A Mechanised and Constructive Reverse Analysis of Soundness and Completeness of Bi-intuitionistic Logic

Using the Coq proof assistant, we investigate the minimal non-constructive principles needed to show soundness and completeness of propositional bi-intuitionistic logic. Before being revisited and corrected by Goré and Shillito, the completeness of bi-intuitionistic logic, an extension of intuitionistic logic with a dual operation to implication, had a rather erratic history, making it an ideal case for computer mechanisation. Moreover, contributing a constructive perspective, we observe that the completeness of bi-intuitionistic logic explicates the same characteristics already observed in an ongoing effort to analyse completeness theorems in general.


Introduction
Bi-Intuitionistic Logic (BIL) extends intuitionistic propositional logic with a binary operator , dual to →, variously called exclusion, subtraction, or co-implication.While BIL is a conservative extension of intuitionistic logic, it does not satisfy the disjunction property: the formula ∨ ∼ , where ∼ is the bi-intuitionistic negation, is a theorem of BIL.Thus, this logic sits in between intuitionistic and classical logic, being tightly connected to both.
Historically, Klemke was certainly the rst to introduce this logic [24].However, it was Rauszer who really laid its foundations through a series of interdependent articles [34][35][36][37][38][39][40], from 1974 to 1977, culminating in her Ph.D. thesis in 1980 [41].In her work, she characterised this logic under various aspects: axiomatic calculus, algebraic semantics, sequent calculus, and Kripke semantics.Alas, Rauszer's foundations for BIL are quite shaky.Several critical mistakes were later detected in her work: a counterexample to her claim of admissibility of cut for the sequent calculus [30], confusions about the holding of the deduction theorem in BIL [9], issues in completeness proofs [9].Thus, it is fair to say that the history of BIL is a troubled one.
In particular, the mistakes in Rauszer's completeness proofs went unnoticed for almost 50 years: it is only in 2020 that Goré and Shillito (the rst author of the present paper) exposed them and provided a correct completeness proof [9].However, their proof was not mechanised and visibly relied on classical logic as the metalogic.
The mechanisation of Goré and Shillito's proof was only carried on by Shillito three years later in his Ph.D. thesis [44], in the interactive theorem prover Coq [46].Without a doubt, this mechanisation brings a qualitative change to the penand-paper completeness (and soundness) proof: it is brought to the highest standards of reliability, as each single step in the proof is now unambiguously mechanically checked.In addition to that, it helps approximate the level of nonconstructivity involved from above: the library Classical for classical logic is invoked in various places, supporting the multiple uses of the law of excluded middle (LEM) throughout the proof.
As a consequence, we can safely assert that the result of completeness for BIL has a de facto non-constructive certied proof.The perspective of constructive reverse mathematics [3,18] then suggests the following approximation from below: which non-constructive principles, if any, are necessary for this completeness result?Incidentally, a similar question can already be asked about the soundness result, as some axioms of BIL concerning have a classical avour that is not interpretable in a fully constructive meta-logic.
In this paper, we investigate the minimal non-constructive principles used to show soundness and completeness of BIL.Our investigations are led using the interactive theorem prover Coq, which is a perfect framework for constructive reverse mathematics, as it is based on a rather agnostic constructive type theory that allows ne sub-classical distinctions.In particular, constructive proofs in Coq can be extracted to executable programs, which for the speci c case of completeness could in principle take the form of rei cation algorithms turning meta-level (semantic) proof terms into object-level (syntactic) derivations.This method has already been used extensively in the case of rst-order logic and related formalisms, by Herbelin and Ilik [14] and others [8,11,15,19].We show that similar observations apply to BIL.
More concretely, we consider an alternative formulation of the Kripke semantics for BIL, which is classically equivalent to the traditional version, but intuitionistically weaker.For this formulation, we show that arbitrary soundness and completeness are equivalent to LEM.Soundness can be given a constructive proof if we restrict our attention to de nite models, i.e. models which have a de nite forcing relation or, more general, to models that at least interpret in accordance to its characterising axioms.On the other hand, as intermediate steps of the completeness proof, model existence is equivalent to the weak law of excluded middle (WLEM) while quasi-completeness is equivalent to the even weaker principle "weak law of excluded middle shift" (WLEMS) that has been identi ed by Kirst [19] and studied in the context of rst-order logic by Herbelin and Kirst [15].Finally, the logical strength of completeness restricted to semi-decidable contexts is connected to Markov's principle (MP) [26] and, as a preliminary approximation, bounded by WLEMS from above and a version of WLEMS for semi-decidable predicates from below.
In Section 2, we sketch the constructive type theory we use as foundation and discuss some non-constructive principles and computational notions.Section 3 introduces the basics of bi-intuitionistic logic.Notably, we present the results of the mechanisation of Shillito.The results in constructive reverse mathematics we obtained are presented in Section 4. Finally, we provide concluding remarks in Section 5, including a discussion of the Coq mechanisation as well as related and future work.Our mechanisation is presented here: h ps://ianshil.github.io/CPPBiInt/.All mechanised results are accompanied by a clickable keyboard symbol "( )" leading to their mechanisation.

