabelle  <path>    axiomatization and sorry, via theory imports
+
+WHAT IT IS NOT
+
+It does not read Lean or Metamath; gonzalgo and mmforge do that, and this is a
+separate instrument for separate systems rather than an extension of either.
+
+It measures at file or module granularity, not per theorem. A file that
+requires a module declaring an axiom inherits it whether or not any theorem in
+that file uses it, so every figure is an upper bound on inheritance rather than
+a statement about use. `Print Assumptions` and `#print axioms` answer the
+per-theorem question and need a built library; this answers the per-file one
+and needs only the source, which is what makes a cross-system census possible
+at all.
+
+TWO POPULATIONS
+
+Counts produced here should not be totalled without separating them. A library
+declares assumptions about mathematics -- excluded middle, choice, functional
+extensionality -- and assumptions about its interfaces -- that native 63-bit
+arithmetic behaves as specified, that a foreign function returns what its type
+says. Both use the same keyword and both are counted by the same tools. Rocq's
+Corelib declares five times as many axioms as the Rocq standard library and
+makes no mathematical assumption at all.
+
+Reference: Gonzalez, V. 2026. "Interface Assumptions Are Not Mathematical
+Assumptions: An Axiom Census of Five Libraries Across Four Proof Systems."
+https://doi.org/10.5281/zenodo.22148932
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+__version__ = "0.1.0"
+
+PAPER_DOI = "10.5281/zenodo.22148932"
+
+
+def open_source_tree(path) -> Path:
+    """Resolve a corpus path, or exit with a message rather than a traceback.
+
+    A wrong path is the most likely thing to go wrong when one of these runs
+    unattended, and a stack trace ending in FileNotFoundError buries the only
+    fact the operator needs.
+    """
+    p = Path(path)
+    if not p.exists():
+        raise SystemExit(f"no such path: {p}")
+    if not p.is_dir():
+        raise SystemExit(f"not a directory: {p}")
+    return p
+
+
+def pct(n, d, places=1):
+    """A percentage, or "n/a" when there is nothing to divide by.
+
+    An empty or partial corpus is a legitimate input -- a stub checkout, a
+    subdirectory, a library whose sources have not been fetched. Reporting that
+    nothing was found is a result, not a reason to divide by zero.
+    """
+    return f"{n / d:.{places}%}" if d else "n/a"

