Staatsgeheim/MathKernel: Evidence-aware multi-engine mathematics runtime for LLMs: exact, symbolic, formal, certified-interval and numeric computation with typed MathIR, trust labels, and full provenance · GitHub

An evidence-aware multi-engine mathematics kernel — usable both as a Python library (mathkernel) and as an MCP server (mathkernel-mcp) — so applications and LLMs can do advanced mathematics while preserving assumptions, provenance, and claim-specific evidence.

The LLM interprets intent; the MathKernel establishes mathematical evidence.

Mathematical results carry an explicit trust level, an engine tag, and a derivation trail. Exact computation, checked certificates, symbolic results, certified enclosures, empirical evidence, and formal proofs are distinct claims. Exact arithmetic alone is not a formal proof; approximate-input ancestry must not silently disappear.

LLMs are good at mathematical intent and bad at mathematical arithmetic. MathKernel inverts the division of labor: the model parses, plans, and interprets; the kernel computes and records claim-specific evidence. Some claims use independent certificates or cross-checks; others are exact computations in one engine. Engine agreement alone is not a proof, and a single trust label does not replace the evidence bundle.

MathKernel is a typed orchestration layer rather than a single solver. The public
facade owns parsing, contexts, object identity, persistence, evidence composition,
resource policy and derivation tracking; domain adapters own the actual mathematics.
Presentation layers sit downstream and cannot silently change the claim being made.

Python / MCP
    |
    v
MathKernel facade
    |-- parser + contexts + typed objects
    |-- execution/evidence contract
    |-- persistence + derivation graph
    |
    +--> symbolic / exact / certified / formal / numerical engines
    |
    +--> MathResult and derived mathematical objects
             |
             +--> MultimodalProjection
                     |--> mathkernel-viz
                     |--> mathkernel-sonify
                     +--> unified portable artifacts

This separation is deliberate: a renderer may present evidence, but it does not create
stronger mathematical evidence merely by producing a polished plot or audio artifact.

The generic MCP tools math_object_create, math_object_get, and math_apply
expose the following compositional operations. This is the full typed-operation
inventory; math_capability_query is the live source of parameter schemas,
output types, limits, engines and verification methods.

Source objects use the same boundary: transform/complex/probability objects,
graphs and combinatorial structures, finite groups/rings/fields/modules,
signals/filters/control systems, optimization problems, and Manifold →
Chart → Metric/CoordinateMap/TensorField/DifferentialForm, plus
Point/PointSet/Polygon/Polytope/Triangulation, and finite
SimplicialComplex/CubicalComplex/integral ChainComplex, and typed
StatisticalSample observations, GeneralizedLinearModel specifications, and
SurvivalDataset/CoxProportionalHazardsModel survival sources, plus
TimeSeriesDataset/TimeSeriesModel ordered-time sources, and
PoissonProcess/WienerProcess/GaussianProcess/ContinuousTimeMarkovChain
process-law sources, StochasticDifferentialEquation Itô models, and structured
PDEProblem equations/domains/conditions.
NonparametricTestResult, ResamplingResult, KaplanMeierEstimate, GLMFit,
and CoxPHFit are derived-only, source-linked records with deterministic exact,
numerical, or seeded-stream replay. TimeSeriesAnalysis, TimeSeriesFit, and
TimeSeriesForecast, FiniteDimensionalDistribution,
GaussianProcessPosterior, and CTMCTransition follow the same output-only
replay boundary. PDEClassification, PDECompatibilityReport, and WeakForm
replay their principal-part, represented-trace, or complete weak-identity result
from the source problem. FEMMesh links that weak form and an optional verified
triangulation. ReferenceElement, BasisFunctionSet, QuadratureRule, and
FiniteElementSpace are output-only with replayable single- or multi-source
ancestry. AssembledSystem retains local and sparse global contributions plus
its space/quadrature sources; output-only FEMSolution retains the exact
assembled-system source and replayable solver diagnostics. G.5 output-only
FEMErrorEstimate, RefinementMarking, RefinedMesh, MeshTransfer, and
FEMConvergenceObservation records retain the complete solution-to-child-mesh
chain, marking policy, parent/child cells, interpolation weights and empirical
rate inputs.
SDESimulation and SDEConvergenceStudy additionally replay
their PCG64 streams and discretizations. Derived-only types cannot be forged through
public input.

pip install mathkernel           # Python mathematical core
pip install 'mathkernel[mcp]'    # add the optional MCP transport

From a source checkout:

python -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate
pip install -e .           # Python mathematical core
pip install -e '.[mcp]'  # add the optional MCP transport

Optional extras:

pip install -e '.[perf]'    # numba — JIT kernels (sieves, GF(2^m), FWHT, closure search)
pip install -e '.[cuda]'    # CuPy + all nvidia-*-cu12 runtime libraries (RTX-class GPU)
pip install -e '.[latex]'   # antlr4 runtime for math_parse_latex
pip install -e '.[dev]'     # pytest

Lean 4 + Mathlib is installed by default on first mathkernel-mcp start and
via mathkernel-lean-setup (elan + a pinned lake workspace). Skip with
MATHKERNEL_SKIP_LEAN_INSTALL=1 (CI/wheel smoke).

GPU note: CuPy wheels ship no CUDA libraries. The cuda extra installs the
matching nvidia-*-cu12 pip packages — without them, cuBLAS/NVRTC DLL loads fail
even though import cupy succeeds. GPU availability is probed at runtime with a
real matmul, so a broken stack degrades gracefully to CPU. Verify your stack with
python scripts/gpu_smoke.py.

The server speaks MCP over stdio (FastMCP 3) and ships core instructions to the
client at initialize time: discover → parse → context → trust discipline → async jobs
→ provenance. 162 tools, all prefixed math_.

