Realisability for Infinitary Intuitionistic Set Theory 11

Home , Computable set

arXiv:2009.12172v2 [math.LO] 31 Aug 2021 re to order suitable a otx ffiiaylgci eetnt 1,wihteprese the which [1], note recent a quest in This logic finitary theory? O of set context Does intuitionistic of transfi arithmetic. systems of (transfinite) various concept than in the rather for theory nu set domain natural thus natural as encoded The be contrast sets. thus In can arbitrary [3]. and author strings finite first transfini are the of output by studied models briefly on and based defined realisability of notions obtain Ordin [15] effectivity. Koepke’s transfinite modelling for objects. approach uncountable natural computabi and Turing beyond transfinite far to goes that effectivity of concept of concept realisability. pr to they introduction statements general the a realising i programs way—to proofs effective that an shows Curry-Howard-isomorphism semantics the intuitionistic respect: of formalisation a as originated o 44,19 EAsedm h Netherlands The Amsterdam, GE 1090 94242, Box d Auf Flensburg, Europa-Universität Didaktik, ihre und matik elsblt omlssta ttmn a eestablish be can statement a that formalises Realisability ihsc rnfiiegnrlsto fTrn computabil Turing of generalisation transfinite a such With qu are programs Turing however, perspective, certain a From -aladdresses E-mail 3 2 1 h hr uhri upre yadcoa coasi fth of scholarship doctoral a by supported is author third The Date nttt o oi,Lnug n optto,Fclyo S of Faculty Computation, Amste and GD Language 1090 Logic, 94160, for Box Institute P.O. College, University Amsterdam t und naturwissenschaftliche mathematische, für Institut etme ,2021. 1, September : ltkstter r elsd sa plcto fortech our of logic. application propositional Kripke-Plat an intuitionistic intuitionistic As (finitary) of realised. rules log admissible are of intuitionistic notion theory infinitary our set of that Platek systems show certain We to (OTMs). respect Machines Turing Ordinal on Abstract. realise y ffciemethod effective rmaygiven any from ttmn fteform the of statement a : [email protected] .aetiuan,r.pa [email protected], [email protected], ELNCARL MERLIN eitouearaiaiiysmnisfrifiiayintui infinitary for semantics realisability a introduce We ogs[]age htmteaiin ey(tlatimpli least (at rely mathematicians that argued [9] Hodges . ELSBLT O INFINITARY FOR REALISABILITY x uha Such . NUTOITCSTTHEORY SET INTUITIONISTIC 1 OEZ GALEOTTI LORENZO , ∀ x method ∃ 1. yϕ Introduction n ed ocm pwt nfr ehdo obtaining of method uniform a with up come to needs one , sotntknt eaTrn rga.Realisability program. Turing a be to taken often is 1 kstter r xcl h disberlsof rules admissible the exactly are theory set ek e ned ttre u ob elcoe nthis in well-chosen be to out turned it Indeed, . 2 tdesitn e etce Volkes deutschen des Studienstiftung c n htalaim fifiiayKripke- infinitary of axioms all that and ic, N OETPASSMANN ROBERT AND , o a rttcldb h rtato nthe in author first the by tackled first was ion tpprrpae n osdrbyexpands. considerably and replaces paper nt ecmuaiiy uhacnetwsfirst was concept a Such computability. te ed Mraiaiiycrepn oprovability to correspond TM-realisability iy loigeetv rcdrst apply to procedures effective allowing lity, mCmu ,293Fesug Germany Flensburg, 24943 1, Campus em nutoitcaihei correspond—in arithmetic intuitionistic n cnsh idn,AtiugfrMathe- für Abteilung Bildung, echnische iu,w hwta h propositional the that show we nique, ieraiaiiyotie rmOM is OTMs from obtained realisability nite oTrn ahns o hc nu and input which for machines, Turing to br,OM a prt n(oe for) (codes on operate can OTMs mbers, lTrn ahns(Ts rvd a provide (OTMs) Machines Turing al t,i eoe aua plcto to application natural a becomes it ity, for [18] book Oosten’s van e.g, see, ove, effectively ine nvriyo mtra,P.O. Amsterdam, of University cience, t iie safraiaino the of formalisation a as limited ite T-elsblt ssudwith sound is OTM-realisability insi e hoyta sbased is that theory set tionistic dm h Netherlands The rdam, [email protected] or explicitly . 3 o xml,in example, for : . il)o a on citly) 2 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

Given the presence of well-established concepts of infinitary logics, proofs, and their intuitionistic variants, it is more natural to consider how these, rather than classical provability in finitary logic, relate to OTM-realisability. In particular, we consider the question whether there is a transfinite analogue of the Curry-Howard-isomorphism; and to this end, we show that proofs in the infinitary intuitionistic proof calculus proposed by Espíndola [7] correspond to OTM-realisations. Thus, OTM-realisability is a natural concept in the context of infinitary intuitionistic proof theory. This paper is organised as follows. After introducing some necessary preliminaries and codings in Section 2, we define a notion of OTM-realisability for set theory in Section 3. Section 4 provides our main results on soundness on both the level of infinitary intuitionistic first-order logic as well as the level of set theory. We put our machinery to use in Section 5 and prove a result about the admissible rules of finitary intuitionistic Kripke-Platek set theory, answering a question by Iemhoff and the third author (see [12]).

2. Preliminaries

2.1. Infinitary Intuitionistic Logic. We will denote the class of ordinals by On, the class of binary sequences of ordinal length by 2symbol of x, y, and z, respectively. We will denote the ∈ length of a context x by ℓ(x). The formulas of the infinitary language L∞,∞ of set theory are defined as the smallest class of formulas closed under the following rules: (i) ⊥ is a formula;

(ii) xi ∈ xj is a formula for any variables xi and xj ;

(iii) xi = xj is a formula for any variables xi and xj ; (iv) if ϕ and ψ are formulas, then ϕ → ψ is a formula;

(v) if ϕα is a formula for every α<β, then α<β ϕα is a formula;

(vi) if ϕα is a formula for every α<β, then Wα<β ϕα is a formula; α (vii) if x is a context of length α, then ∃ xϕ Vis a formula; and, (viii) if x is a context of length α, then ∀αxϕ is a formula. By this definition, our language allows set-sized disjunctions and conjunctions as well as quantification over set-many variables at once. However, infinite alternating sequences of existential and universal quantifiers are excluded from this definition.

Remark 1. While we only consider the logic L∞,∞ in this paper, our results can be easily adapted to logics Lκ,κ for regular cardinals κ. In particular, notions of realisability for these logics can be obtained through κ-Turing machines (κ-TMs; see [3]).

