66 theorems · 3 pillars · MIT
Proof Layer.
Mathematically verified marketing architecture.
Three mathematically independent proof pillars beneath the opua brand family products. Lean 4 theorems as formal proof of critical properties, KAN shadow models as cross-validation, AMDP audit hashes as a reproducible signature of every decision. Built for regulated industries where compliance explainability is not negotiable.
Why proof instead of only tests
Tests check samples. Proofs check all possible inputs.
A classical unit test answers the question: does my code work for these thousand examples. A formal theorem answers the question: does my code work for all possible inputs that can appear in production.
This distinction becomes the key question the moment a marketing agent autonomously allocates budgets at six- or seven-figure scale. nDSG Art. 22 and GDPR Art. 22 demand explainable automated decisions. A machine-checked proof is the most robust form of explainability deliverable today.
Three Pillars
Mathematically independent, organizationally connected.
01
Lean 4 Theorem Proofs
66 theorems productively verified
We formally verify critical properties of our auction engine and MMM pipeline with Lean 4, a theorem prover from Microsoft Research. Forty-seven theorems cover the Nexbid auctions (truthfulness, Pareto efficiency, manipulation resistance, revenue equivalence), nineteen further theorems address marketing mix modeling (budget conservation, non-negativity, determinism, monotonicity). The Lean compiler rechecks these proofs in every continuous integration pipeline run.
Repository: github.com/nexbid-dev/protocol-commerce · License: MIT
02
KAN Shadow Models
Interpretable ML as cross-check
Parallel to every Bayesian model runs a Kolmogorov-Arnold Network as an alternative, interpretable architecture on the same data. If the KAN recommendation deviates from the main model by more than fifteen percent, the system flags a discrepancy and blocks delivery. This is black-box avoidance with two mathematically independent models — not with a rhetorical promise.
Implemented in mmm-wizard and Nexbid · Open-source implementation follows in 2026
03
AMDP Audit-Hash Standard
Canonical signature of every decision
Every agent decision in our stack is hashed over the canonically serialized JSON representation of the full decision context — SHA-256, Ed25519-signed, with hybrid migration to ML-DSA-65 for post-quantum resistance from sprint six. This hash chain is reproducible bit-identically three months later and stands as proof for any compliance officer inquiry. AMDP — Agent Marketing Data Protocol — is the binding fabric between DCM, Nexbid, MMM-Wizard, and AiCMO.
Standardized within the opua brand family · Specification publicly available
Industry Gradation
Three safety levels — we operate at level 2.
Level 0
We don't test.
Surprisingly common in the marketing-tech industry — especially in AI features rolled out quickly.
Level 1
We test with unit and integration tests.
Industrial minimum. Checks samples, not all possible inputs. Edge cases can slip through.
Level 2
We check critical properties formally with a theorem prover.
This is the level at which we operate. The proofs are integrated into the CI pipeline and automatically block every merge on breakage.
In Which Products
Three products, same verification pattern.
Agentic Auctions
Nexbid
47 theorems
Truthfulness in the Vickrey-incentive sense, Pareto efficiency of allocation, manipulation resistance against coordinated bid strategies, conservation of bid budgets, determinism of the ranking function.
Budget Allocation
MMM-Wizard
19 theorems
Budget conservation across the full channel allocation, non-negativity of recommendations, determinism at identical seeds, monotonicity of channel recommendations.
Equity Recommendation
Mineralis
in preparation
Monotonicity against fundamental valuation metrics, determinism of the ranking function, no cyclic recommendation loops. Mineralis is our third product adopting the pattern — Lean 4 as a brand-family standard.
For Whom
Built for industries where provability is the entry ticket.
Banking
nDSG Art. 22 and GDPR Art. 22 demand explainable automated decisions. A machine-checked Lean 4 proof is the most robust form of explainability a software vendor can deliver today.
Insurance
FINMA requirements for algorithmic transparency in brand and customer communications. The reproducibility token enables bit-identical reconstruction three months after the fact.
Pharma
Off-label risks in agentic advertising, patient-communication mandates, EMA/Swissmedic-relevant audit trails. Provability as the ticket into the audit process.
Public Sector
Public-sector clients increasingly demand open-source components with verifiable security. MIT-licensed theorems as the answer to that requirement.
Frequently Asked Questions
Why Lean 4 and not another theorem prover?
Lean 4 unifies mathematical proofs and software verification in a single language. It has been productive since roughly 2021, established itself rapidly in academic mathematics (Liquid Tensor Experiment, Scholze theorem), and arrived in industrial use at Cloudflare, AWS, Linux kernel components, and smart-contract verification over the past two years. Coq and Isabelle would be methodologically equivalent, but tooling and community momentum favor Lean 4 today.Why MIT instead of proprietary?
Three reasons. First, trust signal: a compliance officer can inspect the theorems directly in the repository instead of trusting our marketing claims. Second, cross-brand efficiency: the same methodology is reused in Nexbid, MMM-Wizard, and Mineralis — open-source licensing simplifies internal reuse. Third, ecosystem contribution: we are not the first player using Lean 4 industrially, but we are the first in marketing tech — and we want the pattern to remain accessible to the industry.Why KAN as a shadow model instead of simply more tests?
Tests check samples against expected outputs. They do not detect when a model performs well inside the test samples but decides structurally wrong between them. KAN offers a second, mathematically independent architecture that computes in parallel and flags actively on model divergence. It is not 'more tests'; it is 'a second answer from a different mathematical family'.Are Lean 4 proofs accepted by real compliance officers?
In the industries where we are active — banking, pharma, insurance — yes. Compliance officers know the methodology from the crypto and security world. What is new is the application to marketing and allocation algorithms. With every engagement we provide the theorem IDs, the CI run IDs, and the repository commits so external validation is possible without vendor lock-in.What does a concrete proof artifact look like in an audit?
Three artifacts. First, the theorem file in the public repository with date, commit SHA, and Lean 4 proof script. Second, the continuous-integration run ID of the last successful proof run, accessible via github.com/nexbid-dev. Third, the reproducibility token of every concrete decision — a combination of input-data hash, config hash, and output hash that allows every run to be repeated bit-identically three months later. These three artifacts together are what we deliver to an internal audit.
Proof instead of gut feeling. Openly inspectable.
All 66 theorems are inspectable in the public repository under MIT. For CTOs, compliance officers, and tech investors we offer deeper theorem walkthroughs.