Postmortem for Kernel Soundness Bug #14576 — Leonardo de Moura

A scene: The Lean kernel bug 14576 was reported on July 25 by Ramana Kumar when he posted a “sorry‑free” Collatz disproof produced with AI. The proof exploited a flaw in the kernel’s handling of nested inductive types: phantom parameters disappeared from an auxiliary type, letting an ill‑typed argument become type‑checked as a proof of False. On July 28 Kiran Gopinathan reduced the exploit to a minimal counterexample and opened issue #14576. We pushed a patch (#14577) within an hour, and Joachim Breitner reviewed it, suggesting improvements that were merged. New releases follow.

Why nanoda missed it: nanoda, a Rust‑based independent kernel by Chris Bailey, caught the missing check but had a separate bug. The Collatz repo also passed a week‑old nanoda, so the attack required two distinct bugs. The bug is reachable only via metaprogramming, and merely limiting that feature is not a solution; the kernel must reject ill‑typed declarations itself.

Ongoing resilience: regression tests, additional hardening PRs (#14607–#14616, #14621, #14631, #14632) and daily nanoda integration keep the system robust. We invite experts to help find more bugs and develop verified kernels.