Whenever it is clear from the context, we will omit the superscripts from the quantiﬁers and write ∃ and ∀ instead of ∃α and ∀α, respectively. It will often be useful to identify a variable x with the context x = hxi whose unique element is x. In such situations, we will write “∃xϕ” for “∃xϕ” and “∀xϕ” for

“∀xϕ”. A variable xi is called a free variable of a formula ϕ whenever xi appears in ϕ but is not in the scope of a quantiﬁcation over a context containing xi. As usual, a formula without free variables is called a sentence. We say that x is a context of the formula ϕ if all free variables of ϕ appear in x. REALISABILITY FOR INFINITARY INTUITIONISTIC SETTHEORY 3

As usual, we will write ϕ(x) if ϕ is a formula and x a context of ϕ. Similarly, given two contexts x ′ and y with xj 6= yj′ for all j<ℓ(x) and j < ℓ(y), we will write ϕ(x, y) if the sequence obtained by concatenating x and y is a context for ϕ. Let µ be an ordinal, x be a context of length µ, and y be a variable. Then “x ∈ y” is an abbreviation of the following inﬁnitary formula:

∃f∃d∃µz[“f is a function whose domain is the ordinal d” ∧

(zj′ ∈ zj ∧ zj ∈ d ∧ f(zj)= xj ) ∧ ∀x(x ∈ d → zj = x) ∧ f ∈ y].   j′

∀αx ∈ y ϕ for ∀αx(x ∈ y → ϕ), and ∃αx ∈ y ϕ for ∃αx(x ∈ y ∧ ϕ).

ω The bounded quantifiers for α<ω are defined as usual. The class of ∆0 -formulas consists of those formulas that have no infinitary quantifiers and all of whose quantifiers are bounded. Similarly, a formula ω ω belongs to the class of Σ1 -formulas if it is of the form ∃xψ for some ∆0 -formula ψ. We extend this ∞ definition to formulas with infinitary quantifiers as follows. An infinitary formula is a ∆0 -formula if all ∞ the quantifiers appearing in the formula are bounded. Furthermore, the class of Σ1 -formulas consists α ∞ of the formulas of the form ∃ xψ for some ∆0 -formula ψ and an ordinal α.

∞ Remark 2. Note that the previous definition of infinitary ∆0 -formulas requires the bounding set to contain the sequence hxj | j < αi rather than just each individual element of that sequence. This is necessary to lift the usual absoluteness results to the infinitary case. Indeed, the following alternative definition and straightforward generalisation of the standard definition of bounded formulas does not provide absoluteness. If we define

α α ∀ x ∈ yϕ as ∀ x( xj ∈ y → ϕ), j<α ^ and α α ∃ x ∈ yϕ as ∃ x( xj ∈ y ∧ ϕ), j<α ^ then it is straightforward to see that the following formula

ϕ(y) := ∃ωx ∈{0, 1} x ∈/ y

V L is not absolute: it is easy to see that if ℘ (ω) 6= ℘ (ω), then L |= ¬ϕ(L L ) but ϕ(L L ) is true. ω1 ω1 4 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

2.2. Ordinal Turing Machines. Ordinal Turing machines (OTMs, for short) were introduced by Koepke [15] as a transfinite generalisation of Turing machines and will be the main ingredient for our definition of infinitary realisability. We will only give a basic intuition for this model of transfinite computability and refer to the relevant literature (e.g. [15] or in [3, Section 2.5.6]) for a full introduction to OTMs. An Ordinal Turing machine (OTM) has the following tapes of unrestricted transfinite length: finitely many tapes for the input, finitely many scratch tapes, and one tape for the output. Ordinal Turing machines run classical Turing machine programs and behave exactly like standard Turing machines at successor stages of a computation. At limit stages, the content of the tapes is computed by taking the point-wise inferior limit, the position of the head is set to the inferior limit of the head positions at previous stages, and the state of the machine is computed using the inferior limit of the states at previous stages (see [3, Section 2.5.6] for more details). Ordinal Turing machines are a very well-behaved model of transfinite computability and many results from classical computability theory can be generalised to OTMs (e.g., [15, 6, 14, 21, 4, 5, 24]). For this reason, we will describe OTM-programs using high-level pseudo algorithms as usually done with Turing machines. We fix a computable coding of Turing machine programs as natural numbers. In the rest of the paper, we will identify a program with its natural number code. In this paper, we consider machines that run programs with parameters. For this purpose, we fix one of the input tapes as the parameter tape. A parameter is a binary sequence of ordinal length, i.e., an element of 2

2.3. Coding. The objects of our notion of realisability will be arbitrary sets and not just ordinal numbers. Therefore, we need to be able to perform computations on sets. As OTMs work on ordinal length binary sequences, we have to code arbitrary sets as sequences in 2

C◦ :2

encoding ordinals, sets of ordinals, pairs of sets of ordinals and ordinals, and sequences of such pairs as binary sequences of ordinal length. (ii) A high-level coding C : (On × ℘(On)) → V encoding arbitrary sets as a pair of an ordinal and a set of ordinals.

1We assume here a ﬁxed order in which the parameter appears in the coding. REALISABILITY FOR INFINITARY INTUITIONISTIC SETTHEORY 5

By concatenating both injective functions, we obtain a coding of arbitrary sets as binary sequences of ordinal length. The reader familiar with OTMs and codings may wish to skip forward to Section 3 and refer back to this section if necessary.

2.3.1. Low-level coding. While not diﬃcult, the technical details of the low-level coding are complicated and cumbersome (just like in the case of codings for ordinary Turing machines). For this reason, we introduce the low-level coding via the following abstract theorem. For its proof and the exact deﬁnition of the low-level coding C◦, we refer the interested reader to appendix A.

Theorem 3. Using the injective class-function C◦, the following operations are OTM-computable: (i) given codes for an ordinal and a set of ordinal, checking whether the ordinal is contained in the set of ordinals; (ii) given codes for a set of ordinals and an OTM-program, taking the image of the set of ordinals under the function computed by the program; (iii) given codes for an ordinal β and a sequence of length >β, returning the βth element of the sequence; (iv) given codes for an ordinal β and a sequence of length >β, removing the βth element from the sequence; (v) given a code for a sequence, appending an element to the sequence sequence; and, (vi) conducting a bounded search through a set of ordinals.