Typical agent session:

math_capabilities                                   # discover surface, limits, engines
math_parse("x^2 - 3*x + 2 = 0")                     # -> expr_id
math_context_create(domains=⚡)          # -> context_id
math_reason(expr_id, context_id, formal=true)       # solve + independently verify
math_derivation_trace(step_id)                      # full provenance on demand

Long-running sweeps are async:

math_job_submit("collatz", 🔥)  ->  math_job_status(job_id)  ->  math_job_result(job_id)

The MCP server is a thin transport layer; everything is available in-process:

from mathkernel import MathKernel

kernel = MathKernel()

# symbolic
r = kernel.parse("x^2 - 2 = 0")
sol = kernel.solve(r.data["expr_id"], "x")
assert sol.ok and sol.trust.value == "symbolic"

# exact GF(2^m) field arithmetic
f = kernel.gf2m_create(8, "1b")  # AES polynomial x^8 + x^4 + x^3 + x + 1 (hex reduction part)
kernel.gf2m_compute(f.data["field_id"], "mul", ["53", "ca"])

# finite dynamics: an explicit eight-state cyclic permutation
transition = [1, 2, 3, 4, 5, 6, 7, 0]
fs = kernel.finite_system_create("uniform", transition)
km = kernel.koopman_matrix(fs.data["system_id"], {"kind": "walsh", "r": 3})
vis = kernel.koopman_visibility(fs.data["system_id"], {"kind": "walsh", "r": 3})
# Exact zeros certify the requested modes in this declared finite model.

# closure relations (njit meet-in-the-middle)
kernel.closure_search("cyclic", m="97", weight_bound=10, multipliers=["1", "5"])

Standalone modules (mathkernel.gf2m, mathkernel.koopman, mathkernel.relations,
mathkernel.cumulants, mathkernel.finite_fourier, mathkernel.transforms,
mathkernel.integral_transforms, mathkernel.complex_analysis,
mathkernel.continuous_probability, mathkernel.integers,
mathkernel.computational_geometry, mathkernel.algebraic_topology,
mathkernel.collatz, mathkernel.cuboid) are usable without the facade when
you don’t need derivation tracking.

formal                  Lean certificate accepted by the Lean kernel
exact                   exact computation / checked claim-specific certificate
symbolic                symbolic engine agreement (e.g. SymPy residual checks)
interval_certified      rigorous enclosure (mpmath interval)
numeric_high_precision  arbitrary-precision numeric
numeric                 float evidence (incl. GPU fast paths)
empirical / heuristic / unknown

Overall trust is limited by the weakest evidence required to establish the claimed
result — never the maximum trust emitted by any single node. Independent backend
disagreement is preserved as an explicit conflict, not averaged away.

Every MathResult also carries an evidence_bundle with separate computation,
proof, certificate, numerical, model and empirical evidence. claim_evidence
retains those bundles per conclusion instead of flattening unlike claims into one
score. The legacy trust field remains a conservative summary and is automatically
capped by the evidence required for the result. A producer-supplied
justified_trust is a ceiling, never an override; an unverified proof or certificate
supports only unknown.

Semantic statuses distinguish proof or certification strength from mathematical
outcomes such as does_not_exist, undefined, infeasible and unsupported.
These distinctions survive MCP serialization, asynchronous job retrieval,
derivation replay, visualization and multimodal artifact assembly.

The capability registry separates advertised trust levels from verification
methods. Query it by domain, input/output type, operation, trust level,
verification method or engine; capability records also identify their execution
handler and meaningful cost dimensions. Expression plans record the resolved
capability route before the existing obligation executor runs it.

Exact and numeric paths are strictly separated: koopman/finite-dynamics tools default
to exact=true (proof-grade rational/cyclotomic values); exact=false selects the
vectorized numeric path (CuPy GPU when usable) and downgrades trust to numeric.

Decimal literals are approximate observations. A decimal (RealNode) anywhere in
an expression caps its trust at numeric from parse onward — 0.1 + x parses as
numeric, 1/2 + x as symbolic. Formal certificates (Lean) and exact SMT
counterexamples are refused for approximate inputs, because the backends would encode
decimal syntax as exact rationals — silently proving a different statement. Use exact
rationals or interval certification when proof-grade evidence is needed.

Continuous domains use typed objects and the compositional
object_create → apply model rather than exposing a flat CAS surface.
Every operation records a four-obligation DAG: typed-input validation,
candidate computation, domain-invariant verification and conservative evidence
reconciliation.

• Integral transforms — Laplace, Fourier, Mellin and bilateral Z transforms
  with explicit conventions, assumptions and regions of convergence. Inverse Z
  uses annulus-aware Laurent/residue extraction when justified. Verification
  records round-trip, linearity, convolution, differentiation, value-theorem and
  ROC obligations separately; unresolved obligations remain unknown.
• Complex analysis — derivatives, analyticity candidates, zeros,
  singularities, Laurent series, residues, contour integration, winding numbers,
  argument-principle accounting, conservative identity continuation and
  domain-aware conformal maps. Branch conventions, cuts, excluded points,
  contour orientation and boundary incidents remain explicit.
• Continuous probability — typed univariate, random-variable, joint and
  conditional distributions; PDF/CDF/survival/quantile, moments, transforms,
  entropy, truncation, convolution, mixtures, divergence, marginals,
  conditioning/Bayes, covariance/correlation and order statistics. Support,
  parameter constraints, Jacobians and inverse branches are retained.

Symbolic availability is candidate evidence, not independent proof. Same-engine
identities are capped at symbolic; decimal ancestry remains capped at
numeric. does_not_exist (for example, a Cauchy mean) is distinct from an
unsupported method or an unresolved convergence question.

Conventions and assumptions are part of the object. Fourier sign and
normalization, transform source/target variables, complex branches/cuts,
probability supports and parameter constraints are never selected silently.
Contour orientation and singularity accounting are mandatory where the theorem
depends on them.

Verification is operation-specific. Transforms retain every checked or unresolved
identity and ROC obligation. Residues are compared with defining limit/derivative
or Laurent-coefficient formulas; contour claims retain enclosed singularities,
cuts and winding numbers. Probability verifies normalization, support-aware
nonnegativity, CDF boundaries/derivative/monotonicity when decidable, and
Jacobian branches. These are symbolic checks unless an exact certificate or
separate numerical record says otherwise.

