Vero: Can AI Agents Build Formally Verified Software Repositories?

2026-08-13

AI Summary

Current AI programming agents struggle to guarantee the correctness of generated code and lack evaluation frameworks for jointly synthesizing implementations and formal proofs within multi-module, real-world codebases. This work introduces Vero, the first repository-scale benchmark for formally verified code generation, establishing a novel evaluation paradigm that co-synthesizes implementations and proofs. Vero enhances reliability through an auditing mechanism based on specification unsatisfiability or reference implementation errors. Built on Lean 4, it encompasses languages such as Python, Dafny, Verus, and Coq, integrating formal specifications, API interfaces, and reference implementations. Experiments reveal that even the strongest existing AI agents fully solve only 27 out of 43 instances and fail to close any specification in the most challenging repository, highlighting significant limitations in repository-scale verified software synthesis.

Abstract

AI agents are increasingly used for programming, but do not provide any guarantee on the correctness of generated code. Verified code generation, in which an agent produces both an implementation and a machine-checked proof of its specification, offers a stronger path toward trustworthy AI-generated software. Existing benchmarks in this direction either focus on individual functions or only evaluate proof generation with provided implementations. It is still an open question whether agents can make coherent implementation and proof choices across real multi-module codebases. To bridge this gap, we introduce Vero, the first benchmark to evaluate joint implementation and proof synthesis at the repository level. Vero contains 43 multi-module instances sourced from real-world repositories spanning Python, Dafny, Verus, and Coq, and covering diverse domains from cryptographic protocols to distributed systems. Each instance consists of a multi-module Lean 4 repository with predetermined API interfaces, manually curated formal specifications, and reference implementations, supporting both proof-only and code-and-proof evaluation modes. To improve benchmark reliability, Vero also includes an audit mechanism where agents are allowed to formally prove unsatisfiability of provided specification or incorrectness of reference code, which surfaces and corrects latent code and specification errors during curation. We evaluate frontier coding-agent configurations with Lean toolchain access. The strongest agent fully solves only 27 of 43 instances and closes no specifications on the hardest repositories. Vero provides a concrete testbed for measuring progress toward repository-scale verified software synthesis, where current agents still fall short. We release the benchmark, curation pipeline, and evaluation harness at https://github.com/sunblaze-ucb/vero.

Problem

• verified code generation
• AI programming agents
• formal verification
• multi-module repositories
• proof synthesis

Innovation

• verified code generation
• AI programming agents
• formal verification
• repository-level synthesis
• benchmark