Importantly, this theorem allows us to treat a tape of an OTM as a stack. We will make plenty of use of this convention. Departing from this low-level coding, we need to encode arbitrary sets as pairs of an ordinal and a set of ordinals to use them as the objects of our investigation.

Convention 4. We will follow the usual simplifying convention when working with OTMs (and, in fact, any other kind of machine), and confuse objects with their codes. For example, we might say that ‘an OTM takes an ordinal α as input’ when we mean, of course, that it ‘takes a (low-level) code for an ordinal α as input,’ and similar for sets of ordinals, sequences, etc. It will always be clear from the context when we mean low-level codes because OTMs operate directly only on binary sequences (and not on ordinals or arbitrary sets).

2.3.2. High-level coding. We will now deﬁne a high-level coding for arbitrary sets. Recall that the Gödel class function g extends the usual Cantor pairing function on natural numbers and maps pairs of ordinals to ordinals, see, e.g., [13, p.31]. Given a set X we will denote its transitive closure by tc(X) (see, e.g., [13, p.64]).

Deﬁnition 5. Let X be a set. A pre-code for X is a set C of ordinals such that there is a bijection dC : α → tc({X}) with the property that g(β,γ) ∈ C if and only if dC (β) ∈ dC (γ). We say that C is a pre-code if it is a pre-code for some set X.

Deﬁnition 6. The high-level coding C is the partial surjective class function On × ℘(On) → V given by

C(hρ, Ci)= dC (ρ). If C(hρ, Ci)= x, we say that hρ, Ci is a code of x or that it encodes x. We will also say that ρ is the representative of x in C. 6 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

We say that a tuple hβ, Ci is a code if it is a code of some set x. We say that a code c is based on the pre-code C for y if c = hβ, Ci for some ordinal β. If c is a code for x based on a pre-code C for y, we will write ρc for the representative of x in C, and dc for the bijection dC . The pre-code on which a code is based may contain much more information than actually needed for the coding. For this reason, we introduce the following notion of essential domain containing only the information that is strictly needed to recover the set.

Deﬁnition 7. Let c be a code. The essential domain essdom(c) of c is the set

essdom(c)= {α ∈ dom(dc) | dc(α) ∈ tc({dc(ρc)})}.

Intuitively speaking, the essential domain of a code c of a set x contains the transitive closure of x as coded by c but not more than that. There can be many codes for one set. For this reason, we introduce the following notion of isomorphism between codes. Crucially, these isomorphisms are only between the essential domains of a code.

Deﬁnition 8. Let a and b be codes. A bijection f : essdom(a) → essdom(b) is called an isomorphism of codes if f(ρa)= ρb and da(α)= db(f(α)) for all α ∈ essdom(a).

As usual, we will say that two codes are isomorphic if there is an isomorphism of codes between them.

Lemma 9. Let x and y be sets. If a is a code of x, b is a code of y, and f a code-isomorphism between them, then x = y.

Proof. We see that x = da(ρa)= db(f(ρa)) = db(ρb)= y. We will now prove some helpful properties of (high-level) codes. In doing so, we will rely on Theorem 3 and Convention 4.

Lemma 10. Let a and b be codes of sets. (i) The set essdom(a) is computable, i.e., given a code for a, we can compute a binary sequence b ∈ 2

(ii) The function that given α ∈ dom(da) returns the unique β ∈ dom(db) such that da(α) = db(β) if such an ordinal exists and returns dom(db) otherwise is OTM-computable.

(iii) The function that given α ∈ dom(da) and β ∈ dom(db) returns 1 if and only if da(α) ⊆ db(β) is OTM-computable.

(iv) There is a program that, given a code of a sequence haβ | β < αi of codes of sets, returns a code

for the set {daβ (ρaβ ) | β < α}. (v) Let ϕ be a computable property of sets, i.e., there is a program c, possibly with parameter P , such

that cP (a)=1 if and only if ϕ[Y/x] for every code a of a set Y . There is a program, possibly with parameters, that given a code of a set X as input computes a code for {Y ∈ X | ϕ[Y/x]}. In particular, note that the relations X ∈ Y , X ⊆ Y , and X = Y are computable.

Proof. For (i), we make use of an auxiliary tape which we will use as a stack in virtue of Theorem

3. Given a code a = hρa, Ci, the computation of essdom(a) is implemented via a depth-ﬁrst search as follows. Put ρa on the stack. Then run the following loop until there are no elements left on the stack: Take the top element from the stack, say ordinal β, and remove it from the stack. Mark the βth position of the output tape with a 1. Then conduct a bounded search through C during which all α are put on REALISABILITY FOR INFINITARY INTUITIONISTIC SETTHEORY 7 the stack whenever g(α, β) ∈ C, and jump to the beginning of the loop. This procedure must eventually stop because sets are well-founded so that only set-many steps will be required to walk through the transitive closure of the set represented by ρa. For (ii) and (iii), we provide two procedures that recursively call each other: Decode(a,b,α) and Subset(a,b,α,β), where Decode(·, ·, ·) is the function required for (ii) and Subset(·, ·, ·, ·) for (iii).

Let’s begin with Decode(a,b,α), which takes codes a = (ρa, A) and b = (ρb,B) for sets as well as (a code for) an ordinal α ∈ dom(da) as input. First, the program checks whether da(α)= ∅ by conducting a bounded search looking for a β ∈ dom(da) such that g(β, α) ∈ A. If such a β cannot be found, the program looks for the unique γ such that g(β,γ) ∈/ B for all β ∈ dom(dB ) which must exist as B is a pre-code. The program then returns this γ and stops. If it turns out that da(α) is non-empty, then the program goes through all the ordinals β ∈ dom(db) and calls Subset(a,b,α,β) and Subset(b,a,β,α) to check whether da(α)= db(β). If that is the case, then the program returns β. If no such β is found, it writes dom(db) on the output tape. Next, consider Subset(a,b,α,β), which takes as input two codes a = (ρa, A) and b = (ρb,B). This procedure should return 1 in case da(α) ⊆ db(β) and 0 otherwise. To do so, conducts a bounded search on γ ∈ dom(da) and checks whether g(γ, α) ∈ A. If so, let δ = Decode(a,b,γ) and checks whether g(δ, β) ∈/ B. If this is the case, write 0 on the output tape and stop. If the bounded search is finished without interruption, write 1 on the output tape and stop. To finish the proof of (ii) and (iii), note that the mutual recursive calls finish after set-many steps of computation because sets are well-founded so that, eventually, the case for ∅ will be reached.