Failures use semantic statuses: candidate, unknown, unsupported,
does_not_exist, and error are distinct. Known limitations include
non-product joint supports, continuation without an explicit overlapping source
domain, branch-sensitive argument-principle inputs, transforms whose ROC SymPy
cannot establish, and general multivariate changes of variables without supplied
inverse branches/Jacobians.

Continuous symbolic work is bounded by the global AST/output/solver-time limits
and dedicated contour, joint-dimension, mixture-component, series-order,
order-statistic and inverse-branch limits. Raise the corresponding
MATHKERNEL_MAX_* value explicitly when a larger request is intentional.

# PDF → Laplace transform, preserving support and evidence ancestry
d = kernel.object_create("Distribution", {
    "family": "exponential", "parameters": ["2"], "variable": "x",
})
r = kernel.apply(d.data["object_id"], "integral_transform", {
    "transform": "laplace",
    "transform_variable": "s",
    "convention": "laplace_standard",
})
assert r.data["value"] == "2/(s + 2)"

A distinctive capability: exact spectral analysis of finite dynamical systems
(X, μ, T, O) — built for (and validated on) PRNG structure analysis.

• Koopman suite — transport matrix Q, observation-transfer C, mode visibility
  ρ_O, lagged state tensors (raw/connected), observed statistics, IPR/entropy
  diagnostics. Walsh bases for GF(2)^r, character bases for Z_M.
• Stochastic observation transfer (library API) — exact
  FiniteJointLaw contractions for arbitrary finite latent joint laws; ordered
  Markov path moments/cumulants with the required multiplication operators;
  statewise multiplicativity-defect certificates; and exact finite-noise
  deterministic dilations for rational Markov kernels. The accompanying
  published primate quartet pilot deliberately records that the earlier K3ST
  split-zero diagnostic does not survive outside its group-based assumptions.
• Branching General Markov tensors (library API) — exact
  FiniteMarkovTree sum-product laws and cumulants on heterogeneous rooted
  trees; exact L M R edge-flattening certificates with the sharp transition-
  rank bound; local stochastic observation channels as Kronecker transforms;
  exact left-inverse recovery, collision witnesses, collective sensor fusion,
  and channel-conditioned singular-value bounds. The published primate pilot
  distinguishes algebraic identifiability from finite-sample stability.
• Statistical phylogenetic inference (library API) —
  probability-simplex projection; known-channel EM and constrained ridge
  recovery; held-out regularization selection; multinomial covariance and
  tangent-space Fisher information; nonnegative-rank multinomial likelihood;
  covariance-Wald rank diagnostics; and tie-safe quartet scoring. Controlled
  GM(4) experiments quantify the shared singular-value origin of visibility
  loss and inverse instability. Two fixed published-data pilots add site and
  moving-block bootstrap checks without claiming broad competitive accuracy.
• Frozen phylogenetic benchmarking (library API) —
  FASTA, relaxed PHYLIP, practical NEXUS and Newick ingestion; portable source
  SHA-256 manifests; canonical protocol and corpus locks; result-blind quartet
  sampling from reference-tree splits; complete-case site provenance; site,
  circular-block, partition-stratified and whole-partition resampling; rank-tail,
  p-distance and normalized log-det baselines; and tie-safe corpus summaries.
  The bundled execution evaluates 22 predeclared correlated units from two
  published source alignments and a 1,920-alignment known-truth stress grid. A
  separate lock fixes the first 20 eligible BenchmarkAlignments datasets before
  acquisition; that external corpus is explicitly pending rather than silently
  replaced.
• Observable connected-relation detection (library API) –
  exact and numerical pure-interaction laws; weighted conditional-expectation
  singular spectra; mode-specific stochastic visibility; exact local-channel
  transfer of connected amplitude; chi-square and null-Fisher information
  retention; exact invisibility certificates; finite necessary and constructive
  sufficient sample bounds; binary-parity scaling; and complementary sensor
  fusion. The controlled theorem shows that local visibility losses multiply
  in amplitude and square in information, yielding an s^(-2d) detection-cost
  law in the homogeneous binary specialization.
• Relation-subspace visibility and sensor design (library API) –
  finite multi-parameter local relation laws; latent and observed Fisher Gram
  matrices; generalized retained-information eigenvalues and principal
  visibility directions; exact observation-blind collision certificates;
  direction-level information and sample multipliers; rank, E-optimal, trace,
  D-optimal and pseudo-logdet sensor-subset selection; efficient empirical
  partition transfer; and score-mean long-run-covariance correction. A frozen
  SkewDB adapter adds source/schema auditing, discovery/validation/challenge
  splits by held-out taxonomy, discovery-only preprocessing, source hashing and
  a fail-closed raw-data runner. The bundled SkewDB fixture is explicitly
  synthetic because the current full payload was not acquired in this
  environment.
• Coordinate-invariant relation geometry (library API) –
  finite-simplex tangent vectors with the intrinsic Fisher metric; stochastic
  tangent pushforward; coordinate-invariant generalized retained-information
  eigenvalues; exact score/tangent equivalence; exact local chi-square transfer;
  worst-direction minimax necessary sample bounds; finite Bhattacharyya and
  retention-based pointwise sufficient counts; and iid, moving-block and
  cluster bootstrap intervals for ordered relation spectra. A SHA-256-locked
  local-resolution SkewDB adapter converts documented cumulative *_fit.csv
  tracks to window increments and explicitly separates genuine inputs from the
  bundled source-parameterized generated fixture.
• Finite Fourier — exact arithmetic in ℚ(ζ_L) via cyclotomic polynomials:
  DFT over Z_M, output-transfer transforms, two-point difference coefficients,
  measure Fourier transforms, orbit corrections.
• Closure search — short irreducible relations selected by the dynamics:
  cyclic (Σ k_j·a^j ≡ 0 mod m) and binary (⊕ (L^{jK})ᵀ w_j = 0),
  meet-in-the-middle with L1/Hamming weight bounds.
• GF(2^m) from transitions — reconstruct the field (dual-orbit cyclic basis,
  minimal/reduction polynomial, Rabin-verified) purely from a generator’s
  GF(2)-linear transition columns.
• State-conditioned dynamics — exact per-state orbit access T^κ(x)(x):
  least-lag solving, symmetry-to-access conversion, cocycle composition,
  exhaustive additive closure proofs, symbolic affine access maps, GF(2)
  baby-step/giant-step orbit solving, sparse giant-lag predictive closures,
  and constrained symmetry discovery where numeric probing only ranks
  candidates — canonical-rewrite or exhaustive proofs decide.

