Research operating system
Verified mathematics.
Verified software.
Verified hardware.
Build once. Prove once. Run everywhere.
Most systems stop at code. Monogate carries evidence — from mathematics, to software, to hardware.
The pipeline
One source, carried to hardware — proven at every step.
- EMLone source
- Forgecompile
- Leanproof ✓
- MachLibmath
- RTLsynthesis
- FPGAon silicon ◦
- ESP32byte-identical ◦
- Evidencepacket · replay
Hover a stage to trace the flow. ● Lean is machine-checked proof (formal). ◦ FPGA / ESP32 are measured — byte-identical output on real silicon, not formal equivalence.
Four ways in
Where do you want to start?
Research
Mathematics, proofs, papers. The Khovanskii results, EML foundations, and the Lean library behind every claim.
Enter → 02Engineering
Forge compiles one source to real silicon — FPGA bitstreams, byte-identical ESP32, electronics, and the reproduction zoo.
Enter → 03Explore
Interactive surfaces — the math-to-art gallery, Glass Box, the Proof-Carrying Rescue Explorer, playable simulators.
Enter → 04Build
Install the compiler, read the docs, run the examples. Published packages on PyPI, source on GitHub.
Enter →Live from CI
The verification skyline
Numbers that can go down. Emitted by the build, not by marketing.
Loading status.json from machlib CI. No CI figure is shown until it arrives.
“Discharged” is the share of Forge @verify obligations whose MachLib counterpart already carries a proof, as machlib’s CI measures it. machlib.org reports a different figure (how often Forge’s automatic tactics close the obligations that compile), and Forge’s contract census covers only its example kernels, so the three percentages are not meant to match.
The evidence
See it. Don’t take our word.
Real reproduction-zoo artifacts — a proof, a 32-target emit, and hardware evidence you can inspect.
theorem pid_step_bounded
(error prev_error integral kp ki kd dt : ℝ)
(h : dt > 0) :
OUT_MIN ≤ pid_step error prev_error integral kp ki kd dt ∧
pid_step error prev_error integral kp ki kd dt ≤ OUT_MAX := by
unfold pid_step
exact ⟨clamp_ge_lower _ _ _, clamp_le_upper _ _ _⟩
fn pid_step(error, prev_error, integral,
kp, ki, kd, dt: Real) -> Real
where chain_order <= 0
requires (dt > 0.0)
ensures (result >= OUT_MIN)
ensures (result <= OUT_MAX)
{
clamp((kp*error) + (ki*integral)
+ (kd*(error - prev_error))/dt, OUT_MIN, OUT_MAX)
}
$ python -m efrog.lean_corpus # decompile every example to EML, emit the Lean # proofs, then actually run `lake env lean`: Efrog.sigmoid_eml_consistent ✓ verified (clean) Efrog.while_sum_chain_order ✓ verified (clean) … verified 32/32 theorems — Lean-checked, sorryAx-free
These are real artifacts. pid_step and rc_filter re-derive inside the Forge repository with make verify-proof, and the efrog tile with python -m efrog.lean_corpus. Both repositories are private for now, so the published evidence — 32 targets, proofs, hardware captures — lives in the reproduction zoo →
Auditable by design
Every number here can go down. We publish what we retract.