Preliminaries
We work in a constructive type theory such as the calculus of inductive constructions (CIC) [2,29] underlying the Coq proof assistant [46] and, in this preliminary section, sketch the features we need.To begin, we assume a predicative hierarchy of computational types closed under the usual type formers like (dependent) function types and (dependent) pair types.We further assume an impredicative universe P of propositions in which the above type formers take common logical notation.Inductive types and predicates can be formed via a general scheme, for instance to accommodate the types N of natural numbers, B of boolean values, and of nite lists over a given type.Elimination of inductive predicates into computational types is only allowed if no computational information is present, so for instance for equality = but not for disjunction ∨ or existential quanti cation ∃ . .The logic represented in P is constructive but also agnostic, so in particular LEM is not provable but it can be assumed consistently.In Figure 1, we list a few more unprovable principles that play a role in the characterisation of completeness results.While LEM states that every proposition is de nite, i.e. satis es ∨¬ , double negation elimination (DNE) states that every proposition is stable, i.e. satis es ¬¬ → .In that wording, Markov's principle (MP) states that solvability of boolean sequences is stable and weak excluded middle (WLEM) states that negative propositions are de nite.While these four principles are standard, weak excluded middle shift (WLEMS) has only recently been identi ed as the exact logical strength of a certain formulation of completeness [15,19].The name hints at the equivalent formulation of WLEMS as for predicates taking the form of weak excluded middle.Lifting the wording of de nite and stable propositions to predicates in the canonical way, we may also describe WLEMS as not not de niteness of stable predicates.
Underlying the above equivalent formulation of WLEMS via the provable premise ∀ .¬¬(¬ ∨ ¬¬ ) is a generally noteworthy observation in constructive logic: while not every proposition can be shown to be de nite, every proposition is not not de nite, i.e. the principle ∀ : P. ¬¬( ∨ ¬ ) is provable.As a consequence, when proving negative goals, we have limited access to classical reasoning since for nitely many propositions we may assume ∨ ¬ .This will be of use and clearly verbalised in several proofs.
We collect a few simple facts about the given principles: Lemma 2.1.The following connections are provable.
• Every de nite proposition is stable.
• LEM is equivalent to DNE.
• LEM implies both MP and WLEM.
Just like every constructive foundation, the sketched type theory allows for a synthetic perspective on computability theory [1,7,42]: every de nable function is computable by construction, so we can develop the usual notions and results without reference to a concrete model of computation such as Turing machines.Next to allowing an elegant mathematical development, this approach is particularly helpful when using a proof assistant, since working with a formal model of computation introduces considerable mechanisation overhead.For this paper, we only introduce the synthetic notion of semi-decidability: De nition 2.2.A proposition : P is semi-decidable if there is a boolean sequence : N → B with ↔ ∃ .= and a predicate : → P is semi-decidable if there is family of boolean sequences : The idea is that the boolean sequences : N → B are considered to be computable, so for a semi-decidable proposition it is possible to e ectively recognise its truth by systematically searching through all numbers for a solution of , while there is no way to e ectively determine if no such solution will ever be found.Since MP controls the behaviour of boolean sequences, it also controls the behaviour of semi-decidable propositions: Lemma 2.3.MP implies that semi-decidable propositions and predicates are stable.
Note that the employed synthetic view on semi-decidability is justi ed by two observations.First, every concrete semidecider : N → B de nable in CIC is indeed computable in the usual sense referring to a model like Turing machines.Secondly, if we were to formally de ne Turing machines within CIC, it could be shown that every object-level semidecision procedure conversely induces a corresponding metalevel function : N → B.

Basics of Bi-intuitionistic Logic
We present the basics of bi-intuitionistic logic: its syntax, axiomatic proof system, Kripke semantics and known facts of relevance.

Syntax
As mentioned above, bi-intuitionistic logic is expressed in the language of intuitionistic logic extended with the exclusion operator .More formally: De nition 3.1.( ) We de ne the propositional language L and obtain its inductive type of bi-intuitionistic formulae through its grammar: Here we use dots to distinguish the object-level connectives of bi-intuitionistic logic from the meta-level connectives of the ambient type theory.We also de ne the abbreviations ¬ := ( → ⊥) and ∼ := ( ⊤ ), respectively called negation and weak negation.
The added binary operator is intended to be the dual of → and is usually read as " excludes ".Consequently, ∼ is also de ned dually to ¬.
Note that our language is built on a countably in nite set of propositional variables, i.e. the set of natural numbers N.This has two e ects: it makes our set of formulae countably in nite, hence enumerable, and gives us decidability of equality on formulae.