For (iv), let haβ | β < αi be given with aβ = hρaβ , Aβi. Set S0 = Aβ, σ0 = ρa0 and recursively construct σβ for β < α as follows. If β = γ +1, then let σβ = sup({σγ + γ | γ ∈ Aγ })+1. If β is a limit, then let σβ = sup({σγ | γ<β}). Note that all this can be straightforwardly computed by an OTM. Then deﬁne the set A as follows:

A = {g(σβ + α, σβ + γ) | α, β ∈ On such that g(α, β) ∈ Aβ} ∪{g(σβ + ρa , σα) | β < α}.   β β<α [   Intuitively, the ﬁrst half obtains a concatenation of all the sets coded by aβ and the second half makes sure that all the sets coded by aβ are members of the new set. Now, we might not yet have a code: if there are γ,δ <α such that the sets coded by aγ and aδ are not disjoint, then their common elements will appear twice. For this reason, we have to remove duplicates from A and obtain a pre-code A′. This can easily be done with a bounded search, using the Subset(·, ·, ·, ·) routine, replacing duplicate occurrences with the ﬁrst occurrence and removing those that are not needed. Finally, return the code ′ hσA, A i. Finally, (v) is witnessed by the following algorithm: search through the code of X and check whether ϕ[Y/x] holds for each Y ∈ X. If so, then the machine adds a code of Y to an auxiliary stack. Once the program has checked all the elements of X, it uses the algorithm presented in the proof of (iv) to compute the desired code from the sequence saved in the stack.

Convention 11. As with the low-level coding, we will follow the usual convention of (ordinal) computability theory and confuse objects and their codes. As in Convention 4, it will always be clear (or does not matter) which coding is applied when: for example, if we say that an OTM takes a set as input, then we mean that it takes as input the low-level code of a high-level code for a set. 8 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

3. A Notion of Transfinite Realisability 3.1. OTM-Realisability. In this section, we will define the realisability relation as a relation between potential realisers, viz., OTM programs with parameters, and formulas in the infinitary language of set ∈ theory L∞,∞. Definition 12. A potential realiser is a tuple hc, P i consisting of an OTM-program c and a set P of ordinals. Remark 13. In Kleene’s classical realisability with Turing Machines for arithmetic, every element of the universe, i.e., every natural number, is computable. To make sure that our notion has the same power, we use OTMs with set parameters as potential realisers. OTMs with a single ordinal parameter can only compute every element of the universe in case that V = L, and OTMs without parameters can only compute countably many elements. The seeming imbalance of finite programs with arbitrary parameters could be resolved by moving to the equivalent version of OTMs that can run programs of transfinite length studied by Lewis [16] under the supervision of Benedikt Löwe and the second author.

As potential realisers are just OTMs with parameters, we can keep our conventions and write r(x)= y in case that r = hc, P i is a potential realiser such that cP (x) = y. Similarly, we say that a potential realiser r = hc, P i computes a function if the OTM running program c on parameters P computes that function. To deﬁne the realisability relation, we subtly extend the inﬁnitary language of set theory with a constant symbol for every set in the universe V. To simplify notation, and without creating any confusion, we use the same letters to denote sets and their corresponding constant symbols.

Definition 14 (Substitution of Contexts). Let x be a context of length α, X¯ = hXi | i < αi be a sequence of length α, and ϕ be a formula in context x. Then ϕ[X/¯ x] is the formula obtained by replacing the free occurrences of the variable xi in ϕ with the (constant symbol for the) set Xi. ∈ Definition 15 (OTM-Realisability of L∞,∞). The OTM-realisability relation is recursively defined as a relation between the class of potential realisers and the class of formulas in the infinitary language ∈ of set theory L∞,∞ as follows: (i) r ⊥ is never true, (ii) r X = Y if and only if r computes a code-isomorphism for every pair of codes for X and Y , (iii) r X ∈ Y if and only if for any codes a for X and b for Y , it holds that r(a,b) = hα, si such

that db(α) ∈ Y and s X = db(α), (iv) r ϕ → ψ if and only if for every s ϕ we have that r(s) ψ,

(v) r α<β ϕα if and only if r(0) = hγ,si such that s ϕγ ,

(vi) r Wα<β ϕα if and only if r(α) ϕα for all α<β, ¯ ¯ (vii) r ∃Vxϕ if and only if r(0) = (a,s) such that a is a code for X and s ϕ[X/x], and, (viii) r ∀xϕ if and only if r(a) ϕ[X/¯ x] for every code a of every sequence X¯ of length ℓ(x). A formula ϕ is realised if there is a potential realiser hc, P i ϕ. In this situation, we will call hc, P i a realiser of ϕ. OTM-programs do not necessarily give rise to functions from sets to sets because the result of a computation may depend on speciﬁc features of the code of a set. Consider, for example, a realiser REALISABILITY FOR INFINITARY INTUITIONISTIC SETTHEORY 9 r ∀x∃y(x 6= ∅ → y ∈ x). Intuitively, the realiser r must do the following: given a code for a non- empty x, compute the code for a set y ∈ x. A simple implementation of this would be to search through the code of x until the ﬁrst element of x is found (if there is any) and return the code for this element.

However, there are obviously codes c0 and c1 of {0, 1} such that r(ci) returns a code of i for i < 2. This shows that realisers may make use of specific features of our codes and give rise to multi-valued functions. In conclusion, it is natural to consider the following restricted notion of realisability in which realisers cannot make use of the features of specific codes. Definition 16. We obtain uniform realisability by restricting the class of potential realisers to those OTMs that code a single-valued function. 3.2. Basic Properties of OTM-Realisability. We are now ready to establish some basic properties of OTM-realisability. First, we simplify the conditions for set-membership and equality in our definition of realisability. Lemma 17. Let X and Y be sets. (i) There is a uniform realiser of X = Y if and only if X = Y . (ii) There is a uniform realiser of X ∈ Y if and only if X ∈ Y . Proof. For (i), the left-to-right direction follows from the definition of the realisability relation and Lemma 9. For the right-to-left direction assume that X = Y . Let a and b two codes for X based on the pre-codes A and B, respectively. Let c be a code for a program that returns the code of the algorithm

Decode(·, ·, ·) from Lemma 10 and the ordinal Decode(a,b,ρa). We will show that hc, ∅i X = Y . To this end, we deﬁne f(α) = Decode(a,b,α) for every α ∈ essdom(a). It suﬃces to show that f is a bijection from essdom(a) to essdom(b) to see that it is a code-isomorphism.

