ZTL — Zero-Trust Logic

ZTL (Zero-Trust Logic) is a two-valued logic over marked inputs,
generated by one principle: truth is never granted on credit — a
connective returns T only if T is forced under every classical reading
of the unverified. There are exactly two truth values (verdicts are
always classical); the third symbol Z is a mark on an unverified input,
not a truth value. The mark is barred from the value of any compound
(the greediness theorem, machine-checked): above the atoms the algebraic
value already is the logical value, so — beyond Suszko's logical
two-valuedness, which every structural logic has — ZTL is bivalent on
compounds by construction. Its identity among the three-valued matrices
is precise and machine-checked at its cause: a single rule, ¬¬p ⊨ p,
separates its consequence relation from each of its four
involutive-negation neighbours (K3, LP, weak Kleene, Łukasiewicz Ł₃),
and by one lemma from any three-valued matrix with involutive negation.

That the logic is not arbitrary is evidenced case by case: six
independent engineering traditions — IEEE 754 NaN, SQL NULL, taint
tracking, abstract interpretation, imprecise probabilities, and
provenance semirings — have each reinvented a fragment of the same
discipline, and for each the core reproduces its central move on a
worked case (we argue, and do not claim to have proved, that each
implements a fragment of one logic).

For this logic the preprint builds: the measured price list of classical
laws (12 survive, including modus ponens; 14 fall — all "truth from
form"); the split between rules and laws with a one-directional deduction
theorem for the primitive arrow; a signed tableau calculus with
machine-proven soundness, completeness and cut admissibility; an
algebraic passport — expressive completeness of the external layer, a
definable implication with the full deduction theorem, Craig
interpolation, and the Blok–Pigozzi conditions verified on the matrix
(ZTL is algebraizable, yet not self-extensional); quantifiers over finite
and arbitrary domains; first-order identity (a = predicate whose
reflexivity is an earned verdict — self-identity falls to Z on an
unverified reference — while Leibniz's law licenses substitution only
through an earned equality) and free logic with definite and indefinite
descriptions (a non-denoting term takes the mark, not F and not a gap;
existence is earned self-identity; excluded middle on a non-denoting atom
is F — the greedy collapse setting ZTL apart from the neutral free-logic
school; Hilbert's ε earns denotation exactly when a witness exists);
modal and probabilistic identifications, including the necessity of
identity for earned equalities and rigid designation as the modal face of
existence; a theory of verification (a verdict is a pair "value +
warranty": sound — never lies; hereditary — never revoked) and of
evidence combination (conflict is never renormalized); and a quarantine
passport typing every refusal by its genesis — paradox, intrinsic,
underdetermined, unverified input, inherited — with a measured stipulation
theorem. The classical paradoxes (the liar, Jourdain's carousel, Curry,
Yablo, the crocodile, Russell) receive a uniform diagnosis: pointwise
quarantine instead of explosion.

The entire development — twenty-one Lean 4 modules — is machine-checked
with an EMPTY axiom list (no classical choice, no quotients, not even
propositional extensionality; definitions included): 371 theorems, each
audited individually. Every numerical claim is reproducible by the
repository's regression (62 test stands); an interactive studio (natural
language → the ZFL formal language → the measured core) ships with the
repository.

Functionally the {not, and, or} fragment coincides, cell by cell, with
the external layer of Bochvar's logic (1938) — a kinship found in the
literature search after the tables had been generated, not a source; the
contribution is the generating principle, an implicational floor outside
the Rosser–Turquette standardness conditions, the calculus, the machine
verification, and the bridges to the engineering traditions.

What is new in v1.3 — the preprint is reframed to lead with the logic
and its precise identity, presenting the six engineering traditions as
evidence that it is not arbitrary rather than as the opening motivation.
Two positioning results settle the "is it really its own bivalent logic"
question. First, the SUSZKO POSITIONING (§4): Z is a mark, not a third
truth value; every structural logic is logically two-valued (Suszko's
thesis), and ZTL's stronger, truth-functional fact is that the mark never
reaches the value of a compound at all (the greediness theorem,
evalF_classical, empty axiom list) — the reduction has nothing left to do
above the atoms. Second, the SIGNATURE (§4): a single rule, ¬¬p ⊨ p,
separates ZTL's consequence relation from each of its four
involutive-negation neighbours — and, by one lemma (involution_gives_dne,
empty axiom list), from any three-valued matrix with involutive negation;
the cause is a broken involution, ¬¬Z = T. The scope is kept honest: the
non-involutive kin, external Bochvar, shares the broken involution, so the
two part in the implication fragment, not on this rule.