axsent-0.1.0/src/axsent/agda.py

@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+r"""What does the Agda standard library assume, and where?
+
+    python agda_axioms.py /path/to/agda-stdlib/src
+
+Agda's assumption is the `postulate`: a name given a type and no definition.
+Its unsafe surface is wider than that -- `primTrustMe`, `unsafeCoerce`, and the
+`TERMINATING` pragma each let something through the checker that the checker did
+not establish.
+
+WHY THIS LIBRARY IS THE ONE WORTH MEASURING
+
+Agda has `{-# OPTIONS --safe #-}`, and the compiler enforces it: a module
+declared safe may not postulate, may not use the unsafe primitives, and may not
+import a module that is not itself safe. That last clause is the useful part.
+It means the compiler has already computed the transitive answer, so a textual
+analysis can be checked against ground truth rather than argued about.
+
+Any file this reports as both `--safe` and reaching a postulate is a bug in
+this script, not a finding about Agda. That check runs at the end and is the
+only reason to trust the rest of the output.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+from . import open_source_tree
+
+BLOCK = re.compile(r"\{-(?!#).*?-\}", re.S)      # {- ... -} but not pragmas
+LINE = re.compile(r"(?<!-)--(?!\})[^\n]*")        # -- to end of line
+IMPORT = re.compile(r"^\s*(?:open\s+)?import\s+([\w.']+)", re.M)
+# "postulate" opens a block only when nothing follows it on the line.
+# `postulate[_|->_]` is a legal function NAME in Agda, and \b matches between
+# the "e" and the "[", so \b counts a definition as an assumption.
+POSTULATE = re.compile(r"^[ \t]*postulate[ \t]*(?:$|--)", re.M)
+OPTIONS = re.compile(r"\{-#\s*OPTIONS([^#]*)#-\}")
+UNSAFE_TOKENS = ("primTrustMe", "unsafeCoerce", "TERMINATING")
+
+
+def strip(text):
+    """Remove comments so a word in prose is not read as code."""
+    return LINE.sub(" ", BLOCK.sub(" ", text))
+
+
+def load(root: Path):
+    mods, raw, code = {}, {}, {}
+    for p in sorted(root.rglob("*.agda")):
+        mod = ".".join(p.relative_to(root).with_suffix("").parts)
+        mods[mod] = p
+        t = p.read_text(encoding="utf-8", errors="replace")
+        raw[mod] = t
+        code[mod] = strip(t)
+    return mods, raw, code
+
+
+def main() -> None:
+    root = open_source_tree(sys.argv[1])
+    mods, raw, code = load(root)
+    print(f"   {len(mods)} modules under {root}")
+
+    safe, opts = {}, {}
+    for m, t in raw.items():
+        o = " ".join(x.group(1) for x in OPTIONS.finditer(t))
+        opts[m] = o
+        safe[m] = "--safe" in o
+    print(f"   {sum(safe.values())} declare --safe "
+          f"({sum(safe.values())/len(mods):.1%})")
+
+    posts = {m for m, c in code.items() if POSTULATE.search(c)}
+    unsafe_prim = {m for m, c in code.items()
+                   if any(tok in c for tok in UNSAFE_TOKENS)}
+    print(f"   {len(posts)} modules postulate; "
+          f"{len(unsafe_prim)} use primTrustMe / unsafeCoerce / TERMINATING")
+    print()
+
+    known = set(mods)
+    deps = {}
+    for m, c in code.items():
+        deps[m] = {i for i in IMPORT.findall(c) if i in known}
+
+    sys.setrecursionlimit(30000)
+    reach = {}
+
+    def visit(m, stack=()):
+        if m in reach:
+            return reach[m]
+        if m in stack:
+            return set()
+        got = {m} if m in posts else set()
+        for d in deps.get(m, ()):
+            got |= visit(d, stack + (m,))
+        reach[m] = got
+        return got
+
+    for m in mods:
+        visit(m)
+
+    touched = [m for m in mods if reach[m]]
+    print(f"   {len(touched)} of {len(mods)} modules ({len(touched)/len(mods):.1%}) "
+          f"transitively import a postulate")
+    print()
+
+    below = {}
+    for m in mods:
+        for r in reach[m]:
+            below.setdefault(r, set()).add(m)
+    print(f"   {'module that postulates':<52}{'safe?':>7}{'below':>7}")
+    print("   " + "-" * 68)
+    for r, users in sorted(below.items(), key=lambda kv: -len(kv[1])):
+        print(f"   {r:<52}{('yes' if safe[r] else 'no'):>7}{len(users):>7}")
+
+    # ---- the check that makes the rest trustworthy --------------------
+    print()
+    contradictions = [m for m in mods if safe[m] and reach[m]]
+    if contradictions:
+        print(f"   INSTRUMENT FAILS: {len(contradictions)} modules are --safe "
+              f"yet reach a postulate. Agda forbids that, so this is my bug.")
+        for m in contradictions[:10]:
+            print(f"      {m}  ->  {', '.join(sorted(reach[m]))[:70]}")
+    else:
+        print("   CHECK PASSES: no --safe module reaches a postulate, which is "
+              "what the Agda compiler guarantees.")
+
+
+if __name__ == "__main__":
+    main()