First, to see that f is an injection, let α ∈ essdom(a). Then da(α) ∈ X = Y , and there is β ∈ dom(db) such that db(β)= da(α) ∈ X = Y . But then, by Lemma 10, f(α)= β and, since db(β) ∈ tc({db(ρb)})= tc({Y }), we have β ∈ essdom(b) by definition. Now let α 6= β be in essdom(a), then by injectivity of da we have that da(α) 6= da(β). Finally by Lemma 10 db(f(α)) = da(α) 6= da(β) = db(f(β)). So, f is injective. Second, to see that f is surjective, let β ∈ essdom(b). Then, since X = Y , there is α ∈ essdom(a) such that da(α) = db(β). But then, by Lemma 10, f(α) is such that db(f(α)) = da(α) = db(β), and since db is a bijection, we have that f(α)= β as desired. This concludes the proof of (i). For (ii), first assume that there is a realiser hc, P i X ∈ Y . Let a and b be any two codes of X and Y , respectively. By definition of the realisability relation , the program c computes an ordinal α such that db(α) = X and a realiser of X = db(β) so the claim follows from the previous case. For the right-to-left direction it is enough to note that, using Decode(·, ·, ·), one can easily compute the ordinal

α such that db(α) ∈ db(ρb) and the realiser of X = db(α). This concludes the proof of (ii). ω ¯ Lemma 18. Let ϕ(x) be an inﬁnitary Σ1 -formula, and X be a sequence of the same length as x. The formula ϕ[X/¯ x] is uniformly realised if and only if ϕ[X/¯ x] is true. Proof. The proof is an induction on the complexity of ϕ(x). The cases where ϕ is “X ∈ Y ” or“X = Y ” follow from Lemma 17. If ϕ = ⊥, then the claim is trivial because ⊥ is both never realised and false. The case for implication follows directly from the induction hypothesis and the deﬁnitions. ¯ If ϕ(x) = β<γ ϕβ, assume that hc, P i uniformly realises β<γ ϕβ[X/x]. Then c is the code of a program that computes an ordinal β <γ and a realiser of ϕ [X/¯ x]. By the induction hypothesis, W Wβ 10 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

¯ ¯ ¯ ϕβ[X/x] is true and, therefore, the disjunction ϕ is true as well. If β∈γ ϕβ[X/x] is true, then ϕβ[X/x] is true for some β<γ. By induction hypothesis, ϕ [X/¯ x] is realised by some potential realiser hc′, P ′i. β W Let P be a code for the pair hβ, hc′, P ′ii, and c be a code for a program that given 0 as input just returns P . Then hc, P i uniformly realises ϕ[X/¯ x].

If ϕ(x) = β<γ ϕβ, assume that hc, P i uniformly realises β<γ ϕβ. Then c codes a program that, given an ordinal β<γ, computes a realiser of ϕ [X/¯ x]. Hence, each formula ϕ [X/¯ x] is realised and, V β V β by induction hypothesis, true. In conclusion, the conjunction is also true. We prove the converse by ¯ contradiction. Suppose that β<γ ϕβ [X/x] is true but not realised. This means that there is a β<γ such that ϕ [X/¯ x] is not realised. By induction hypothesis, ϕ [X/¯ x] is false. A contradiction. β V β Assume that ϕ(x)= ∃1yψ. If hc, P i uniformly realises ϕ[X/¯ x], then c returns the code of a program with parameter that returns, on input 0, a code for a set Y and a realiser of ψ[Y/y][X/¯ x]. By the induction hypothesis, ψ[Y/y][X/¯ x] holds and, therefore, ϕ is true. On the other hand, if ϕ[X/¯ x] is true, then there is a set Y such that ψ[Y/y][X/¯ x] is true and, by induction hypothesis, there is a realiser hc′, P ′i of ψ[Y/y][X/¯ x]. Let P encode the realiser ha, hc′, P ′ii, where a is a code for Y , and let c be the code of a program that copies the parameter to the output tape. It is not hard to see that hc, P i uniformly realises ϕ[X/¯ x] as desired. 1 Finally, let ϕ(x) = ∀ y ∈ xj ψ for some j <ℓ(x). Assume that hc, P i uniformly realises ϕ[X/¯ x]. Then c is a program that, given P and a code for a set Y as input, returns a code for a realiser of

Y ∈ Xj → ψ[Y/y][X/¯ x]. So, by induction hypothesis for every Y ∈ Xj we have ψ[Y/y][X/¯ x] as desired.

For the right-to-left direction, assume that ϕ[X/¯ x] is true. By induction hypothesis, for every Y ∈ Xj ¯ N there is a realiser hcY , PY¯ i of ψ[Y/y][X/x]. Let f : Xj → × On be the function that maps Y to the realiser hcY , PY i. Let P be a code for the function f (as a list of codes for the pairs ha, hcY , PY ii where a is a code of Y ), and let c be the code of a program that, given the code of Y ∈ Xj , searches in P the pair haY , hcY , PY ii and copies hcY , PY i to the output tape. The pair hc, P i is a uniform realiser of ϕ.

Indeed, given a code for Y ∈ Xj the program coded by c with parameter P returns a code for a realiser of ψ[Y/y][X/¯ x], moreover the output of the machine is independent from the speciﬁc coding of X¯, so the realiser is uniform.

∞ Lemma 18 can be extended to Σ1 -formulas. To prove this, we need the following lemma. Recall that “x ∈ y”, where x is a context-variable and y a set-variable, is an abbreviation as introduced in Section 2.1. The following lemma justiﬁes this abbreviation semantically.

Lemma 19. Let x be a context of length µ and y a variable. For every set Y and for all X¯ we have that (x ∈ y)[X/¯ x][Y/y] is realised if and only if X¯ ∈ Y .

Proof. For the right-to-left direction assume that X¯ ∈ Y . Let µ = ℓ(X)= ℓ(X¯). Since X¯ is a function with domain ℓ(X¯), Lemma 18 implies that the following sentence is realised by some s:

(“f is a function with domain the ordinal d” ∧ ( (zj′ ∈ zj ∧ zj ∈ d ∧ f(zj)= xj ) j′

For the left-to-right direction, assume that (x ∈ y)[X/¯ x][Y/y] is realised by some program r. Then r is such that r(0) = (F, r′), where r′ is a program such that r′(0) = (D, r′′), and r′′ is a program such that r′′(0) = (Z,s¯ ) and s realises

[“f is a function with domain the ordinal d” ∧ ( (zj′ ∈ zj ∧ zj ∈ d ∧ f(zj )= xj ) j′

∞ ¯ Lemma 20. Let ϕ(x) be an inﬁnitary Σ1 -formula and X a sequence of length ℓ(x). The formula ϕ[X/¯ x] is uniformly realised if and only if ϕ[X/¯ x] is true.