The scripts/ tree contains uniform, end-to-end reproductions for 25+ generators
(xorshift/xoroshiro/xorwow families, MT19937, Melg19937, WELL19937a, MRG32k3a,
PCG32/64(+fast), LXM, SplitMix64, SFC64, JSF64, Romu, Philox, Threefry, RXS-M-XS),
each runnable from scratch with scripts/families/run_all.py and
scripts/companion/run_all.py. Reference data ships in scripts/data/ — no
external fixtures required.

MathKernel provides typed engineering mathematics for signals, control systems and constrained optimization while preserving the same evidence and persistence contracts as the symbolic core.

Continuous and sampled signals carry explicit domains, sample grids and units. Spectral representations are typed rather than treated as anonymous arrays. FIR/IIR filters and filter designs retain coefficients, conventions and source signals, while immutable streaming state makes block-by-block processing replayable. Frequency-response and time-response operations record whether they used exact symbolic algebra or numerical evaluation.

Typed SISO and MIMO models support state-space and transfer-function representations, continuous/discrete conversion, poles and zeros, stability checks, discretization, controller construction and observer construction. LQR, finite-horizon LQR, steady-state Kalman filtering, LQG composition and immutable Kalman prediction/update states retain plant/model ancestry and separate algebraic checks from modeling assumptions.

Constrained finite-horizon MPC keeps feasibility, optimality, terminal invariance, recursive-feasibility and stability claims separate. Frequency-domain analysis includes Bode, Nyquist and root-locus representations together with checked time responses.

Linear and quadratic programs can return exact/checkable optimality witnesses where the supported fragment permits it. Infeasible LPs can expose Farkas certificates and unbounded problems can expose recession rays. MILP search results carry replayable proof trees rather than only an incumbent value. Conic and quadratic-constraint workflows support bounded SOCP/SDP product cones and Lagrangian-style certificates in their declared fragments.

External native candidate solvers are isolated in fresh processes with bounded requests and hard timeout termination. Candidate generation and certificate verification are distinct steps: a solver finding a point does not by itself establish a stronger claim than the verifier can check.

Immutable Manifold, Chart, and Metric objects feed typed GeometryTensor, Connection, and GeodesicSystem outputs. Metric operations compute inverse metrics, Christoffel symbols, Riemann/Ricci/scalar/Einstein curvature and affine geodesic equations. Exact symbolic checks cover inverse identities, torsion freedom, metric compatibility, Riemann symmetries, the first Bianchi identity and the contracted Bianchi identity. Chart domains and metric nondegeneracy conditions remain explicit.

Directional CoordinateMap objects carry explicit Jacobians and inverse-composition checks. Dense variance-aware TensorField objects and canonical sparse DifferentialForm objects support covariant and Lie derivatives, wedge products, exterior derivatives, interior products, pullbacks and Hodge stars. Checks include graded commutativity, d²=0, pullback commutation with d, metric compatibility, coordinate-map composition and the Hodge double-star sign when metric signature is supplied. Orientation and signature are never guessed.

Point, PointSet, Polygon, half-space Polytope, Triangulation, and derived VoronoiDiagram objects provide exact orientation, incircle and segment-intersection predicates, monotone-chain convex hulls, winding containment, exact squared-distance nearest neighbors, certified ear clipping, convex polygon clipping, empty-circumcircle Delaunay triangulation and finite Voronoi duals with explicit unbounded rays. Decimal predicates use conservative floating-point error filters; when topology cannot be established, the result is explicitly ambiguous rather than promoted to an exact classification.

Exact finite SimplicialComplex, CubicalComplex, and integral ChainComplex objects expand cells to canonical face closures and derive oriented boundary matrices. Complexes verify boundary[k-1] * boundary[k] = 0 before homology is attempted. homology computes free ranks and integer torsion over Z through certified Smith-kernel/quotient reductions, and exact Betti numbers plus representative cycles over Q or GF(p). boundary_matrix, chain_complex, and euler_characteristic expose ordered bases and the Euler–Poincaré cross-check.

Verified exact triangulations can be converted into canonical simplicial complexes and composed directly with homology operations; numeric or refuted triangulations cannot cross that exactness boundary. Closure expansion is bounded before combinatorial growth can exceed configured topology limits. Persistent homology, cohomology products and infinite/CW-complex inference are not claimed.

StatisticalSample stores a rectangular nonempty matrix of finite concrete real observations, unique variable labels, optional unique observation IDs and explicit asserted sampling/population/design metadata. describe derives exact or ancestry-capped numeric moments and type-7 order statistics; covariance derives centered cross-products with sample or population normalization; empirical_distribution preserves exact frequency counts and rational probabilities; and evidence_profile audits the evidence boundary itself.

The required evidence establishes only calculations on the stored observations. Sampling metadata, empirical support and model assumptions stay in separate diagnostic evidence records, while population generalization and model validity remain explicitly unestablished. Missing values, unresolved symbolic observations and silent imputation are refused. Decimal input cannot upgrade, resource limits are checked before expensive work, and every derived object retains its source across persistence and restart.

Immutable GeneralizedLinearModel objects link to stored samples and produce derived-only GLMFit objects. Supported canonical pairs are Gaussian/identity, binomial/logit and Poisson/log. verify checks response domain, design rank and residual degrees of freedom; fit reports ordered coefficients, covariance/standard errors, fitted conditional means, deviance, null deviance, dispersion, convergence, score residual and conditioning. Fits independently support verify, diagnostics, and predict.

Exact-input Gaussian models use sufficient cross-products and exact normal equations. Numeric Gaussian fits use checked float64 least squares; logistic and Poisson fits use deterministic float64 IRLS. Rank deficiency, invalid or degenerate response domains, non-convergence, singular/ill-conditioned information and detected complete/quasi separation fail closed without a fit object. No ridge term, row deletion, imputation or family/link substitution is silent. Coefficient, covariance, deviance and prediction claims remain conditional on the stored sample/design; model validity, population generalization and causal effects are not inferred.

Stored samples support mann_whitney, wilcoxon, kruskal_wallis, ks_2samp, spearman, and kendall, with explicit average ranks and tie corrections. method="auto" performs complete exact sign/label/permutation enumeration only when both state and work estimates fit configured bounds; otherwise the result names its normal, chi-square, Kolmogorov or Student-t approximation. Thus an exact p-value is an exact conditional null calculation for the stored observations, while an asymptotic p-value remains numerical evidence without a finite-sample error theorem.

permutation_test supports mean/median differences using exact enumeration or explicitly seeded PCG64 Monte Carlo with an add-one p-value. bootstrap supports mean/median percentile intervals with a mandatory uint64 seed, bounded draws and memory-bounded batches. Simulated results record random algorithm, seed, draw count and replay configuration. Exchangeability, sampling design, asymptotic validity, population coverage and causal interpretation remain separate assumptions or unestablished claims.

SurvivalDataset stores durations, exact binary event indicators, optional delayed-entry times and optional strata inside an immutable statistical sample. kaplan_meier constructs exact risk sets and product-limit values together with numerical Greenwood standard errors and two-sided log-log intervals. Multi-stratum inputs require an explicit stratum, and survival_at queries the right-continuous step curve.

CoxProportionalHazardsModel provides an unstratified Cox surface with explicit Efron or Breslow ties. Its deterministic float64 Newton fit uses monotone line search and refuses rank-deficient, event-sparse, non-convergent, singular, over-conditioned or separation-like cases. CoxPHFit records coefficients/hazard ratios, covariance/standard errors, partial likelihood, score residual, baseline hazard, concordance and Schoenfeld time correlations, with replay verification, diagnostics and bounded partial-hazard prediction. Independent censoring, proportional hazards, population generalization and causality remain assumptions or unestablished.

TimeSeriesDataset preserves row order, distinct time/value columns, strict timestamps, reject-missing policy and detected regular spacing. Exact-source acf uses a common lag-zero centered denominator and pacf uses Durbin–Levinson recursion. stationarity_test provides a numerical constant-case ADF regression with named asymptotic critical values rather than inventing an exact p-value or claiming stationarity is proved.

TimeSeriesModel covers AR, MA, ARMA, ARIMA and GARCH orders, constant choice, Gaussian innovations and initialization. ARMA-family fits use bounded conditional-sum-of-squares optimization; GARCH uses constrained Gaussian likelihood with positive variance and persistence below one. Derived fits record coefficients, residual/fitted series, conditional variance, roots, likelihood, AIC/BIC and convergence, with Ljung–Box/Jarque–Bera diagnostics. Forecasts derive regular future times, recursive means and Gaussian intervals using ARIMA impulse responses or GARCH variance recursion. Irregular spacing may be analyzed but not fitted.

Immutable PoissonProcess, WienerProcess, GaussianProcess, and ContinuousTimeMarkovChain objects expose finite-dimensional laws and checked derived artifacts. Poisson count masses/moments and Wiener means/covariances are symbolic or exact. Gaussian-process finite laws support RBF, Matérn-3/2, linear and Brownian kernels with numerical PSD checks; conditioning uses bounded float64 Cholesky solves, explicit observation-noise variance and optional stored jitter without silently fitting hyperparameters. CTMC verification checks generator and initial-law axioms exactly; transitions use a checked matrix exponential, while stationary laws use an exact left-nullspace system and preserve nonuniqueness.

Independent/stationary increments, continuity, Gaussianity, kernel suitability and time homogeneity remain declared model assumptions rather than facts established by calculation.

StochasticDifferentialEquation supports vector Itô systems with declared symbol scope, drift vector, full state-by-noise diffusion matrix, concrete initial state and finite interval. Euler–Maruyama supports vector states and full diffusion. Milstein is restricted to scalar state/scalar noise and uses the symbolic diffusion derivative; unsupported multidimensional cases are refused rather than silently substituting another scheme.

Simulation records the exact step grid when possible, float64 paths, PCG64 algorithm/seed/stream, terminal sample moments and nominal strong/weak orders. Large outputs expose compact metadata plus bounded path/terminal queries. Coupled convergence studies reuse a finest Brownian stream across multiple step sizes and report observed terminal RMS convergence when defined. Simulation and convergence remain numerical/empirical; nominal orders, existence, uniqueness and regularity are assumptions, not proofs.

Across all statistical/stochastic objects, exact, symbolic, asymptotic, numerical, empirical and model evidence remain distinct. Derived types are output-only, replay operates under current limits, decimal ancestry cannot upgrade, persisted JSON is integrity checked before decoding, and stored type/class/source fields are reconciled to prevent cross-type source substitution.

Typed PDE problems support scalar and coupled systems, declared independent/dependent variables, derivative multi-indices, coefficients/parameters and explicit initial/boundary conditions. Principal-part analysis classifies the represented system only within the declared symbolic fragment, and trace compatibility checks distinguish represented boundary information from stronger claims such as existence, uniqueness, regularity or well-posedness.

PDEFunctionSpace, PDEMeasure, WeakIntegralTerm, IntegrationByPartsStep, and output-only WeakForm artifacts represent weak formulations explicitly. derive_weak_form requires integration variables, ordered trial spaces, test spaces, boundary-trace indices and selected term/coordinate transfers; it does not guess analytic spaces or silently integrate terms.