axsent-0.1.0/src/axsent/cli.py

@@ -0,0 +1,59 @@
+"""axsent command line.
+
+    axsent <system> <path> [options]
+    axsent <system> --help
+
+Each subcommand is a reader for one proof assistant. They share a shape --
+find what is asserted without proof, follow the dependency edges, report how
+far each assertion reaches -- but nothing else, because the three systems have
+no syntax in common.
+"""
+from __future__ import annotations
+
+import sys
+
+from . import __doc__ as PACKAGE_DOC
+from . import __version__, PAPER_DOI
+
+COMMANDS = {
+    "rocq": ("rocq", "top-level Axiom, followed through Require Import/Export"),
+    "agda": ("agda", "postulate blocks, checked against the --safe flag"),
+    "isabelle": ("isabelle", "axiomatization and sorry, across theory imports"),
+}
+
+
+def usage(code: int = 0) -> None:
+    print(PACKAGE_DOC.strip().split("\n\n")[0])
+    print()
+    print("usage: axsent <system> <path>")
+    print("       axsent <system> --help")
+    print()
+    width = max(len(c) for c in COMMANDS)
+    for name, (_mod, summary) in COMMANDS.items():
+        print(f"  {name:<{width}}  {summary}")
+    print()
+    print("Counts of mathematical and interface assumptions should not be")
+    print(f"totalled together. See doi:{PAPER_DOI}")
+    sys.exit(code)
+
+
+def main() -> None:
+    if len(sys.argv) < 2 or sys.argv[1] in ("-h", "--help", "help"):
+        usage(0)
+    name = sys.argv[1]
+    if name in ("-V", "--version"):
+        print(f"axsent {__version__}")
+        sys.exit(0)
+    if name not in COMMANDS:
+        print(f"axsent: unknown system {name!r}\n", file=sys.stderr)
+        usage(2)
+
+    module_name, _ = COMMANDS[name]
+    import importlib
+    mod = importlib.import_module(f".{module_name}", package="axsent")
+    sys.argv = [f"axsent {name}"] + sys.argv[2:]
+    mod.main()
+
+
+if __name__ == "__main__":
+    main()

axsent-0.1.0/src/axsent/isa_strip.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+r"""Strip Isabelle comments, documentation and string literals properly.
+
+Isabelle comments NEST:  (* outer (* inner *) still outer *)
+
+A non-greedy regex closes the outer comment at the inner comment's terminator
+and hands back the remainder as live code. That is how a commented-out block
+containing `sorry` gets reported as an admitted proof in a refereed archive.
+Depth counting is the only thing that reads this correctly.
+
+Also removed:
+  \<open> ... \<close>   text cartouches -- Isabelle's documentation syntax, and
+                        where most prose discussing `sorry` actually lives
+  "..."                 string literals -- one AFP entry searches HOL.thy for
+                        the literal word "sorry" as a test of its string matcher
+"""
+from __future__ import annotations
+
+OPEN, CLOSE = "(*", "*)"
+COPEN, CCLOSE = "\\<open>", "\\<close>"
+
+
+def strip(text: str) -> str:
+    out = []
+    i, n = 0, len(text)
+    depth = 0        # nested (* *)
+    cart = 0         # nested \<open> \<close>
+    in_str = False
+    while i < n:
+        if not in_str and text.startswith(OPEN, i):
+            depth += 1
+            i += 2
+            continue
+        if depth and text.startswith(CLOSE, i):
+            depth -= 1
+            i += 2
+            out.append(" ")
+            continue
+        if depth:
+            i += 1
+            continue
+        if text.startswith(COPEN, i):
+            cart += 1
+            i += len(COPEN)
+            continue
+        if cart and text.startswith(CCLOSE, i):
+            cart -= 1
+            i += len(CCLOSE)
+            out.append(" ")
+            continue
+        if cart:
+            i += 1
+            continue
+        c = text[i]
+        if c == '"' and (i == 0 or text[i - 1] != "\\"):
+            in_str = not in_str
+            out.append(" ")
+            i += 1
+            continue
+        out.append(" " if in_str else c)
+        i += 1
+    return "".join(out)