Also new in v1.3, extending the first-order layer, all machine-checked on
the empty axiom list: FIRST-ORDER IDENTITY (§24, ZEq.lean) — a = predicate
whose reflexivity falls to Z on an unverified reference (self-identity is
earned), whose symmetry splits into a surviving rule and a failing
biconditional law, and whose Leibniz substitution is salva veritate but
never through the mark; FREE LOGIC WITH DESCRIPTIONS (§25, ZDesc.lean,
ZEps.lean) — a non-denoting term takes the mark; existence is earned
self-identity ("no entity without identity", made literal); excluded
middle on a non-denoting atom is F, not the supervaluational super-true;
the definite description ι denotes by earned uniqueness and Hilbert's
indefinite ε by an earned witness (ε denotes exactly when the existential
is earned), the empty choice earning only the mark; and MODAL IDENTITY —
the necessity of identity (Kripke) holds for every earned equality, rigid
designation is the modal face of existence, and once more ZTL parts from
supervaluation. The corpus grows to 371 theorems across twenty-one Lean
modules, all on the empty axiom list; regression now 62 stands + Lean.

What is new in v1.2 — first, the TEMPORAL LAYER. ZTL's only clock is the
arrival of ground: one tick = one verification. The warranty ladder is
read as a system of temporal quantifiers — until-verification = true
now, sound = true at every ending, hereditary = true always along every
path — with the absorption and arrow theorems machine-checked
structurally (ZTime.lean, empty axiom list; every completed
verification path ends hereditary). An expiry event returns earned
ground to the mark and splits time into epochs — the knowledge
chronology (learning about the same world) versus the validity
chronology (the world changing) — and the EPOCH BOUNDARY THEOREM
(EpochBoundary.lean, empty axiom list, structural for every formula of
the language) states: a verdict invariant across unrestricted epoch
crossing is constant — it reads none of its grounds; non-trivial
guarantees require the boundary, which is thereby a logical necessity,
not an administrative convenience. The layer is priced for use: early
settlement (once hereditary, remaining checks buy nothing),
expiry-insurance (a shortcut's savings are a loan against its
expirable ground), the ungrounded verification event (the closed-world
loan "no proof of revocation, hence not revoked" cannot enter the
logic — an argument from absence never yields T — and is exposed in
the event ledger). And a price list of DERIVATIONS: forward chaining
over the 12 alive rules shows they are transport, not creation — from
the empty premise set nothing is derivable even with the fallen rules
as loans, ZTL's own guarded tautologies included; the classical
step invisible from inside (double-negation elimination) becomes a
priced borrowing with a named creditor. New sections 21-23; the
ZFL language gains a verification timeline played into chronicles;
regression now 40 stands + Lean.

Also new in v1.2: the central construction is named — the
zero-trust lift (§2), with its disambiguation from the strict (Kleene)
lift; §3.8, an explicit Lean-verified census of the sixteen lifted binary
connectives that re-derives Finn's completeness landscape for the
external-Bochvar class (Studia Logica 1974): solo-completeness tracks
non-commutative directionality — Sheffer's stroke and Peirce's arrow
fall (both stall in one shared 18-table cage), both implications and
both abjunctions survive — with the kernel clone equalities
machine-checked on the empty axiom list (lean/ZClone.lean), the
surviving basis read as the credit detector; the
fence-depth theorem (§19): the hereditary warranty is checkable at
depth exactly m−1 and no constant-depth fence exists (the guard
family over the fallen law of identity); the warranty ladder
stress-tested at scale (151.8M pairs, 0 violations); the three-laws
capstone (§3.1): of the classical triad only non-contradiction
survives the lift — a denial is free, an affirmation is on credit;
§11 opened by the paradox engine: paradox(f) = ground(S = f(S)), the
expeditions as the range of one construction, with the verified
containment (ZTL-settled nets are a strict subset of the classically
categorical ones; stand pengine.py); the honest
Bochvar ledger (§4): the {¬,∧,∨} coincidence found post hoc, not a
source, now joined by the Łukasiewicz pedigree — the tables are
Bochvar's, the MEANING of the mark Z descends from Ł₃'s "possible /
not yet determined" (ref [36]), and the genetic order of the alphabet
reads N, Z, F, T: nothing → doubt → free denial → earned affirmation;
and the passport's phase letter glossed (§10): read N as
Not-yet — Kleene's undefined by intent housed as a phase — with errors
typed as interface events (the premature read of a phase; signaling
NaN is the cousin), not as a logical letter.

What was new in v1.1 (same-day self-correction): §19 is corrected —
the verdict warranty is a two-grade ladder (sound / hereditary). The
v1.0 claim "stability-by-supervaluation ⟺ invariance under
verifications" (90/90) was a fact about that section's 10-formula
pool, not a law: it is falsified by the or(ladder, gap) cells, e.g.
¬¬p ∨ (q∨¬q), found by the identity atoms of the operational-sets
expedition (E21) on a 3303-formula pool and cross-checked with the
section's own instruments. The sound half of the warranty survives
(a sound verdict never lies); only hereditary invariance buys shelf
life. The correction was found the day of v1.0's publication and is
released after three further expeditions leaned on the corrected
machinery and it held.

AI disclosure: this work was carried out with the substantial
participation of the AI system Claude (Anthropic) in a dialogue
setting; all design decisions, fork choices, and final responsibility
rest with the human author. The reliability of the results does not
depend on trusting the AI: every claim is checkable by the repository
code and the Lean 4 kernel.