Pricing
Payoff logic, pricing kernels, discounting, and calibration paths become checked Chelis programs with explicit numerical assumptions.
First application
Finance
The first application is the options and derivatives desk. A wrong Greek moves hedges the same hour it reaches the desk; a curve that dips negative misprices a book quietly. C Proof exists for teams whose generated pricing and risk code cannot wait for a human to read every line.
The gap
The two-language problem
Research runs in Python. Production runs in C++. Compliance signs off on a document written in English. Every translation between them is a place for the model and the code to diverge, and generated code multiplies the translations. C Proof gives the desk one checked path: the model enters once, with provenance, and the code that runs is the code that was checked.
Application
Use cases
Greeks
Derivative calculations and AD paths check against type rules and implementation properties before generated code reaches a desk.
Risk
Scenario grids, portfolio constraints, exposure logic, and aggregation rules get reviewable properties instead of only regression tests.
Signals
Research signals and execution-facing transforms carry the compiler's structural checks into the build path.
Curves
Curve construction, interpolation, bootstrapping, and rate transforms tie to stated domains and repeatable provenance.
XVA
Cross-valuation invariants stated as checkable properties, evidence tier recorded, so model-risk review starts from a record.
Governance
The audit chain from approved specification to compiled binary. The person who signs off reads one artifact.
The canon
What must be true
An options model does not get to negotiate with financial mathematics. A canon of properties must hold: prices stay inside no-arbitrage bounds, parity ties calls to puts, more volatility never means a cheaper option. C Proof states each property as executable and routes it to the strongest evidence available. The C Note shows which hold under the stated assumptions, which break, and the input that witnesses each break.
A working canon for a vanilla options model. Each desk extends it with the properties its own models must satisfy.
| Property | What it says | Sketch |
|---|---|---|
| Non-negativity | No option is worth less than nothing. | price >= 0 |
| No-arbitrage bounds | A call stays between its intrinsic value and the underlying price. Outside those bounds there is free money. | max(spot - strike * df, 0) <= call <= spot |
| Put-call parity | Calls and puts at the same strike and tenor are locked together. The parity residual is zero. | call - put == spot - strike * discount_factor |
| Monotonicity in vol | Raising volatility never lowers the price of a vanilla option. | sigma_2 >= sigma_1 implies price(sigma_2) >= price(sigma_1) |
| Delta range | Call delta stays in [0, 1]; put delta stays in [-1, 0]. | 0 <= delta_call <= 1 |
| Vega and gamma signs | Vega and gamma are non-negative for vanilla options. | vega >= 0 and gamma >= 0 |
| Probability bounds | Terms that stand for probabilities stay in [0, 1]. | 0 <= n_d2 <= 1 |
How a result reads
holds SMT-proved
Intrinsic value
max(spot - strike, 0) >= 0 and max(strike - spot, 0) >= 0
The intrinsic-value kernels are non-negative. SMT-proved under declared domain assumptions.
holds SMT-proved, algebraic kernel
Put-call parity
residual = call - put - (spot - strike * discount_factor)
Residual proved zero for the checked algebraic kernel. Through the closed-form price path it runs as labeled validation.
holds sampled, not proven
Black-Scholes-style
closed-form price with exp, log, sqrt, and normal CDF
Kept as property-based validation with explicit preconditions and sample count.
breaks 1 witness
lower_bound_disc
C >= max(S - K * df, 0)
S 150.00 · K 50.00 · r 0.02 · sigma 0.15 · T 0.25 · model 100.2394 < bound 100.2494
From a worked example: a call priced deep in the money to exhibit a saturating CDF approximation. The desk reads the input that breaks the model, not a red build log.
Growth
From the options desk outward
The options desk is first. The same checked path extends to risk measurement, execution, treasury, clearing, and governance: each with its own canon of invariants the generated code must satisfy. The research page describes the category and the foundation underneath.
Next step