Axiomatic Calculus
When considering logics as consequence relations, traditional Hilbert calculi become inadequate proof systems.They are designed to capture logics as sets of theorems, i.e. sets of the form { : ⊢ }, and notably led to historical confusions once considering sets of the form {(Γ, ) : Γ ⊢ } [9,12].
Generalised Hilbert calculi manipulate expressions Γ ⊢ , called consecutions, where Γ is a set of formulae called a context.They clearly express the distinction between the notion of deducibility from a set of assumptions, and theoremhood.They avoid the confusions of traditional Hilbert calculi, pertaining notably to the deduction theorem [9].Still, they correspond to traditional Hilbert calculi when restricted to consecutions of the shape ∅ ⊢ .
The generalised Hilbert calculus BIH [9] ( ) for BIL extends the one for intuitionistic logic, containing the axioms 1 to 10 (implicit here), with the axioms 11 to 14 and the rule (wDN), shown in Figure 2. There, A in the rule (Ax) refers to the set of all instances of axioms.In the following we write Γ ⊢ to mean that the syntactic expression Γ ⊢ is provable in BIH, i.e. there is a tree of consecutions built using the rules in Figure 2 with instances of (Ax) and (El) as leaves.We also abbreviate ¬(Γ ⊢ ) by Γ ⊬ .We formally de ne the logic BIL as the set {(Γ, ) : Γ ⊢ }.
Note that our calculus BIH is the calculus wBIH of Goré and Shillito [9].In their work, they also consider a stronger system called sBIH, obtained by modifying the premise of the rule (wDN) to Γ ⊢ .As the letters w and s are only used Generalised Hilbert calculus BIH for BIL to distinguish the two calculi, we drop w in this paper for simplicity.

Kripke Semantics
We proceed to de ne a Kripke semantics for BIL which slightly departs from the traditional one [41].The latter was used in Shillito's mechanisation [44].
Both the traditional semantics and ours are de ned using (Kripke) models which are identical to the ones of intuitionistic logic, as shown below.
Our semantics extends the forcing relation of intuitionistic logic to in the following way.
De nition 3.3.( ) Given a model M = ( , ≤, ), we dene the forcing relation M, ⊩ between a world ∈ and a formula as follows: Crucially, while the semantic clause for → looks forwards on the relation ≤, the clause for looks backwards.This circumstance shows that BIL shares similarities with tense logic [31][32][33].
Note that our semantic clause for is intuitionistically weaker but classically equivalent to the traditional clause [41]: Two points motivate our clause.First, our mechanisation led us to believe that the strength of the traditional clause more readily forces one to use non-constructive principles, notably in the proof of the Truth lemma 3.10.Second, to our eyes the duality between → and is more visibly expressed in our clause.Indeed, it is obtained in two steps via the negation of the clause for → , and the reversing of the order between and , witnessing the tense logic avour of .The main feature of the Kripke semantics for intuitionistic logic, i.e. persistence, is preserved in our semantics for BIL.
We abbreviate ¬(Γ |= ) by Γ ̸ |= .Note that by distributing the quanti cation over to the antecedent and consequent of the implication, we obtain the global consequence relation.The latter corresponds to the generalised Hilbert calculus sBIH [9].

Constructive Proof-theoretic Results
Here, we present constructively-obtained proof-theoretic results from the mechanisation of Shillito [44].They express properties of the proof system BIH.We reuse these properties when considering our semantics later on in the paper.
Unsurprisingly, we can prove that BIL is a nitary logic: it satis es identity ( ), monotonicity ( ), compositionality ( ), structurality ( ), and niteness ( ) [6,25].These properties are expressed below, where : N → is a uniform substitution and ⊆ is the nite subset relation (which we also use with a list on the left).
To present the next results in an elegant way, we need to introduce some helpful derived notions.De nition 3.5.( ) Let Δ be a list of formulae.We de ne : → recursively on the structure of Δ: The function essentially creates the disjunction of all the members of a list of formulae, with an additional disjunct ⊥, the neutral element of ∨ .Using , we can bring consecutions Γ ⊢ to a fully symmetric setting via pairs of the shape [Γ | Δ], constituted of a left and right context.De nition 3.6.We de ne the following: While these pairs are crucially used in the completeness proof, as we shall see, they are already convenient to express interesting properties of BIH.Theorem 3.7.We have the following: (1) above shows that a bi-intuitionistic version of the law of excluded-middle holds in BIL ( ). ( 2) is an object language analogue of the algebraic dual residuation property below ( ).

Non-constructivity and Traditional Semantics
Then, we turn to the non-constructive results from Shillito's mechanisation [44].These results involve the traditional semantics, and use the full strength of classical logic via multiple applications of LEM.Note that in the presence of LEM, both versions of the semantics are equivalent, suggesting the relevance of Shillito's results to our work.The most important of these results are soundness and completeness.
Soundness is proved as usual by showing that all axioms are valid and that rules of BIH preserve semantic consequence.Here, the non-constructivity appears through LEM in the proof of the validity of the axioms 11 , 13 and 14 .
Completeness is proved via a canonical model construction, which has relative consistent and complete pairs [Γ | Δ] as points [43]: De nition 3.9.The canonical model M = ( , ≤ , ) is de ned in the following way: The canonical model satis es the crucial truth lemma, relating elementhood and forcing.
Finally, we compile the results above to obtain an intermediate result, called model existence.
The assumption Γ ⊬ easily allows us to obtain ⊬ [Γ | ], on which we can apply Lemma 3.11.The obtained complete and relative consistent pair can thus be found as a point in the canonical model, which forces Γ but not as indicated by Lemma 3.10.
Given that model existence is classically equivalent (but intuitionistically weaker) to completeness, we have reached a non-constructive proof of the latter.In a similar way, we could use the following intermediate result, yet weaker than model existence, to obtain completeness.

Quasi-completeness Γ ⊬ → Γ ̸ |=
As mentioned above, the mechanisation of Shillito [44] heavily used LEM in all of the results pertaining to the traditional semantics.In the remainder of this paper, we use Shillito's work as a basis but modify it to our more constructive semantics.On this ground, we proceed to determine equivalences between variants of soundness and completeness results and non-constructive principles.

Constructive Reverse Mathematics Results
In this section, we take a closer look at the non-constructive principles underlying the soundness and completeness properties of BIH.In the case of soundness, we show it equivalent to full LEM, while completeness, though in full generality also equivalent to LEM, can be broken down into weaker forms equivalent to weaker logical principles.Moreover, we provide a preliminary characterisation of completeness restricted to semi-decidable contexts.Most of these observations have already been observed and mechanised for related logical formalisms [8,11,14,15,19].To allow a meaningful analysis, all proofs in this section are constructive where not explicitly stated otherwise.

Soundness
Starting with soundness, we observe that the required classical reasoning can be assumed as a property of the targeted models M, for instance in requiring that they be de nite, meaning that they satisfy M, ⊩ or M, ⊮ for all .
Lemma 4.1.( ) BIH is sound for de nite models.
Proof.We show Γ |= by induction on a given derivation of Γ ⊢ .The validity of the inference holds constructively using routine arguments and so does the validity of all axioms but 11 , 13 , and 14 .
• For 11 we need to show that assuming M, ⊩ we have either M, ⊩ or M, ⊩ .To proceed, we use the de niteness of M to distinguish whether M, ⊩ or M, ⊮ .In the former case we are done, in the latter case we show M, ⊩ , so for a contradiction we assume that M, ′ ⊩ implies M, ′ ⊩ for all predecessors ′ ≤ .For the choice ′ := we thus obtain M, ⊩ , in contradiction to the assumption M, ⊮ .
• For 13 we need to show that M, ⊩ ( ) implies M, ⊩ ∨ .So for a contradiction we assume that M, ′ ⊩ implies M, ′ ⊩ ∨ for every predecessor ′ ≤ and derive a contradiction by using the assumption M, ⊩ ( ) .Hence we need to show that for every predecessor ′ ≤ with M, ′ ⊩ we have M, ′ ⊩ .By de niteness of M, it su ces to refute M, ′ ⊮ .Now applying M, ′ ⊩ , we assume M, ′′ ⊩ for some ′′ ≤ ′ and need to show M, ′′ ⊩ .Then since by transitivity ′′ ≤ , we obtain M, ′′ ⊩ ∨ , so either M, ′′ ⊩ which is the desired claim, or M, ′′ ⊩ which yields a contradiction to M, ′ ⊮ via persistence.
• For 14 we need to show that M, ⊩ ¬( ) implies M, ⊩ → .So for some successor ′ ≥ we assume M, ′ ⊩ and show M, ′ ⊩ by deriving a contradiction from M, ′ ⊮ , once more employing the de niteness of M. Applying the assumption M, ⊩ ¬( ) for ′ it then remains to show M, ′ ⊩ , which follows from M, ′ ⊩ together with M, ′ ⊮ .□ In fact, it is straightforward to show that BIH is sound for the class of BIH-models, de ned as satisfying the critical axioms 11 , 13 , and 14 , which we conjecture to be a strictly larger class than the de nite models.In any case, it is the largest class of models that BIH is sound for.
Proof.The soundness proof is by induction as in Lemma 4.1, this time the critical axioms are treated by the assumption of M being a BIH-model.Conversely, if BIH is sound for some M, then M satis es all axioms and hence in particular is a BIH-model.□ While it is possible to localise the use of classical logic to establish soundness in the discussed sense, in full generality all the strength of LEM is necessary.Proof.To obtain soundness from LEM, we just observe that in the presence of LEM every model is clearly de nite, so we just apply Lemma 4.1.
For the converse, assuming a proposition , we consider the trivial model M with a single world and interpretation function ( ) := { : }, i.e. the set of all such that holds.Since ∅ ⊢ ∨ ∼ is derivable for every formula by (1) of Theorem 3.7, soundness for the trivial model in particular yields that M , ⊩ ∨ ∼ for every variable .Now given that has no predecessors, this actually either yields M , ⊩ , from which we derive , or M , ⊮ , from which we derive ¬ .□ Corollary 4.4.If all models are BIH-models, then LEM holds.
We remark that the failure of general soundness to hold constructively suggests that the class of BIH-models provides the reasonable semantics for BIH.As a price of this suggestion, however, the reasonable formulation of completeness will also only refer to BIH-models and is therefore potentially harder to prove.In the next section we will show that this restriction imposes no actual problem though, since the employed canonical models are BIH-models by construction.

Completeness
We rst explain why completeness in full generality is equivalent to LEM.To this end, we observe a localised connection between completeness and double negation elimination.Lemma 4.5.Let C : P → P be a class of propositions.We call Γ a C-context if for every there is in C with ∈ Γ i .Then completeness for C-contexts turns all in C stable.
Proof.Assume completeness for C-contexts and a proposition in C with ¬¬ .We consider the context Γ := { ⊥ : } that contains the falsity constant ⊥ i holds, so in particular Γ is a C-context.Now we rst observe that Γ |= ⊥, since, given any model M and world with M, ⊩ Γ, showing M, ⊩ ⊥ means to derive a contradiction, so we can argue classically enough to actually derive from ¬¬ and since then ⊥ ∈ Γ, we obtain the desired contradiction by M, ⊩ Γ.But then the assumed completeness implies Γ ⊢ ⊥ and so in particular Γ ′ ⊢ ⊥ for a list Γ ′ ⊆ Γ.If Γ ′ is empty, we obtain a contradiction from ∅ ⊢ ⊥ since a trivial model constructively entails the consistency of BIH using soundness for de nite models (Lemma 4.1).If, on the other hand, there is some ∈ Γ ′ , then we actually obtain ⊥ ∈ Γ and thus by de nition, so we successfully eliminated the double negation from ¬¬ .□ The connection between completeness and LEM is then nothing but a special case of the observed phenomenon.We remark that the here observed classicality of completeness solely relies on the interpretation of ⊥ as ⊥ [26], which could be relaxed to so-called exploding models [47], a slightly generalised semantics for which this e ect is circumvented.To disentangle from the interpretation of ⊥ and analyse the orthogonal reasons for non-constructivity induced by the interpretation of ∨, we now investigate the intermediate steps of the completeness proof, namely the Lindenbaum lemma, model existence, and quasi-completeness, for which the interpretation of ⊥ does not matter.We begin with the strongest form of the Lindenbaum lemma that can still be proven fully constructively, where most crucially we cannot obtain actual primeness of the extended context Γ ′ (i.e. that ∨ ∈ Γ ′ implies that ∈ Γ ′ or ∈ Γ ′ ).• Relative consistency: Proof.We construct Γ ′ by iteration, using an enumeration of formulas and letting Γ 0 := Γ: where the seemingly classical case distinction is captured constructively by the proposition characterising membership in Γ +1 .We then set Γ ′ := :N Γ , and rst observe Γ ′ ⊇ Γ by construction.Before turning to the remaining properties one-by-one, note that ⊬ [Γ ′ | Δ] is preserved inductively.
• For deductive closure, assume that Γ ′ ⊢ .This entails that when is considered at in the enumeration of formulae, then it must be added to Γ +1 : indeed, we can prove that Next, by N we refer to the canonical model constructed as in De nition 3.9, but now formed over the consistent (i.e.Γ ⊬ ⊥), deductively closed, stable, and prime contexts Γ ordered by inclusion, in contrast with the relatively consistent and complete pairs of M .The relation and interpretation of N are thus obtained from restricting those of M to contexts.The realisation that one can shift from pairs to contexts in the canonical model, absent from Shillito's work, was made through a careful analysis of the Lindenbaum lemma 3.11: there, the extended pair is constructed by extending solely the left context, and in the last step taking its complement as the right context.
First note that deductive closure in particular implies that N satis es the critical axioms 11 , 13 , and 14 , so N is a BIH-model and thus usable for completeness statements even when restricting to that class.Moreover, the requirement of primeness is strictly necessary, since it exactly states the disjunction case of the truth lemma for N .In light of the mismatch of the Lindenbaum lemma only yielding quasi-prime extensions, we therefore need to make additional assumptions.In a rst approximation, we use WLEM to completely bridge the gap.Lemma 4.8.Assuming WLEM, every stable, quasi-prime context is prime ( ).In consequence, the left context of every relative consistent pair [Γ | Δ] extends into a world of N and the truth lemma for N can be proven ( ).
Proof.Let Γ be stable and quasi-prime.To show primeness, we suppose ∨ ∈ Γ and need to derive ∈ Γ or ∈ Γ.We use WLEM to decide whether ∉ Γ or ¬( ∉ Γ).In the latter case, we immediately have ∈ Γ by stability.In the former case, we show ∈ Γ so by stability we may assume ∉ Γ to derive a contradiction.This contradiction follows from quasi-primeness yielding ¬¬( ∈ Γ ∨ ∈ Γ) while we have both ∉ Γ and ∉ Γ.
To provide some intuition, the truth lemma for N stating is proven by induction on the formula as in the fully classical proof and we only describe the crucial localisation of classical reasoning in the Lindenbaum extension and to establish goals of the form ∈ Γ and ∉ Γ via proof by contradiction.The former, needed in the cases of implication (backwards) and exclusion (forwards), actually poses no problem by the previous observation that WLEM is enough to extend consistent pairs into pairs whose left contexts are worlds.The latter, needed for the backwards direction of both implication and exclusion, can be replaced by stability of Γ and its complement.□ Note that in this setting the truth lemma could be established even for the traditional (existential) interpretation of since there are no restrictions in which context the Lindenbaum extension is applicable.