Proof. With Lemma 19 it is easy to adapt the proof of Lemma 18 for the present case.

∞ ¯ Theorem 21. Let ϕ(x) be an inﬁnitary ∆0 -formula in the language of set theory and X be a sequence of length ℓ(x). There is an OTM that, given codes for ϕ and X¯, returns 1 if ϕ[X/¯ x] is true and 0 otherwise.

Proof. This result is a variation on a Lemma of Koepke [15, Lemma 4] for inﬁnitary formulas. The proof is an induction on the complexity of the formula ϕ(x). We already provided the algorithms for atomic formulas in Lemma 10. If ϕ(x)= ¬ψ(x), then the program computes the truth value of ψ(X¯) and ﬂip the result.

If ϕ(x)= β<α ψβ, then the program recursively computes the truth values ψβ for every β < α. The program outputs 1 if one of the recursive instances stops with 1; it outputs 0 if after the search is done W none of the instances halted with 1. A similar argument works for . If ϕ(x) = ∃y ∈ x ψ for some j<ℓ(x) and a ∆∞-formula ψ, then the program goes through the j 0 V sequences Y¯ in Xj and for each of them recursively compute the truth value of ψ[Y/¯ y][X/¯ x]. If the program ﬁnds a Y¯ on which the recursive call returns 1 then returns 1, otherwise returns 0. A similar proof works for ∀.

∞ Lemma 22 (Universal Realisability Program). Let ϕ(x) be an inﬁnitary ∆0 -formula in the language of set theory and let X¯ be a sequence of length ℓ(x). There is an OTM-program Φ that takes codes of X¯ and ϕ as input and returns the code of a realiser of ϕ[X/¯ x] whenever ϕ[X/¯ x] is realised. The same holds if we substitute realisability with uniform realisability. Moreover, if V = L then the statement is ∞ true for inﬁnitary Σ1 -formulas.

Proof. We give an informal description of the program Φ that computes the realisers. The program ﬁrst checks the main operator of the input-formula and then proceeds as follows: If ϕ is “X ∈ Y ” or“X = Y ”, then the program just returns the codes of the algorithms described in Lemma 10 to compute a realiser of ϕ. If ϕ = ⊥ then the program can just return anything since ⊥ is never realised. ∞ If ϕ = β∈γ ϕβ, then proceed as follows. By Theorem 21, the ∆0 -satisfaction relation is computable by an OTM. For every sentence ϕ [X/¯ x] the program Φ checks whether the sentence is true or not. W β When it ﬁnds a β such that ϕβ[X/¯ x] holds, Φ stops the search and returns hc, P i where P is a code of X¯, and c is a code of a program that returns β and the output of a recursive call of Φ on ϕβ and X¯ 12 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

If ϕ = β∈γ ϕβ, then the program returns the pair hc, P i where c is a code for Φ and P is a code for X¯. V ∞ If ϕ(x) = ∃y ∈ xj ψ for some j<ℓ(x) and some ∆0 -formula ψ, then the program returns hc, P i, where P is a code of X¯ and c is a code of a program that does the following: for every sequence Y¯ ∈ X of length y, it checks whether ψ[Y/¯ y][X/¯ x] holds. As soon as such a Y¯ is found, the program recursively calls Φ on ψ[Y/¯ y][X/¯ x] and outputs a code for Y¯ and the result of the recursive call of Φ.

If ϕ(x) = ∀y ∈ xj ψ, then the program returns hc, P i where P is a code of X¯ and c is a code for a program that taken a sequence Y¯ as input and P as parameter runs Φ on ψ[Y/¯ y][X/¯ x]. The correctness of the algorithm follows by an easy induction on ϕ using Lemma 20. Finally, if V = L, then we can treat unbounded existential quantiﬁcation as follows: Suppose that ∞ ϕ(x)= ∃yψ for some ∆0 -formula ψ. By a result of Koepke (implicit in [15] and explained in detail in [3, Theorem 3.2.13 & Lemma 2.5.45]), L is computably enumerable by an OTM. So the program starts an unbounded search in L for a witness Y¯ of ψ[Y/¯ y][X/¯ x]. If it ﬁnds one, it recursively calls itself on ψ[Y/¯ y][X/¯ x] and outputs a code for Y¯ and the result of the recursive call.

4. Soundness of OTM-Realisability 4.1. Logic. In this section, we will show that our notion of realisability is sound with respect to the inﬁnitary sequent calculus that was introduced by Espíndola [7]. In fact, Espíndola deﬁnes a calculus for the language Lκ+,κ for every cardinal κ. As we admit formulas of all ordinal lengths, we will show that OTM-realisability is sound with respect to these systems for every κ.

∈ Deﬁnition 23. Let Γ ∪ ∆ be a set of formulas in the inﬁnitary language of set theory L∞,∞. A sequent Γ ⊢ ∆ is realised if the universal closure of Γ → ∆ is realised. If A and B are sets of sequents, then the rule A is realised if whenever all sequents in a ∈ A are realised, then there is some sequent in B B V W that is realised.

Note that a formula ϕ is realised if and only if the sequent ∅ ⊢ ϕ is realised. To simplify notation, A A B A we will write B to denote the conjunction of both rules B and A . Accordingly, we say that B is valid A B if both B and A are valid. In many of the following soundness proofs, we will need to show that certain sequents Γ ⊢x ∆ are realised, i.e., we have to ﬁnd a realiser of the corresponding formula ∀x( Γ → ∆). In many cases these realisers will be independent of x. Then, we will directly describe a realiser of Γ → ∆, and V W omit that we mean a realiser that, given any X¯ of length ℓ(x), outputs the previously described realiser. V W Proposition 24. The following structural rules are realised: (i) Identity axiom:

ϕ ⊢x ϕ

(ii) Substitution rule:

ϕ ⊢x ψ

ϕ[s/x] ⊢y ψ[s/x]

where y is a string of variables including all variables occurring in the string of terms s. REALISABILITY FOR INFINITARY INTUITIONISTIC SET THEORY 13

(iii) Cut rule:

ϕ ⊢x ψ ψ ⊢x θ

ϕ ⊢x θ Proof. The identity axiom is trivially realised by an OTM that implements the identity map.

