Research operating system
Verified mathematics.
Verified software.
Verified hardware.
Build once. Prove once. Run everywhere.
Most systems stop at code. Monogate carries evidence — from mathematics, to software, to hardware.
The pipeline
One source, carried to hardware — proven at every step.
- EMLone source
- Forgecompile
- Leanproof ✓
- MachLibmath
- RTLsynthesis
- FPGAon silicon ◦
- ESP32byte-identical ◦
- Evidencepacket · replay
Hover a stage to trace the flow. ● Lean is machine-checked proof (formal). ◦ FPGA / ESP32 are measured — byte-identical output on real silicon, not formal equivalence.
Four ways in
Where do you want to start?
Research
Mathematics, proofs, papers. The Khovanskii results, EML foundations, and the Lean library behind every claim.
Enter → 02Engineering
Forge compiles one source to real silicon — FPGA bitstreams, byte-identical ESP32, electronics, and the reproduction zoo.
Enter → 03Explore
Interactive surfaces — the math-to-art gallery, Glass Box, the Proof-Carrying Rescue Explorer, playable simulators.
Enter → 04Build
Install the compiler, read the docs, run the examples. Published packages on PyPI, source on GitHub.
Enter →Live from CI
The verification skyline
Numbers that can go down. Emitted by the build, not by marketing.
Loading status.json from machlib CI. No CI figure is shown until it arrives.
The theorem rows are machlib’s theorem ledger, read off the Lean environment: every theorem’s axioms, classified against the declared axiom policy. Approved policy: the kernel checked the proof and every axiom it rests on is in the trusted policy. Conditional: the kernel checked the proof, which rests on declared axioms outside that policy, so it is proved relative to those assumptions, not unproved. Unchecked: the proof holds a sorry or an undeclared axiom; today that is one deliberate, allowlisted teaching example. A “Discharged” percentage stood here until 2026-10-10. It came from a text search, which is not a count of proved results, and it is retired.
The evidence
See it. Don’t take our word.
Real reproduction-zoo artifacts — a proof, a 32-target emit, and hardware evidence you can inspect.
theorem pid_step_bounded
(error prev_error integral kp ki kd dt : ℝ)
(h : dt > 0) :
OUT_MIN ≤ pid_step error prev_error integral kp ki kd dt ∧
pid_step error prev_error integral kp ki kd dt ≤ OUT_MAX := by
unfold pid_step
exact ⟨clamp_ge_lower _ _ _, clamp_le_upper _ _ _⟩
fn pid_step(error, prev_error, integral,
kp, ki, kd, dt: Real) -> Real
where chain_order <= 0
requires (dt > 0.0)
ensures (result >= OUT_MIN)
ensures (result <= OUT_MAX)
{
clamp((kp*error) + (ki*integral)
+ (kd*(error - prev_error))/dt, OUT_MIN, OUT_MAX)
}
$ python -m efrog.lean_corpus # decompile every example to EML, emit the Lean # proofs, then actually run `lake env lean`: Efrog.sigmoid_eml_consistent ✓ verified (clean) Efrog.while_sum_chain_order ✓ verified (clean) … verified 32/32 theorems — Lean-checked, sorryAx-free
These are real artifacts. pid_step and rc_filter re-derive inside the Forge repository with make verify-proof, and the efrog tile with python -m efrog.lean_corpus. Both repositories are private for now, so the published evidence — 32 targets, proofs, hardware captures — lives in the reproduction zoo →
Auditable by design
Every number here can go down. We publish what we retract.