By the previous lemma, using WLEM the canonical model N can serve as a witness for model existence and in fact WLEM turns out to be necessary for that property in general.
For the converse, we assume a proposition we want to show WLEM for.For a xed propositional variable , we set Since consistency is a negative property, for that intermediate claim we may actually assume ∨ ¬ .This assumption allows us to show that the trivial model M already used for Theorem 4.3 is classical and satis es Γ, so we can rule out Γ ⊢ ⊥ using soundness for de nite models (Lemma 4.1).Now model existence can be applied, yielding a model M and world with M, ⊩ Γ.But then in particular M, ⊩ ∨ ¬ meaning the model is forced to make a decision, so actually either M, ⊩ or M, ⊩ ¬ .In the former case we can show ¬¬ , since assuming ¬ would mean ¬ ∈ Γ in contradiction to M, ⊩ .In the latter case, we similarly show ¬ , thus altogether establishing WLEM for .□ Complementing with a ner approximation, we next show that WLEMS, although not enough to fully bridge the gap from quasi-primeness to primeness, is enough to establish the truth lemma for N .This time, the truth lemma crucially relies on the weakened (negated) interpretation of since the Lindenbaum extension only applies in negative goals.Lemma 4.10.Assuming WLEMS, every stable, quasi-prime context is not not prime ( ).In consequence, the left context of every relative consistent pair [Γ | Δ] does not not extend into a world of N while the truth lemma for N can still be proven ( ).
Proof.Let Γ be stable and quasi-prime.Suppose for a contradiction that additionally Γ were not prime.Given the negative goal, using WLEMS we may assume that for all we have ∉ Γ or ¬( ∉ Γ).By the same argument as in Lemma 4.8 this assumption is enough to derive primeness, then contradicting the assumption that Γ was not prime.
Regarding the truth lemma, we exploit that the two usages of the Lindenbaum extension happen for a negative goal, so the double negation shielding the extensions can be eliminated: First, in the backwards direction for implication, we assume N , Γ ⊩ → and need to show → ∈ Γ, which by stability can be turned into the negative goal ¬( → ∉ Γ).Secondly, in the forwards direction for exclusion, we assume ∈ Γ and need to show N , Γ ⊩ , which is a negative goal by our choice of semantics.□ While there is no hope to establish model existence only using WLEMS, we could show that N is not not a model for every consistent context.More naturally, however, we show that with the help of WLEMS and N the property of quasi-completeness can be established and, as in the case of model existence, that this logical characterisation is sharp.Proof.In order to derive quasi-completeness from WLEMS, we use Lemma 4.10 to extend the left context of a relative consistent pair [Γ | ] with Γ |= into a world Γ ′ of N .Note that this extension is possible since we ultimately want to derive a contradiction, so the shielding double negation of the obtained world can be eliminated.But then the truth lemma yields N , Γ ′ ⊩ Γ and N , Γ ′ ⊮ as in Theorem 4.9, together in contradiction to Γ |= .
For the converse, we assume a predicate : N → P we want to show WLEMS for.We this time consider the context and again rst establish that Γ is consistent.In principle, the idea is to use a model that interprets with to show consistency via soundness, however this model cannot be shown de nite as this would involve in nitely many case distinctions and even facing the negative goal we can only do nitely many of them.So instead we exploit that a derivation Γ ⊢ ⊥ only involves nitely many assumptions Γ ′ ⊆ Γ and construct a model ignoring all unused variables (i.e.interpreting them trivially).This model then can be shown de nite by only nitely many classical case distinctions, so it witnesses Γ ⊬ ⊥ via soundness for de nite models (Lemma 4.1).
To nally derive WLEMS, we assume ¬(∀ .¬ ∨ ¬¬ ) and apply quasi-completeness such that using the previously established consistency Γ ⊬ ⊥, only Γ |= ⊥ remains to be shown.Thus it is enough to assume a model M and world with M, ⊩ Γ and show that actually ∀ .¬ ∨ ¬¬ which then works exactly as in Theorem 4.9 by analysing the decisions M, ⊩ ∨ ¬ the model is forced to make.□ We emphasise that the necessity for classical assumptions in the case of model existence and quasi-completeness solely relies on the presence of ∨ in the syntax of BIL.So, in particular, if we were to consider BIL without ∨ or to interpret M, ⊩ ∨ classically by ¬(M, ⊮ ∧ M, ⊮ ), we expect model existence and quasi-completeness hold constructively, while in the latter case soundness will instead become even less constructive.Also, in any of these modi cations actual completeness still fails short of being constructive due to the strong interpretation of ⊥.We will illustrate in the next section that the contribution of ⊥ however changes with the complexity of the context.