axsent-0.1.0/src/axsent/isabelle.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+r"""What does the Archive of Formal Proofs assume, and what is unfinished in it?
+
+    python afp_axioms.py /path/to/afp/thys
+
+The AFP is a curated, refereed archive: every entry is built and checked by the
+Isabelle release process. That makes two questions worth asking of it that are
+not worth asking of an ordinary library.
+
+  `axiomatization`  Isabelle's way of asserting something without proof. An AFP
+                    entry that axiomatizes is adding to the trusted base of
+                    anything that imports it. Isabelle/HOL's own axioms are not
+                    in scope here; this counts what the ARCHIVE adds on top.
+
+  `sorry`           an admitted proof. Isabelle accepts it, marks the result,
+                    and carries on. A `sorry` anywhere upstream means a theorem
+                    that looks proved is not, which is exactly the failure mode
+                    a provenance tool exists to catch, and exactly the one that
+                    a green build does not reveal.
+
+Comments are stripped before counting, because "sorry" and "axiomatization"
+both appear in prose discussing them, and counting those would inflate every
+number here. Occurrences inside string literals are left, which biases the
+counts slightly upward -- the report says which files so they can be read.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+from .isa_strip import strip as isa_strip
+from . import open_source_tree
+
+COMMENT = re.compile(r"\(\*.*?\*\)", re.S)
+# a theory header: theory NAME imports A B C begin
+IMPORTS = re.compile(r"\btheory\s+([\w.']+)\s+imports\s+(.*?)\bbegin\b", re.S)
+AXIOMATIZATION = re.compile(r"(?<![\w'])axiomatization(?![\w'])")
+SORRY = re.compile(r"(?<![\w'])sorry(?![\w'])")
+OOPS = re.compile(r"(?<![\w'])oops(?![\w'])")
+CONSTS = re.compile(r"^\s*consts(?![\w'])", re.M)
+
+
+def main() -> None:
+    root = open_source_tree(sys.argv[1])
+    files = sorted(root.rglob("*.thy"))
+    print(f"   {len(files):,} theory files under {root}")
+
+    ax_files, sorry_files, oops_files, consts_files = {}, {}, {}, {}
+    entries = Counter()
+    total = Counter()
+
+    for p in files:
+        raw = p.read_text(encoding="utf-8", errors="replace")
+        # only pay for the depth-counting strip when a keyword is present
+        if any(k in raw for k in ("sorry", "axiomatization", "oops", "consts")):
+            code = isa_strip(raw)
+        else:
+            code = raw
+        rel = p.relative_to(root)
+        entry = rel.parts[0] if len(rel.parts) > 1 else "(top)"
+        entries[entry] += 1
+
+        n_ax = len(AXIOMATIZATION.findall(code))
+        n_sorry = len(SORRY.findall(code))
+        n_oops = len(OOPS.findall(code))
+        n_consts = len(CONSTS.findall(code))
+        total["axiomatization"] += n_ax
+        total["sorry"] += n_sorry
+        total["oops"] += n_oops
+        total["consts"] += n_consts
+        if n_ax:
+            ax_files[str(rel)] = n_ax
+        if n_sorry:
+            sorry_files[str(rel)] = n_sorry
+        if n_oops:
+            oops_files[str(rel)] = n_oops
+        if n_consts:
+            consts_files[str(rel)] = n_consts
+
+    print(f"   {len(entries):,} entries")
+    print()
+    print(f"   {'construct':<18}{'occurrences':>13}{'files':>8}{'entries':>9}")
+    print("   " + "-" * 50)
+    for name, d in (("axiomatization", ax_files), ("sorry", sorry_files),
+                    ("oops", oops_files), ("consts", consts_files)):
+        ents = {f.split("/")[0].split("\\")[0] for f in d}
+        print(f"   {name:<18}{total[name]:>13,}{len(d):>8,}{len(ents):>9,}")
+
+    for title, d in (("entries that axiomatize", ax_files),
+                     ("files containing sorry", sorry_files)):
+        print()
+        print(f"   {title}")
+        print("   " + "-" * 66)
+        for f, n in sorted(d.items(), key=lambda kv: -kv[1])[:18]:
+            print(f"   {n:>4}  {f}")
+        if len(d) > 18:
+            print(f"         ... and {len(d)-18} more")
+
+
+if __name__ == "__main__":
+    main()

axsent-0.1.0/src/axsent/rocq.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+r"""Where does the Rocq standard library spend its axioms?
+
+    python rocq_axioms.py /path/to/stdlib/theories
+
+Rocq is constructive by default. Excluded middle, choice, functional
+extensionality and proof irrelevance are not available unless a file asks for
+them, and asking is a visible act: `Require Import` of a module that declares
+them. That makes the question "what does this result assume" answerable from
+the source, without building anything.
+
+WHAT COUNTS AS AN AXIOM
+
+Only a top-level `Axiom`. `Parameter` and `Hypothesis` inside a `Module Type`
+or a `Section` are discharged when the module is instantiated or the section
+closes; they are interface obligations, not assumptions the library makes. A
+census that counts them reports a library assuming several hundred things it
+does not assume. Depth is tracked so they can be excluded rather than guessed
+at.
+
+WHAT THIS DOES NOT DO
+
+This is module-level, not theorem-level. A file that requires
+`Logic.Classical` inherits the axiom whether or not any theorem in it uses
+excluded middle, so the counts below are an upper bound on what actually rests
+on the axiom. `Print Assumptions` answers the per-theorem question and needs a
+built library; this answers the per-file one and needs only the source.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from collections import defaultdict, deque
+from pathlib import Path
+from . import open_source_tree
+
+AXIOM = re.compile(r"^\s*Axiom\s+([A-Za-z_][A-Za-z0-9_']*)", re.M)
+OPEN = re.compile(r"^\s*(Module\s+Type\b|Module\b|Section\b)", re.M)
+CLOSE = re.compile(r"^\s*End\b", re.M)
+# "Require Import A.B C." / "Require Export A." / "From X Require Import Y."
+REQUIRE = re.compile(
+    r"^\s*(?:From\s+([\w.]+)\s+)?Require\s+(?:Import|Export)?\s*([^.]*)\.",
+    re.M)
+COMMENT = re.compile(r"\(\*.*?\*\)", re.S)
+
+
+def toplevel_axioms(text):
+    """Axioms declared at depth 0, i.e. not inside a Module Type or Section."""
+    depth = 0
+    found = []
+    events = []
+    for m in OPEN.finditer(text):
+        events.append((m.start(), +1, None))
+    for m in CLOSE.finditer(text):
+        events.append((m.start(), -1, None))
+    for m in AXIOM.finditer(text):
+        events.append((m.start(), 0, m.group(1)))
+    for _pos, kind, name in sorted(events):
+        if kind == 0:
+            if depth == 0:
+                found.append(name)
+        else:
+            depth = max(0, depth + kind)
+    return found
+
+
+def load(root: Path):
+    files, text = {}, {}
+    for p in sorted(root.rglob("*.v")):
+        rel = p.relative_to(root)
+        mod = ".".join(rel.with_suffix("").parts)
+        files[mod] = p
+        text[mod] = COMMENT.sub(" ", p.read_text(encoding="utf-8", errors="replace"))
+    return files, text
+
+
+def requires(text, known):
+    """Modules this file requires, resolved against what exists."""
+    out = set()
+    for m in REQUIRE.finditer(text):
+        prefix, body = m.group(1), m.group(2)
+        for tok in body.replace("\n", " ").split():
+            if not re.match(r"^[\w.]+$", tok):
+                continue
+            cands = [tok]
+            if prefix:
+                cands.append(prefix + "." + tok)
+            # Rocq module paths drop the library root; match on any suffix
+            for c in cands:
+                tail = c.split(".")
+                for k in known:
+                    if k.split(".")[-len(tail):] == tail:
+                        out.add(k)
+    return out
+
+
+def main() -> None:
+    root = open_source_tree(sys.argv[1])
+    files, text = load(root)
+    known = set(files)
+    print(f"   {len(files)} files under {root}")
+
+    declares = {m: toplevel_axioms(t) for m, t in text.items()}
+    roots = {m: a for m, a in declares.items() if a}
+    total_axioms = sum(len(a) for a in roots.values())
+    print(f"   {total_axioms} top-level Axiom declarations in {len(roots)} files")
+
+    deps = {m: requires(t, known) for m, t in text.items()}
+
+    # who reaches an axiom-declaring file
+    reach = {}
+
+    def visit(m, stack=()):
+        if m in reach:
+            return reach[m]
+        if m in stack:
+            return set()
+        got = set(roots.get(m, ()) and [m] or [])
+        for d in deps.get(m, ()):
+            got |= visit(d, stack + (m,))
+        reach[m] = got
+        return got
+
+    sys.setrecursionlimit(20000)
+    for m in files:
+        visit(m)
+
+    touched = [m for m in files if reach[m]]
+    print(f"   {len(touched)} of {len(files)} files "
+          f"({len(touched)/len(files):.1%}) transitively require an axiom file")
+    print()
+
+    # which axiom source is inherited most widely
+    below = defaultdict(set)
+    for m in files:
+        for r in reach[m]:
+            below[r].add(m)
+    print(f"   {'axiom-declaring file':<44}{'axioms':>7}{'files below':>13}")
+    print("   " + "-" * 66)
+    for r, users in sorted(below.items(), key=lambda kv: -len(kv[1])):
+        print(f"   {r:<44}{len(roots[r]):>7}{len(users):>13}")
+    print()
+    print("   the axioms themselves, by file")
+    for r in sorted(roots, key=lambda r: -len(below[r])):
+        print(f"   {r}")
+        print(f"      {', '.join(sorted(roots[r]))[:200]}")
+
+
+if __name__ == "__main__":
+    main()

axsent-0.1.0/src/axsent.egg-info/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: axsent
+Version: 0.1.0
+Summary: Measure what a formal library assumes: Rocq, Agda and Isabelle, from source, with nothing built
+Author-email: Vincent Gonzalez <vincegonzalez@me.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/vince-gonzalez/axsent
+Project-URL: Paper, https://doi.org/10.5281/zenodo.22148932
+Keywords: axiom provenance,formal verification,proof assistants,Rocq,Agda,Isabelle,dependency analysis
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Scientific/Engineering :: Mathematics
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+```
+╔════════════════════════════════════════════════════════════════════════════════════════════╗
+║                                                                                            ║
+║                     █████╗ ██╗  ██╗███████╗███████╗███╗   ██╗████████╗                     ║
+║                    ██╔══██╗╚██╗██╔╝██╔════╝██╔════╝████╗  ██║╚══██╔══╝                     ║
+║                    ███████║ ╚███╔╝ ███████╗█████╗  ██╔██╗ ██║   ██║                        ║
+║                    ██╔══██║ ██╔██╗ ╚════██║██╔══╝  ██║╚██╗██║   ██║                        ║
+║                    ██║  ██║██╔╝ ██╗███████║███████╗██║ ╚████║   ██║                        ║
+║                    ╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚══════╝╚═╝  ╚═══╝   ╚═╝                        ║
+║                                                                                            ║
+║                               what a formal library assumes                                ║
+║                                                                                            ║
+╚════════════════════════════════════════════════════════════════════════════════════════════╝
+```
+
+An accent is a dependence on something local that travels with whoever carries
+it. An inherited axiom is the same thing: a library speaks in the assumptions of
+wherever it came from, and most of what it carries it never chose.
+
+Rocq, Agda and Isabelle each let a development assert something without proving
+it, and each records the dependency edges that carry the assertion outward.
+`axsent` reads those declarations and those edges from source text, with no
+proof assistant installed and nothing built.
+
+```bash
+pip install axsent
+```
+
+```bash
+axsent rocq      path/to/stdlib/theories
+axsent agda      path/to/agda-stdlib/src
+axsent isabelle  path/to/afp/thys
+```
+
+## Why counts should not be totalled
+
+A library declares two kinds of assumption and both use the same keyword.
+
+**Mathematical** — excluded middle, choice, functional extensionality, proof
+irrelevance. Claims about mathematics. A result depending on one is classical
+rather than constructive.
+
+**Interface** — that native 63-bit arithmetic behaves as specified, that a
+mutable array returns what was written to it, that a foreign function returns
+what its type says. Claims about the machine and the runtime. A result
+depending on one is not thereby classical.
+
+Rocq's Corelib declares **five times** as many axioms as the Rocq standard
+library and makes no mathematical assumption at all: all 73 specify primitive
+machine arithmetic, native arrays, floats and strings. Every one of the 16
+postulating modules in the Agda standard library is a foreign-function or
+operating-system interface. A single figure hides which of the two you are
+looking at.
+
+## What it is not
+
+It does not read Lean or Metamath. [gonzalgo](https://pypi.org/project/gonzalgo/)
+and [mmforge](https://pypi.org/project/mmforge/) do that. This is a separate
+instrument for separate systems, not an extension of either.
+
+It measures at file or module granularity, not per theorem. A file requiring a
+module that declares an axiom inherits it whether or not any theorem in that
+file uses it, so every figure is an **upper bound on inheritance**, not a
+statement about use. `Print Assumptions` and `#print axioms` answer the
+per-theorem question and need a built library. This needs only the source,
+which is what makes a cross-system census tractable.
+
+## Reading the source correctly
+
+Three exclusions do real work, and each was derived from a failure rather than
+anticipated.
+
+**Rocq `Parameter` and `Hypothesis` are not axioms** inside a `Module Type` or
+`Section` — they are discharged. The Rocq standard library has 389 `Parameter`
+and 125 `Hypothesis` against 14 top-level `Axiom`; counting the former reports
+a library assuming five hundred things it does not.
+
+**Agda `postulate` must open a block.** `postulate[_|->_]` is a legal function
+*name*, and a word-boundary match counts it as an assumption.
+
+**Isabelle comments nest.** `(* outer (* inner *) still outer *)` is one
+comment; a non-greedy match closes it at the inner terminator and returns the
+rest as live code. On the Archive of Formal Proofs that single difference is 33
+reported `sorry` occurrences against 3.
+
+## The check that makes it trustworthy
+
+Agda's `{-# OPTIONS --safe #-}` is compiler-enforced and transitive: a safe
+module may not postulate and may not import a module that is not itself safe.
+The compiler has already computed the transitive answer, so `axsent agda`
+ends by checking itself against it. Any module reported as both `--safe` and
+reaching a postulate is a bug in this tool, not a finding about Agda.
+
+Nothing in Rocq, Isabelle, Lean or Metamath offers a comparable ground truth.
+Run the Agda census first for that reason alone.
+
+## Citation
+
+The method and the five-library census it produced:
+
+> Gonzalez, V. 2026. *Interface Assumptions Are Not Mathematical Assumptions:
+> An Axiom Census of Five Libraries Across Four Proof Systems.* Zenodo.
+> https://doi.org/10.5281/zenodo.22148932
+

axsent-0.1.0/src/axsent.egg-info/SOURCES.txt

@@ -0,0 +1,15 @@
+LICENSE
+README.md
+pyproject.toml
+src/axsent/__init__.py
+src/axsent/agda.py
+src/axsent/cli.py
+src/axsent/isa_strip.py
+src/axsent/isabelle.py
+src/axsent/rocq.py
+src/axsent.egg-info/PKG-INFO
+src/axsent.egg-info/SOURCES.txt
+src/axsent.egg-info/dependency_links.txt
+src/axsent.egg-info/entry_points.txt
+src/axsent.egg-info/top_level.txt
+tests/test_readers.py

axsent-0.1.0/src/axsent.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

axsent-0.1.0/src/axsent.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+axsent = axsent.cli:main

axsent-0.1.0/src/axsent.egg-info/top_level.txt

@@ -0,0 +1 @@
+axsent

axsent-0.1.0/tests/test_readers.py

@@ -0,0 +1,103 @@
+"""The three exclusions that do real work, and the degenerate inputs.
+
+Every case here was a wrong answer this tool gave before it was corrected, so
+each test is a regression rather than a hypothetical. Two of them come from
+reading a refereed archive and reporting defects that were not there.
+"""
+import pytest
+
+from axsent import open_source_tree, pct
+from axsent.isa_strip import strip as isa_strip
+from axsent.rocq import toplevel_axioms
+from axsent.agda import POSTULATE
+
+
+# --- Rocq: Module Type and Section obligations are not assumptions ---------
+
+def test_toplevel_axiom_is_counted():
+    assert toplevel_axioms("Axiom classic : forall P:Prop, P \\/ ~ P.") == ["classic"]
+
+
+def test_axiom_inside_module_type_is_not_counted():
+    src = """
+Module Type Specification.
+  Axiom archimedean : something.
+  Axiom algebraic : something_else.
+End Specification.
+Module Implementation : Specification.
+End Implementation.
+"""
+    assert toplevel_axioms(src) == []
+
+
+def test_axiom_after_a_closed_section_is_counted_again():
+    src = """
+Section S.
+  Axiom hidden : thing.
+End S.
+Axiom visible : thing.
+"""
+    assert toplevel_axioms(src) == ["visible"]
+
+
+# --- Agda: postulate must open a block ------------------------------------
+
+def test_postulate_block_is_matched():
+    assert POSTULATE.search("postulate\n  pure : A -> IO A\n")
+
+
+def test_postulate_in_a_function_name_is_not_matched():
+    """`postulate[_|->_]` is a legal Agda name; \\b matches inside it."""
+    src = "postulate[_↦_] : forall {a b} -> A -> B\n"
+    assert not POSTULATE.search(src)
+
+
+# --- Isabelle: comments nest ----------------------------------------------
+
+def test_nested_comment_is_fully_removed():
+    """A non-greedy match closes the outer comment at the inner terminator
+    and hands back `sorry` as live code. On the AFP that was 33 against 3."""
+    src = "(* outer (* FIXME inner *) lemma x: y sorry *) real_code"
+    out = isa_strip(src)
+    assert "sorry" not in out
+    assert "real_code" in out
+
+
+def test_documentation_cartouche_is_removed():
+    src = "text \\<open>we did not want a sorry in this file\\<close> real_code"
+    out = isa_strip(src)
+    assert "sorry" not in out
+    assert "real_code" in out
+
+
+def test_string_literal_is_removed():
+    """One AFP entry searches HOL.thy for the literal word as a test."""
+    src = 'val test = kmp "sorry" (File.read x) real_code'
+    assert "sorry" not in isa_strip(src)
+
+
+def test_live_code_survives_stripping():
+    src = "lemma a: b\n  sorry\n"
+    assert "sorry" in isa_strip(src)
+
+
+# --- degenerate inputs -----------------------------------------------------
+
+def test_pct_does_not_divide_by_zero():
+    assert pct(0, 0) == "n/a"
+    assert pct(3, 0) == "n/a"
+    assert pct(1, 4) == "25.0%"
+
+
+def test_missing_path_is_a_message_not_a_traceback(tmp_path):
+    with pytest.raises(SystemExit) as e:
+        open_source_tree(tmp_path / "nope")
+    assert "no such path" in str(e.value)
+
+
+def test_file_instead_of_directory_is_a_message(tmp_path):
+    f = tmp_path / "a.v"
+    f.write_text("Axiom x : y.", encoding="utf-8")
+    with pytest.raises(SystemExit) as e:
+        open_source_tree(f)
+    assert "not a directory" in str(e.value)