Variable-coefficient integration by parts retains the complete product rule, storing differentiated-test and coefficient-derivative volume terms separately. Every transfer emits oriented boundary faces. Boundary terms that vanish under declared zero test traces remain represented and are marked as such. Dirichlet, Neumann/Robin and periodic indices are recorded as essential, natural and periodic partitions. WeakForm.verify reconstructs spaces, measures, volume/boundary terms, signs, product-rule derivatives, partitions and derivation steps from the source PDE. The verified claim is the represented integral identity under declared assumptions—not a theorem of solvability or regularity.

FEMMesh supports interval, triangle and tetrahedron simplices. Construction checks bounded connectivity, nondegeneracy, canonical positive orientation, boundary/interior facet incidence, induced boundary ownership and cell connected components. A compatible stored Triangulation can provide triangle connectivity while preserving geometry and weak-form ancestry. Combinatorial replay does not infer geometric non-overlap or approximation quality.

reference_element provides canonical unit simplices. basis derives symbolic nodal P1 Lagrange functions and gradients and checks the Kronecker property, partition of unity and gradient sum. quadrature supplies bounded exact-moment rules for the supported simplex degrees. finite_element_space builds P1 vertex-DOF C0 spaces with explicit local-to-global connectivity and essential boundary DOFs. Derived objects are replayable and output-only.

AssembledSystem and FEMSolution support scalar linear stationary weak forms on affine P1 simplices. Assembly stores dense local matrices/vectors and Jacobian determinants, coalesces the global matrix into ordered sparse entries, integrates supported Neumann/Robin facet terms and performs documented symmetric elimination for Dirichlet DOFs while retaining raw and transformed systems. Concrete substitutions resolve remaining PDE parameters through restricted MathIR.

Assembly distinguishes exact integration from an exact finite quadrature sum. Insufficient-order or non-polynomial quadrature may still define a replayable algebraic system, but quadrature_exact=false records the limitation. Unsupported strong second derivatives, time derivatives, coupled/nonlinear fields, periodic constraints, unresolved parameters and missing boundary fluxes fail closed.

Solves select exact rank/augmented-rank analysis or an explicit SciPy sparse numeric path. FEMSolution records unique, ill_conditioned, singular_inconsistent, singular_underdetermined, or singular_least_squares, together with residual and conditioning diagnostics. Verification establishes the transformed finite-dimensional system and solver outcome only, never a continuous PDE solution theorem or continuum error bound.

FEMSolution.estimate_error provides residual–jump indicators for complete unique or ill-conditioned P1 solutions in its supported scalar stationary diffusion fragment. Each CellErrorIndicator retains diameter-weighted strong residual, interior conormal-jump contribution, natural-boundary contribution and total. FEMErrorEstimate stores local/global estimator values, quadrature-exactness and algebraic residual separately, and always records rigorous_error_bound=false; reliability and efficiency constants are not inferred.

FEMErrorEstimate.mark implements deterministic Dörfler and maximum policies. RefinementMarking.refine applies triangle red refinement and propagates conforming closure through shared edges. RefinedMesh records requested/closure cells and child-to-parent mappings; MeshTransfer records refined P1 nodal values as explicit affine combinations of parent DOFs. Refined meshes can re-enter the basis, quadrature, space, assembly, solve and estimation chain.

FEMErrorEstimate.compare accepts direct parent/child refinement pairs and reports estimator ratios and observed two-mesh rates. FEMConvergenceObservation is explicitly empirical evidence about an estimator sequence, not a convergence theorem or continuum error bound.

mathkernel.composite_relation_inference provides a quadratic score test for an entire visible relation subspace. Generalized observed scores are whitened under the nominal law and the statistic is the squared norm of their sample mean. A finite bounded-score argument supplies a conservative guarantee with explicit dependence on relation dimension, weakest retained-information eigenvalue, perturbation radius and score bound.

The same module computes nuisance-adjusted target information through latent and observed Fisher Schur complements. It reports exact post-observation confounding when a target direction can be reproduced by nuisance variation. For repeated or nearly repeated information eigenvalues, bootstrap uncertainty is attached to invariant eigenspaces through principal angles rather than arbitrary individual eigenvectors. Studentized ordered-spectrum intervals, dependence-informed circular-block heuristics, nominal/empirical/HAC covariance modes and norm-bounded misspecification guarantees are available with their assumptions recorded.

mathkernel.robust_relation_inference provides model-scoped quadratic inference, learned nuisance projections, orthogonal residual relations and VAR-prewhitened long-run covariance estimation.

These research APIs remain numerical/model-scoped unless a stronger finite guarantee is explicitly returned. They do not acquire formal-proof or interval-certification labels merely because they are composed with other MathKernel objects.

The relation-analysis stack also includes exact observable-relation visibility, information-retention calculations, sample-cost diagnostics, multi-relation Fisher geometry, sensor-design objectives, coordinate-invariant tangent representations, local testing bounds and uncertainty for information spectra. Numerical near-null directions are kept distinct from mathematically exact blind directions.

Exact symbolic types (Fraction, CyclotomicNumber) are deliberately pure Python —
a visibility zero or closure cancellation must remain a proof. Numeric twins exist
where scale demands it and always carry trust: numeric.

Expansion contract. New domains must design verification and
performance tiers together from the start: exact typed semantics and limits,
an independently checkable certificate for every VERIFIED claim, and — where the
workload is regular enough — a Numba/process/GPU fast path behind a narrow exactness
fragment with automatic Python fallback. Fast paths must be re-verified or
differential-tested against the reference implementation and must record the selected
backend in evidence metadata; they may never raise trust beyond the underlying proof.
GPU offload is mandatory only for regular device-exact workloads; irregular
arbitrary-precision algorithms document the considered tiers instead.

MathKernel optimizes only where the mathematical contract survives the optimization. Regular bounded integer/array workloads use Numba, process or GPU paths with differential checks and guarded fallbacks. Exact symbolic workloads stay on exact representations when converting them to floating point would weaken the claim. Profiling is used to remove repeated symbolic work, hoist invariant computations, cache replayable certificates and replace avoidable superlinear verification passes without changing stored mathematical evidence. Backend selection is recorded in evidence metadata and never raises trust above the underlying computation or certificate.

mathkernel_viz turns MathKernel objects and results into evidence-carrying interactive
artifacts. Visualization is downstream of mathematics: it consumes typed source data or
a MultimodalProjection, records presentation transformations, and never upgrades the
source evidence merely because a particular graphical form is used.

import mathkernel_projection as mkp
import mathkernel_viz as viz

projection = mkp.create_projection(
    "matrix",
    {"matrix": [[1, 2], [3, 4]]},
    trust="exact",
)
doc = viz.from_projection(projection)
viz.export_html(doc, "matrix.html", mode="portable")

The lower-level dashboard API remains available for direct composition:

import mathkernel_viz as viz

doc = viz.dashboard("My result", cols=2)
viz.add_point_cloud(doc, points, trust="numeric")
viz.add_histogram(doc, values, bins=128)
viz.add_select(doc, "lag", [
    {"label": "k=4", "value": {"embed": {"lags": [0, 4, 8]}}}
])
viz.export_html(doc, "out.html", mode="portable")

• Building blocks, not monoliths — artifacts compose reusable panels such as
  point_cloud_3d, trajectory_3d, surface_3d, vector_field_3d, plot2d,
  histogram, heatmap, dag, metric_grid, data_table, text and select.
• Renderer-neutral IR — the versioned VisualizationDocument is consumed by
  pure-Python SVG, optional matplotlib PNG/PDF, and the HTML+Three.js renderer.
• Interactive 3D — orbit/pan/zoom and hover inspection of identity and trust.
• Portable HTML — one self-contained .html with embedded datasets, provenance,
  reproducibility metadata and viewer runtime; no server or CDN is required.
• Evidence-preserving — block/series/dataset trust is inherited conservatively;
  interval-certified display is only used when the source itself carries that support.
• Integrity & determinism — payload and per-dataset SHA-256 are exposed, and
  identical inputs produce deterministic artifacts.
• Secure presentation boundary — CSP, escaped labels, no eval, dataset limits,
  and MathIR treated as data rather than executable code.

The shared mathkernel_projection layer defines canonical mathematical projection
families that can feed visualization, sonification, or a combined research artifact.
This prevents each renderer from inventing its own interpretation of a matrix, mesh,
graph, field, distribution or high-dimensional object.

A MultimodalProjection records:

• source lineage (SourceRef);
• projection family and structured payload;
• coordinates, units and labels;
• assumptions and evidence references;
• deterministic transformation provenance;
• explicit basis, slice, traversal or ordering parameters;
• output dimensionality and declared information loss.

The canonical families cover scalar/vector fields; point sets/clouds; curves, surfaces
and trajectories; sequences and distributions; matrices and tensors; graphs, evidence
graphs, expression trees and certificate trees; spectra and complex-valued fields;
regions and implicit sets; meshes and geometric complexes; ODE/PDE solutions and
dynamical systems; optimization and statistical-inference objects; finite-field/GF(2)
structures; relation/information geometry; sets, partitions and piecewise objects;
quantities with units; ensembles; and explicit higher-dimensional projections.

For source dimension greater than three, a projection method and output dimensionality
must be explicit. Coordinate selection, a declared basis, PCA-like reduction or a
domain-specific spectral projection are transformations that must be recorded; a
renderer cannot silently decide which view is canonical.

A registry of result adapters (mathkernel_projection.result_adapters) maps stored
typed objects and flat result payloads onto these families automatically. Adapters
are pure extraction functions: they never recompute mathematics, never upgrade
trust, and declare any presentation choice (sampling grids, magnitude-only spectra,
channel selection, covariance-to-band reduction) in parameters and
information_loss. math_visualize(object_id=...) and
math_projection_create(source_object_id=...) use the registry to choose the
canonical projection for signals, spectra, filters, pole-zero maps, frequency
responses, root loci, time responses, distributions (symbolic densities are sampled
on a declared window), empirical/discrete distributions, statistical samples,
GLM fits, Kaplan-Meier estimates, Cox baseline hazards, ACF/PACF diagnostics,
time-series fits, graphs and traversal trees, optimization results, ODE/SDE
ensembles, FEM meshes/solutions/error indicators/convergence observations,
assembled-system sparsity patterns, PDE grids, point sets, polygons, triangulations,
Voronoi diagrams, generating functions, Cayley tables, contours, singularity maps,
subgroup/coset/orbit partitions, combinatorial counts, and unit quantities.
Unregistered object types fail with a typed error rather than an invented view.

Evidence graphs are first-class: claim -> evidence -> assumption/source relationships
can be visualized directly, making MathKernel’s verification structure inspectable rather
than hiding it in metadata. Complex-valued projections retain magnitude/phase structure,
and mesh/field projections preserve the geometric entity to which each value belongs.

mathkernel_viz, mathkernel_sonify and mathkernel_multimodal share the mathkernel_artifacts semantic layer. MathKernelArtifact carries typed source lineage, evidence/certificates, presentation transformations, scientific/perceptual annotations, reproducibility metadata and visual/audio synchronization. mathkernel_viz.visualize(result) attaches deterministic structured lineage to visual datasets and series, while mathkernel_viz.to_artifact(doc, result=...) promotes a visual document into the same evidence-carrying artifact model used by multimodal exports. Presentation remains downstream of mathematics and cannot upgrade source trust.

mathkernel_sonify is the auditory sibling of mathkernel_viz. It consumes the same
source lineage and MultimodalProjection contract, while SonificationDocument owns the
auditory mapping itself. The mathematical result remains untouched.

import mathkernel_projection as mkp
import mathkernel_sonify as son

projection = mkp.create_projection(
    "spectrum",
    {"amplitudes": [1.0, 0.42, 0.17], "phases": [0.0, 0.3, -0.2]},
    trust="numeric",
)
audio = son.projection_sonification(projection)
son.write_wav(audio, "spectrum.wav")
son.export_html(audio, "spectrum.html")

The IR records every value-to-audio mapping as declarative provenance. Structured
objects are never silently flattened: matrix scans record row/column ordering; tensor
sonification records the selected slice/order; graphs record traversal or degree
reduction; meshes record the geometric reduction; complex objects preserve magnitude
and phase mapping; optimization traces, bootstrap/null distributions, relation spectra
and ensemble orderings are likewise explicit.

Built-in adapters cover harmonic/Fourier additive synthesis, sequential scans,
prediction-vs-observation stereo comparison, residual sonification and projection-aware
structured mappings. Offline PCM/WAV rendering is deterministic, rejects silent Nyquist
aliasing, and applies explicit normalization/peak limits. The WebAudio exporter is a
single offline HTML file with no network dependency.

Scientific rule: an audible pattern is a perceptual candidate, not mathematical
evidence. Any pattern discovered by listening must be validated quantitatively, exactly,
formally or empirically through MathKernel.

mathkernel_multimodal combines visualization and sonification derived from the same
source/projection into one portable MathKernelArtifact. Shared SourceRef ancestry
allows automatic cross-modal synchronization without weakening the mathematical trust
model.

import mathkernel_multimodal as mkm

artifact = mkm.build_artifact(
    title="Result",
    visualizations=[viz_doc],
    sonifications=[son_doc],
    mathkernel_version="current",
)
mkm.export_html(artifact, "result.html")

• visual blocks can highlight during linked audio playback and linked audio can seek
  from a visual block;
• one inspector surface exposes Result, Evidence, Provenance, Data, Reproduction,
  Visual Mapping, Audio Mapping, Sync and Annotations;
• payload verification and document integrity hashes remain available in the exported
  artifact;
• portable output works from file://, with no running MathKernel server required;
• artifact trust remains the weakest justified source/member trust.

Via MCP, research artifacts can be assembled from stored visualization and sonification
objects and exported as a single self-contained file.

Every tool docstring is written LLM-facing: parameter formats, exact-vs-numeric
semantics, limits, and follow-up hints are documented in-place.

All settings are environment-driven with the MATHKERNEL_ prefix
(Settings.from_env()), introspectable via math_capabilities:

src/mathkernel/            core library, typed mathematics and kernel facade
src/mathkernel_mcp/        FastMCP server layer and public math_* tools
src/mathkernel_projection/ shared typed multimodal projection layer
src/mathkernel_viz/        visualization IR, viewers and portable renderers
src/mathkernel_sonify/     scientific sonification IR, PCM/WAV and WebAudio
src/mathkernel_artifacts/  shared evidence, lineage and synchronization schema
src/mathkernel_multimodal/ unified visual/audio research-artifact exporter
scripts/                   reproducibility, GPU checks and demonstrations
experiments/               research validation programs and datasets
skills/                    synchronized Python and MCP agent skills
tests/                     core, regression, multimodal and domain test suites
benchmarks/                correctness-gated performance measurements

MathKernel ships two synchronized agent-skill packages: one for direct Python use and
one for MCP clients. They document the same evidence contract, object lifecycle and
mathematical semantics, while adapting examples to their respective interfaces.

The skills cover symbolic/exact work, reasoning and proving, persistence, finite
dynamics, probability/statistics, numerics, tensors/units, performance, visualization,
scientific sonification and the shared multimodal projection workflow. The viz/audio
skills now require projection-first provenance for structured objects and explicit
high-dimensional reduction or acoustic extraction rather than hidden flattening.

Run the complete source-tree suite with the optional dependencies required by the domains you want to validate:

PYTHONPATH=src:. python -m pytest -q
python scripts/gpu_smoke.py

The repository degrades unavailable optional engines to unknown or unavailable rather than fabricating success. FastMCP is required for MCP registration tests, z3-solver for SMT/proving/quantifier-elimination tests, and the compatible ANTLR runtime for SymPy LaTeX parsing. Domain-specific test modules and experiment runners can be executed independently when validating a particular mathematical surface.

Coverage includes parser and ambiguity handling, symbolic algebra and calculus, exact integer and finite-field arithmetic, graph algorithms, linear algebra, Numba/CUDA differential paths, asynchronous jobs, code generation and checking, GF(2) and finite Fourier methods, Koopman/finite dynamics, PRNG analysis, typed engineering mathematics, geometry/topology, statistics and stochastic systems, PDE/FEM/adaptivity, evidence propagation, persistence integrity, visualization, sonification, multimodal artifacts and the MCP tool surface.

CI targets supported Python versions with native thread fan-out bounded per worker. Distribution checks build the sdist and wheel, verify metadata, install the wheel in a clean environment, confirm the runtime version and check that vendored offline visualization/multimodal assets are present. Portable exports therefore do not require a CDN after installation.

• No raw user expression ever reaches sympify()/parse_expr(); restricted grammar,
  unknown functions rejected, ambiguous notation refused with candidates.
• Chunked arbitrary-length integer conversion; big-result output guards; bounded
  automatic number-theory work; obligation step ceilings; dependency/cycle validation.
• Sandboxed code execution is opt-in (MATHKERNEL_ENABLE_EXECUTION=1), runs in an
  isolated subprocess with a timeout, and is always labeled numeric evidence.
• Lean subprocess invocation uses shell=False; optional engines report
  unknown/unavailable rather than fabricating success.
• External native LP/QP/MILP, conic/QCQP, Riccati/LQG and numerical pole-placement
  candidate searches run in fresh interpreters whose process groups are killed
  on timeout. Requests/results are bounded and BLAS/OpenMP fan-out is capped.
• SQLite persistence checks every JSON payload with SHA-256 before decoding.
  canonical typed records additionally reconcile their declared object type, decoded
  model class, and source-link field before retrieval or execution. Corrupt or
  substituted records fail closed without producing derived objects.

This termination boundary is not a hostile-code sandbox and does not impose an
OS memory quota. Multi-tenant isolation still belongs in an external worker or
sandbox layer.

Copyright © 2026 Maarten Boone.

Released under the MIT License.