For the substitution rule, recall that by our definition, a realiser of ϕ ⊢x ψ is in fact a realiser r ∀x(ϕ → ψ). We need to find a realiser t ∀y(ϕ[s/x] → ψ[s/x]), i.e., t takes as input some code for a sequence y of variables. To achieve this, find codes for the realiser r and the substitution s/x. Then let t be the OTM with parameters r and s/x that performs the following two steps: first, reorder the input y according to the substitution s/x, and then apply the parameter r to compute a realiser of ϕ[s/x] → ψ[s/x]. For the cut rule, let r ∀x(ϕ → ψ) and s ∀x(ϕ → θ). For any given input X¯, we have that r(X¯) ϕ(X¯) → ψ(X¯) and s(X¯) ψ(X¯) → θ(X¯), i.e., r(X¯) maps realisers of ϕ(X¯) to realisers of ψ(X¯), and s(X¯) maps realisers of ψ(X¯) to realisers of θ(X¯). Let t be the OTM that, given input X¯, returns an OTM that given input u returns s(X¯)(r(X¯)(u)). Then t ∀x(ϕ(x) → ψ(x)).

Proposition 25. The following rules for equality are realised:

(i) ⊤⊢x x = x

(ii) (x = y) ∧ ϕ[x/w] ⊢z ϕ[y/w] where x, y are contexts of the same length and type and z is any context containing x, y and the free variables of ϕ.

Proof. Finding a realiser of the first statement means finding a realiser of ∀x(⊤ → x = x), which is equivalent to finding a realiser of ∀x(x = x). This follows directly from the fact that the algorithm for equality presented in the proof of Lemma 17 is the same for any sets x and y. The second statement follows in a similar way as the substitution rule of Proposition 24 using that, by the definition of realisability, realisers work on all codes of any given set.

Proposition 26. Let κ be a cardinal. The following conjunction rules are realised: (i)

ϕi ⊢x ϕj , i<κ ^ (ii)

{ϕ ⊢x ψi}i<κ . ϕ ⊢x ψi i<κ ^ Proof. The deﬁnition of realisability straightforwardly implies that both rules are realised: For the ﬁrst rule observe that we can just extract a realiser of ϕj from a realiser of i<γ ϕi. For the second rule, combine the realisers r ϕ → ψ for i<κ into a parameter P and obtain a realiser of ϕ ⊢ ϕ i i V x i<κ i by implementing an OTM program that returns the realiser of ϕ on input i. i V Proposition 27. Let κ be a cardinal. The following disjunction rules are realised: (i)

ϕj ⊢x ϕi i<κ _ 14 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

(ii)

{ϕi ⊢x θ}i<κ

ϕi ⊢x θ i<κ _ Proof. For the ﬁrst statement, we need to realise the implication ϕj → i<κ ϕi. This can be done by an OTM that, given a realiser r of ϕ , returns an OTM that returns a tuple hj, r i on input 0. j j W j For the second statement, code the realisers rj for ϕi ⊢x θ, i<κ into a parameter P . Then,

i<κ ϕi ⊢x θ is realised by the following algorithm implemented by an OTM: Given a realiser s ϕ , compute s(0) = hi,ti, such that t ϕ and then return r (t) by using the parameter. Wi<κ i i i PropositionW 28. The following implication rule is realised: ϕ ∧ ψ ⊢x η ϕ ⊢x ψ → η Proof. We have to show two directions. For the ﬁrst direction, top-to-bottom, let r ϕ ∧ ψ → η. Now, we construct a realiser of ϕ → (ψ → η) as follows: Given a realiser rϕ for ϕ, output the OTM that, given a realiser rψ for ψ, combines it with rϕ to obtain a realiser rϕ∧ψ ϕ∧ψ. Then apply r(rϕ∧ψ) η. For the other direction, bottom-to-top, suppose we have a realiser r ϕ → (ψ → η). We obtain a realiser of ϕ ∧ ψ → η as follows: Given a realiser of rϕ∧ψ ϕ ∧ ψ, compute realisers rϕ ϕ and rψ ψ. By deﬁnition and our assumptions, (r(rϕ))(rψ ) η.

Proposition 29. The following existential rule is realised: ϕ ⊢xy ψ ∃yϕ ⊢x ψ where no variable in y is free in ψ.

Proof. For the ﬁrst direction, assume that r ∀xy(ϕ → ψ). We have to ﬁnd a realiser t ∀x((∃yϕ) → ψ). Let t be an implementation of the following algorithm: Given some sequence X¯ and a realiser r∃ ∃yψ. Compute from r∃ a code for some Y¯ and a realiser rϕ ϕ. Then calculate (t(X¯Y¯ ))(rϕ). This is a realiser of ψ. For the other direction, assume that r ∀x(∃yϕ → ψ). We construct a realiser t ∀xy(ϕ → ψ). So let sequences X¯, Y¯ be given, and assume that we have a realiser s ϕ(X¯Y¯ ). We can compute a realiser r∃ for ∃yϕ(X¯) as the OTM that returns X¯ and s. We can then return (r(X¯))(r∃), which is a realiser of ψ.

Proposition 30. The following universal rule is realised: ϕ ⊢xy ψ ϕ ⊢x ∀yψ where no variable in y is free in ϕ.

Proof. For the top-to-bottom-direction, assume that r ∀xy(ϕ → ψ). We have to ﬁnd a realiser t ∀x(ϕ → (∀yψ)). If X¯ is a sequence and rϕ a realiser of ϕ, then the OTM that takes some Y¯ as ¯ ¯ input and returns r(XY )(rϕ) is a realiser of ∀yψ. Call this realiser rX¯ . Then, the OTM which takes ¯ some X as input and then returns rX¯ is a realiser of ∀x(ϕ → ∀yψ). For the bottom-to-top-direction, assume that r ∀x(ϕ → (∀yψ)). Then ∀xy(ϕ → ψ) can be realised by the OTM that operates as follows: Given sequences X¯ and Y¯ as input, return the OTM that, given a realiser s ϕ, returns ((r(X¯))(s))(Y¯ ) ψ. REALISABILITY FOR INFINITARY INTUITIONISTIC SET THEORY 15

Proposition 31. The small distributivity axiom is realised:

(ϕ ∨ ψi) ⊢x ϕ ∨ ψi i<κ i<κ ! ^ ^ for each cardinal κ.

Proof. It is enough to construct an OTM that transforms a realiser of i<κ(ϕ ∨ ψi) into a realiser of ϕ ∨ ψ . So let r (ϕ ∨ ψ ). The OTM proceeds as follows: First, search for a realiser of i<κ i i<κ i V ϕ by going through all i<κ. As soon as a realiser of ϕ is found, we are done. If no realiser of ϕ is V V found, then we have, in fact, realisers for every ψi for i<κ and can therefore construct a realiser of i<κ ψi.

