How it works

1. Compile. The function is parsed and translated into Z3 terms: each int parameter becomes an unbounded mathematical integer (like Python's), each if/else a Z3 If, each return the result. Anything outside the subset is refused, never approximated.
2. Match Python, not the solver. Python's // and % round toward minus infinity; SMT-LIB's round differently for negative divisors. VeriCoding encodes Python's rule, so 7 // -2 == -4 and x % -3 <= 0 come out as Python says.
3. Ask four questions, in order. Since 2026-11-02:
   1. Can the precondition itself raise ZeroDivisionError?
   2. Can an input that meets the precondition make the function raise?
   3. Can the postcondition raise on the function's result?
   4. Can an input that meets the precondition produce a result that breaks the postcondition?
   Each "yes" comes with the input. Only four "no"s make a proof. Division-safety follows Python's evaluation order: and/or stop early, a conditional evaluates one branch.
4. Answer. contract_holds: true (proved for every input), or false with a counterexample and a failure kind, or ok: false (outside the subset, or Z3 could not decide in time). Unknown is never a pass.
5. Sign. On request, the answer becomes a certificate signed with Ed25519, with a standalone re-checker.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.