{
  "format": "quorum-sandwich-proof/v1",
  "title": "Can Two Majorities Order Different Sandwiches?",
  "checked_at": "2026-07-20",
  "lean": {
    "version": "4.30.0",
    "target": "x86_64-unknown-linux-gnu",
    "commit": "d024af099ca4bf2c86f649261ebf59565dc8c622",
    "toolchain": "leanprover/lean4:v4.30.0"
  },
  "validation_environment": {
    "container": "ghcr.io/leanprover-community/mathlib4/lean@sha256:83140e22981b3db35e15476380ea629061408c20baa9dc9f81c69eac81c19210",
    "note": "The pinned container supplied Elan; Elan installed the pinned Lean toolchain into a persistent validation container."
  },
  "model": {
    "voters": 5,
    "certificate_threshold": 3,
    "signature_variables": 10,
    "boolean_assignments": 1024,
    "same_term_rule": "No voter signs both values."
  },
  "theorems": [
    {
      "name": "majority_quorums_intersect",
      "claim": "Every pair of 3-of-5 quorums shares at least one voter."
    },
    {
      "name": "conflicting_majority_certificates_are_impossible",
      "claim": "Under the no-double-signing rule, two conflicting values cannot both hold a 3-of-5 certificate."
    },
    {
      "name": "two_of_five_can_split",
      "claim": "Two disjoint 2-of-5 signature groups exist."
    },
    {
      "name": "double_signing_allows_two_majorities",
      "claim": "Two 3-of-5 certificates can coexist when their shared voter signs both values."
    }
  ],
  "files": {
    "QuorumSandwich.lean": {
      "sha256": "3fff43fc5ef6e9eb0d9954e98d819350891eefcbd76508f3d0a430d2f2bbcd97"
    },
    "outputs/lean-check.txt": {
      "sha256": "88d148141c69178b0bbd52870449f50b2e478023125c7b16bee6a3d5970f2799"
    }
  },
  "result": {
    "lean_exit_code": 0,
    "named_declarations_without_axiom_dependencies": 4
  },
  "limitations": [
    "The proof covers exactly five voters and a threshold of three.",
    "The proof assumes a voter does not certify both values in the same term.",
    "The model does not include messages, time, crashes, leader election, logs, or state-machine execution.",
    "The proof does not establish that a networked implementation conforms to this model.",
    "The theorem establishes certificate uniqueness, not preference aggregation or liveness."
  ]
}