V Recall that a bar is an upwards-closed subset of a tree that intersects every branch of the tree.

Proposition 32. The dual distributivity rule is realised, i.e.:

β ϕg ⊢x ϕf β <κ,f ∈ γ β+1 g∈γ ,g|β =f ^ β ϕf ⊣⊢x ϕf|α β < κ, limit β,f ∈ γ α<β _

ϕf|β+1 ⊢x ϕ∅ f B β<δ ^∈ _f for each cardinal γ<κ+. Here B ⊆ γ<κ consists of the minimal elements of a given bar over the tree κ γ , and the δf are the levels of the corresponding f ∈ B.

Proof. Our goal is to construct a realiser of

ϕf|β+1 ⊢x ϕ∅, f B β<δ ^∈ _f i.e., we have to construct an OTM that computes a realiser of ϕ from a realiser of ϕ . ∅ f∈B β<δf f|β+1 In doing so, we can use realisers of the antecedents of the rule: We denote by r a realiser of the ﬁrst 1 V W ⊢ antecedent and by r2 a realiser of the forward direction of the second antecedent. We claim that Algorithm 1 describes a desired realiser, and we will now prove that it terminates with a realiser of ϕ when run on a realiser of ϕ . In fact, we will prove the contrapositive. ∅ f∈B β<δf f|β+1 So suppose that the OTM described by Algorithm 1 does not terminate, i.e., it either loops or crashes. V W First, assume that the machine loops. As our algorithm constructs r(−) in a monotone way, the partial function r(−) must stabilise before the loop. Hence, the algorithm must loop through lines 15 and 16: otherwise we would (eventually) still alter r(−) (lines 11/12) or contradict the well-foundedness of the ordinal numbers (lines 5–9). However, looping through lines 15 and 16 means that we built up a sequence f that will eventually reach length κ. But then the operation of selecting a direct successor in line 15 will crash, a contradiction to the machine’s looping. Secondly, assume that the machine crashes. It is easy to see that this must happen in line 15 as all ⊢ other operations are well-deﬁned (using the case distinctions and assumptions on r, r1 and r2 ). A crash in line 15, however, will only occur if f has reached length κ. This means that we have constructed a branch through λ<κ that does not intersect the bar B, a contradiction. 16 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

Algorithm 1: Walking(r), walking through the tree Input: A realiser r for ϕ f∈B β<δf f|β+1 Output: A realiser r ϕ . ∅ V ∅ W <κ <κ 1 From r extract a set C ⊆ γ and a partial function r(−) : γ → V such that rf ϕf for all f ∈ C. 2 Let f = ∅.

3 while r∅ is undeﬁned do 4 if f ∈ dom(r(−)) then 5 if f is of successor length α +1 then

6 Set f := f|α. 7 if f is of limit length β then 8 ⊢ Calculate r2 (rf ) and extract from this rf|α for some α<β. 9 Set f := f|α.

10 else

11 if g ∈ dom(r(−)) for all direct successors g of f then ′ 12 Combine the r into a realiser r β+1 ϕ . g g∈γ ,g|β =f g ′ 13 Set rf := r1(r ). V 14 else <κ 15 Select a direct successor g ∈ γ of f such that rg is undeﬁned. 16 Set f := g.

17 Return r0.

Proposition 33. The transﬁnite transitivity rule is realised:

β ϕf ⊢yf ∃xgϕg β <κ,f ∈ γ β+1 g∈γ ,g|β =f _ β ϕf ⊣⊢yf ϕf|α β < κ, limit β,f ∈ γ α<β ^

ϕ∅ ⊢y∅ ∃β<δf xf|β+1 ϕf|β+1 f B β<δ _∈ ^f

+ for each cardinal γ <κ , where yf is the canonical context of ϕf , provided that, for every f ∈ β+1 γ , F V (ϕf ) = F V (ϕf|β ) ∪ xf and xf|β+1 ∩ F V (ϕf|β ) = ∅ for any β <γ, as well as F V (ϕf ) = <κ α<β F V (ϕf|α ) for limit β. Here B ⊆ γ consists of the minimal elements of a given bar over the tree γκ, and the δ are the levels of the corresponding f ∈ B. S f Proof. The proof of this proposition is a simpliﬁcation of the proof of Proposition 32: Again, we need to

search through the tree until we hit the bar. This time, however, we are starting from a realiser of ϕ∅. Then use the ﬁrst assumption to compute realisers at successor levels and use the second assumption to compute realisers at limit levels. By the deﬁnition of the bar B, this procedure must at some point reach some node contained in B, and we have found the desired realiser. Note that this procedure does not REALISABILITY FOR INFINITARY INTUITIONISTIC SET THEORY 17 require any backtracking as in the previous proposition and, therefore, the formalisation of the desired OTM is straightforward.

Espíndola’s [7] system of κ-ﬁrst-order logic is axiomatised in the sequent calculus by the rules mentioned in Propositions 25 to 33.

Corollary 34. OTM-realisability is sound with respect to κ-ﬁrst-order logic for every cardinal κ. The same holds if we substitute realisability with uniform realisability.

Proof. This is just the combination of Propositions 25 to 33.

Before moving on to questions of which set theory is OTM-realised in the next section, we will take a brief moment to note a few logical properties of our notion of realisability.

Proposition 35 (Semantic Disjunction and Existence Properties). If ϕ∨ψ is realised, then ϕ is realised or ψ is realised. More generally, if i<κ ϕi is realised, then there is some i<κ such that ϕi is realised. If ∃αxϕ(x) is realised, then there is a sequence X¯ such that ϕ(X¯) is realised. W Proof. This follows from the deﬁnition of realisability for disjunctions and existential quantiﬁers.

We say that a formula of propositional logic is (uniformly) OTM-realisable if every substitution instance of the formula is (uniformly) OTM-realisable.

Theorem 36. There is a formula of propositional logic which is uniformly OTM-realisable but not a consequence of intuitionistic propositional logic.

Proof. Each instance of the so-called Rose formula (due to Rose [22]) is OTM-realisable but this formula is not a consequence of intuitionistic propositional logic. This is shown in just the same way as in the arithmetical case (see Plisko’s survey [20, Section 6.1]).

A similar result holds with respect to ﬁrst-order logic.

Theorem 37. Each substitution instance of the following Markov’s principle, formulated in ