[
  {
    "question": "What does formal verification of a ZK circuit actually prove?",
    "answer": "A machine-checked theorem that the circuit's constraints match a written specification. The strong form is two theorems: soundness (every satisfying witness meets the spec, so no false proof is accepted) and completeness (every valid input has a witness, so honest provers are never blocked). Automatic tools such as Picus prove a weaker property, that outputs are uniquely determined by inputs, without a specification.",
    "anchor": "https://sorryfree.com/faq/#what-is-fv-zk"
  },
  {
    "question": "How is formal verification different from an audit?",
    "answer": "An audit is a time-boxed expert review that finds bug classes authors are blind to and reports on a specific commit; it does not prove absence of bugs. Formal verification proves a stated property for all inputs but only for the property stated and only inside its trusted computing base. Mature teams use both: an audit for the specification, integration and deployment surfaces, proofs for the gadgets and instruction sets that matter most.",
    "anchor": "https://sorryfree.com/faq/#fv-vs-audit"
  },
  {
    "question": "Which framework should I use for my proof system?",
    "answer": "AIR or Plonky3-style tables and zkVM chips: Clean (or sp1-lean if you are on SP1). Halo2: Halva. Noir: Lampe for proofs, NAVe for automatic checks. gnark: proven-zk. Circom: Picus, CIVER and Circomspect for automatic checks, Garden or Clean's forthcoming LLZK frontend for proofs. Cairo: StarkWare's Lean proofs cover the VM itself. Proof-system components (sum-check, FRI, Fiat-Shamir): ArkLib.",
    "anchor": "https://sorryfree.com/faq/#which-framework"
  },
  {
    "question": "Why is everything in Lean 4 now?",
    "answer": "The Ethereum Foundation's Verified zkEVM program funded most 2025 and 2026 circuit and proof-system verification in Lean 4 (Clean, zkLean, Halva, ArkLib, sp1-lean), StarkWare and Reilabs chose it independently, Mathlib supplies the field and polynomial mathematics, and AI proving tools target it. Rocq remains strong for implementation verification (Fiat-Crypto, Formal Land) and F* for HACL* and hax.",
    "anchor": "https://sorryfree.com/faq/#lean-vs-rocq"
  },
  {
    "question": "Do I need completeness or is soundness enough?",
    "answer": "You need both if a rejected valid input is a problem, which is true for wallets, bridges, rollups and anything with liveness requirements. Soundness alone is satisfied by an unsatisfiable circuit, so a soundness-only result must be paired with honest-path tests. Clean, zk.golf, Garden and CIVER's post-condition mode state completeness explicitly.",
    "anchor": "https://sorryfree.com/faq/#completeness-needed"
  },
  {
    "question": "How much does formal verification cost and how long does it take?",
    "answer": "Automatic checks (Circomspect, Picus, Kani) take hours to days of engineer time. A sound-and-complete proof of a hash gadget such as Poseidon or SHA-256 in Clean is weeks of proof engineering; a zkVM instruction set is months and ongoing. Costs scale with the size of the specification, not the size of the code, so writing the specification first is the best cost control.",
    "anchor": "https://sorryfree.com/faq/#cost"
  },
  {
    "question": "Can verified code still have bugs?",
    "answer": "Yes, outside the verified boundary. The February 2026 Verification Theatre paper found 13 vulnerabilities in verified libraries, four inside code covered by proofs, all in properties that were never specified. The SP1 JALR bug was inside a proven opcode whose theorem excluded misaligned targets. Read the theorem statements and the trusted computing base, and audit what they leave out.",
    "anchor": "https://sorryfree.com/faq/#verified-bugs"
  },
  {
    "question": "Can AI agents write these proofs?",
    "answer": "Increasingly. better.codes measures AI-driven progress on a real soundness bound with the Lean kernel as judge, zk.golf publishes an agent API for verified circuit optimisation, and the May 2026 Rust-to-Lean pipeline paper used AI provers on Plonky3 and RISC Zero code. The kernel check is what makes AI-written proofs trustworthy; AI-written specifications still need human review.",
    "anchor": "https://sorryfree.com/faq/#ai-proving"
  },
  {
    "question": "Which firms deliver formal verification for ZK and cryptography?",
    "answer": "In the order this index lists them: zkSecurity (Clean, zk.golf, better.codes), Galois (Cryptol/SAW, zkLean), Veridise (Picus, LLZK), Nethermind (Halva, SP1, EasyCrypt), Formal Land (Rocq, Garden), Cryspen (hax, libcrux), Reilabs (Lampe, proven-zk), Runtime Verification (K), Certora (contracts), Trail of Bits (Circomspect, audits) and Symbolic Software (Verifpal, protocol analysis).",
    "anchor": "https://sorryfree.com/faq/#who-does-it"
  },
  {
    "question": "What about post-quantum implementations?",
    "answer": "Verified ML-KEM and ML-DSA implementations exist in libjade (Jasmin/EasyCrypt), libcrux (hax/F*), AWS-LC (SAW, NSym, HOL Light), mlkem-native (CBMC plus s2n-bignum) and Apple corecrypto (Isabelle, SAW). If you ship your own, the relevant frameworks are Jasmin, hax, Cryptol/SAW, CryptoLine and CBMC, and the firms are Cryspen, Galois and Formosa Crypto collaborators.",
    "anchor": "https://sorryfree.com/faq/#post-quantum"
  }
]