Why is it all in the kernel?
Summary
Lawrence C. Paulson analyzes the fragility and design of proof assistants, focusing on kernel safety, proof objects, and the history of recursion in type theory. The piece uses a Collatz conjecture episode and recent bugs as a springboard to discuss why much of formal verification relies on a kernel while proof objects often introduce complexity and risk. It surveys Lean, Isabelle/HOL, and MLTT-based approaches, arguing for careful engineering of the foundational layer over external certificates.