---
格式版本: 2
标题: "Contract-Aware Rescue of a Drifted Isabelle Development: The Double-Tank Case Study"
原文链接: "https://arxiv.org/abs/2608.18822"
发布日期: "2026-08-19"
发布时间校准状态: "found"
发布时间需复核: "否"
发布时间来源: "rule:local:strict_original_body"
发布时间证据: "**\\[v1\\]** Wed, 19 Aug 2026 11:23:33 UTC (35 KB)"
发布时间校准原因: "规则确认唯一严格发布时间，来源 local:strict_original_body"
发布时间校准置信度: "high"
发布时间候选数量: 18
发布时间严格候选数量: 6
发布时间原页读取状态: "source template page reused from URL open"
发布时间未找到原因: ""
发布时间校准时间: "2026-08-20T14:41:40+08:00"
发布时间仲裁状态: "skipped"
发布时间仲裁尝试次数: 0
发布时间仲裁耗时毫秒: 0
发现时间: "2026-08-20T14:38:42+08:00"
入库时间: "2026-08-20T06:41:40.813Z"
来源平台: "arXiv 学术论文搜索"
搜索渠道: "source_template"
搜索词: "https://arxiv.org/search/?query=Oracle&searchtype=all"
匹配关键词:
  []
相关厂家:
  - "Oracle"
相关专家:
  []
内容类型: "网页"
抓取工具: "Free Fetch + Defuddle"
清洗工具: "Defuddle Markdown + Defuddle/Readability 正文提取"
原始附件:
  []
AI优质: "否"
AI打分: 5
AI分档: "非优质"
AI质检状态: "不通过"
AI打分理由: "论文为软件工程形式化验证研究，涉及Isabelle定理证明，与超节点/AI Rack/机柜级AI基础设施完全无关，无任何相关技术或商业信号。"
AI质检模型: "ali-deepseek-v4-flash"
AI质检时间: "2026-08-20T14:43:00+08:00"
AI主题相关性: 0
AI来源权威性: 5
AI新颖性: 0
AI技术细节: 0
AI商业部署信号: 0
AI完整性: 5
AI摘要: "一项针对Isabelle双罐控制器开发的研究发现，大语言模型提议的证明虽能通过构建，但审计显示100个原始声明中16个被实质性改变，包括弱化的端到端保证定理。"
AI摘要模型: "ali-deepseek-v4-flash"
AI摘要时间: "2026-09-07T03:19:16.520Z"
采集批次: "2026年8月20日14点19分32秒"
采集批次ID: "20260820-141932-079"
去重键: "https://arxiv.org/abs/2608.18822"
---

## Computer Science > Software Engineering

## Title:Contract-Aware Rescue of a Drifted Isabelle Development: The Double-Tank Case Study

Authors:[Jim Woodcock](https://arxiv.org/search/cs?searchtype=author&query=Woodcock,+J), [Gabriel Leite](https://arxiv.org/search/cs?searchtype=author&query=Leite,+G), [Augusto Sampaio](https://arxiv.org/search/cs?searchtype=author&query=Sampaio,+A), [Ran Wei](https://arxiv.org/search/cs?searchtype=author&query=Wei,+R)

[View PDF](https://arxiv.org/pdf/2608.18822) [HTML (experimental)](https://arxiv.org/html/2608.18822v1)

> Abstract:Large language models can propose proofs for interactive theorem provers, but a successful build does not show the surrounding verification task was preserved. We study this problem in an Isabelle development of a sampled-data double-tank controller. The work began with nine theories and ten unfinished obligations, grew to a 16-theory build without sorry, oops, added axiomatisation, or oracle use, and accumulated 23 stable and 36 broken proof states. A retrospective audit found material changes in 16 of the 100 original declarations, including a weakened end-to-end assurance theorem that assumed three of the four requirements in its conclusion. We used CAPRI, a contract-aware proof-repair tool, to govern a reconstruction by combining Isabelle acceptance with an independent check of repository changes against machine-readable edit contracts. The reconstruction discharged all ten scoped obligations within the original nine-theory structure. A secondary replay by a co-author reproduced the R10 build, contract checks, control tests, and principal audit findings; independent replication remains future work. Operational end-to-end verification remains incomplete: we still need to connect operational executions to the reconstructed quantitative trace contract, a task requiring an extended contract.

| Comments: |  |
| --- | --- |
| Subjects: | Software Engineering (cs.SE) |
| Cite as: | [arXiv:2608.18822](https://arxiv.org/abs/2608.18822) \[cs.SE\] |
|  | (or [arXiv:2608.18822v1](https://arxiv.org/abs/2608.18822v1) \[cs.SE\] for this version) |
|  | [https://doi.org/10.48550/arXiv.2608.18822](https://doi.org/10.48550/arXiv.2608.18822) |

## Submission history

From: Jim Woodcock FREng \[[view email](https://arxiv.org/show-email/93e724b9/2608.18822)\]  
**\[v1\]** Wed, 19 Aug 2026 11:23:33 UTC (35 KB)

[Which authors of this paper are endorsers?](https://arxiv.org/auth/show-endorsers/2608.18822) | Disable MathJax ([What is MathJax?](https://info.arxiv.org/help/mathjax.html))