Completeness for Semi-decidable Contexts
We end this section with a preliminary analysis of completeness restricted to semi-decidable contexts.In this particular case, not the full strength of LEM is necessary, since the remaining double negation from quasi-completeness to completeness can be eliminated only using MP.However, while we also conversely obtain MP from completeness, we only obtain versions of WLEM and WLEMS restricted to semidecidable propositions and predicates from the intermediate formulations of completeness.The corresponding proofs follow mostly the outline from before, so we provide only the high-level ideas and refer to the accompanying Coq code for full detail.
The idea to derive restricted versions of the principles WLEM and WLEMS is basically as before, i.e. to exploit suitable contexts that can be shown consistent constructively but where an actual model would provide some additional non-constructive information.A rst attempt could be to just exactly consider WLEM and WLEMS for semi-decidable predicates, but this fails since the contexts used in Theorem 4.9 and Theorem 4.11 refer to the complement of the assumed predicate and therefore need not be semi-decidable.Therefore, we rst give reformulations of WLEM and WLEMS that instead of the complement refer to a second predicate: DM expresses a version of the de Morgan law and DDNS can be seen as an instance of double negation shift for disjunctions since ¬( ∧ ) is equivalent to ¬¬(¬ ∨¬ ).Lemma 4.12.WLEM is equivalent to DM and WLEMS is equivalent to DDNS.
Proof.Both are by simple constructive reasoning.For the rst direction, one uses WLEM / WLEMS for both and .For the converse direction, one instantiates with the complement of .□ The given reformulations of WLEM and WLEMS can now be more symmetrically restricted to semi-decidable predicates, to which we refer by S-DM and S-DDNS, respectively.
Then their contribution to the completeness statements can be summarised as follows.
and from there proceed exactly as in Theorem 4.11.4. Since completeness implies quasi-completeness, it implies S-DDNS given the previous claim.Moreover, MP is obtained by Lemma 4.5 since MP exactly states stability for the class of semi-decidable propositions.□ It seems unlikely that S-DM and S-DDNS conversely sufce to establish model existence and quasi-completeness, respectively, since the Lindenbaum extension does not maintain semi-decidability as is, so we cannot simply form a universal model over semi-decidable contexts.However, such a universal model would be needed to obtain these intermediate formulations of completeness only using the semidecidable versions of their characterising principles.We leave it for future investigations to determine if an alternative strategy can be found that would induce an exact equivalence of semi-decidable completeness with the conjunction of S-DDNS and MP, or if instead a stronger principle can be identi ed that turns out to be su cient and necessary.
We further remark that the reverse directions of the above theorem are not at all speci c to semi-decidable contexts but apply to arbitrary classes and the correspondingly restricted logical principles: If C : P → P contains at least ⊤, then for C-contexts we have that model existence implies C-DM, that quasi-completeness implies C-DDNS, and that completeness implies C-DNE.So in particular there is the even more general open question how much logical strength between WLEM and C-DM or WLEMS and C-DDNS is needed to characterise model-existence or quasi-completeness of Ccontexts, respectively.

Discussion
In this paper, we led a constructive reverse mathematics investigation in the interactive theorem prover Coq: we showed the interactions between non-constructive principles, soundness and completeness-like results.For an alternative formulation of the Kripke semantics for BIL, we showed the following equivalences: soundness and LEM, completeness and LEM, model existence and WLEM, quasicompleteness and WLEMS.In addition to that, we approximated the logical strength of these results when restricted to semi-decidable contexts by giving them bounds using further non-constructive principles such as MP, S-DM or S-DDNS.

Coq Development
In our Coq mechanisation we mostly use standard techniques for the representation of the logic, namely an inductive type for the syntax, an inductive predicate for the deduction system, and a recursive evaluation function for the semantics.The enumerability / semi-decidability of the syntax and deduction system needed for the Lindenbaum lemma and the discussion concerning Markov's principle, respectively, is established using the technique of cumulative list enumeration [7].For the discreteness of the syntax we employ the decide equality tactic and in nite contexts are represented using the Ensembles library.The structure of Kripke models is registered as a type class to enable implicit inference in a semantic argument as usual in mathematical practice.
Using Coq in our investigation proved useful for several reasons.First, the gap-free mechanisation complements the previous proofs by Goré and Shillito [9] revisiting Rauszer's work [41] with a fully formal correctness certi cate.It thereby also lays the foundation for follow-up research extending to rst-order bi-intuitionistic logic, whereof Rauszer's original completeness result was found to be erroneous.Secondly, the proof assistant actually assisted in working out the reverse mathematical results, especially concerning the choice of semantics, and with simpli cations of proofs.Keeping track of the ne intuitionistic logical distinctions and where they come to play a role can be fully delegated to Coq, especially when later changing an initial de nition and reworking the whole argument.Similarly, only in interaction with Coq we found the simpli cation of the universal model and Lindenbaum lemma, referring to single contexts rather than pairschanging the proofs then simply involved editing the critical places pointed out by the system.Thirdly, Coq's underlying constructive type theory is an ideal framework for a reverse analysis since it is precise enough to distinguish much logical structure and expressive enough to model the involved notions in a natural way.
In principle, the formal metatheory of a logic like BIL can be developed in other proof assistants, at least concerning the standard treatment of properties like soundness and completeness.However, our particular interest in the constructive content of these proofs rules out proof assistants with hard-wired classical logic, like Isabelle/HOL and other member of the HOL family, and those with standard libraries depending on classical logic, like Lean.Moreover, the simultaneous synthetic treatment of computable functions and investigation of non-constructive logical principles is impossible in systems that validate unique choice, therefore ruling out Agda and implementations of HoTT.Consequently, while we do not inherently rely on the impredicativity of Coq's P universe, its disconnection from the computational type universes is the crucial and unique feature enabling our formal investigation.

Related Work
Mechanisation of completeness proofs.There is a rather long list of works mechanising completeness proofs which for the most prominent case of rst-order logic is summarised in [8] and [19].Regarding formalisms like bi-intuitionistic logic with a modal aspect, we are aware of the works in Coq of Doczkal and Smolka on CTL [5], Doczkal and Bard on converse PDL [4], and Hagemeier and Kirst on IEL [11], the work in HOL Light of Maggesi and Perini Brogi on the provability logic GL [28].We nally mention the recent formalisation in Lean of Guo, Chen and Bentzen on propositional intuitionistic logic [10].
Constructive reverse analysis of completeness.Wellknown results regarding the reverse analysis of completeness of rst-order logic have been observed by Kreisel [26] concerning Markov's principle, by Henkin [13] concerning the boolean prime ideal theorem, by Simpson [45] concerning weak König's lemma, and by Krivtsov [27] concerning the weak fan theorem.The new observations involving WLEM and WLEMS have been discovered by Kirst [19] in an extension of the work with Hagemeier on IEL [11], and applied to rst-order logic by Herbelin and Kirst [15].
Logic formalisation using synthetic computability.The synthetic approach [1] to represent semi-decidability employed in Section 4.3, i.e. to use type-theoretic functions instead of a formal model of computation, has rst been applied to the investigation of rst-order logic in [7].The same approach has then been applied to formalise and mechanise undecidability [17,20,22], incompleteness [23], and Tennenbaum's theorem [16], which together with other results was merged into a collaboratively developed Coq library of rst-order logic [21].

Future Work
There are four ways in which we intend to extend this work.First, we aim at completing the picture for semi-decidable contexts by obtaining equivalences where we currently have lower and upper bounds.Such a completion should be obtained for general C-contexts as well.Secondly, we would like to obtain a similar analysis to the one in this paper, but for the traditional semantics involving existential quanti cation instead of negated universal quanti cation.We suspect that the equivalences in this context involve di erent non-constructive principles than the ones we obtained here.Third, we intend to use the insights in this paper to build the rst correct and formalised proof of completeness for rst-order bi-intuitionistic logic, and proceed to a constructive reverse mathematics analysis of this result.Fourth, we plan on writing a paper summarising the equivalences with completeness obtained for general classes of logics.

Figure 1 .
Figure 1.Non-constructive principles used in this paper

Theorem 4 . 6 .
( ) Completeness is equivalent to LEM.Proof.A classical completeness proof has been outlined in Section 3.5.Conversely, assuming completeness, then by Lemma 4.5 we obtain stability for the full class of propositions, thus conclude DNE which is equivalent to LEM. □

Theorem 4 . 9 .
( ) Model existence is equivalent to WLEM.Proof.In order to derive model existence from WLEM, we use Lemma 4.8 to extend the left context of a relative consistent pair [Γ | ] into a world Γ ′ of N .By the truth lemma and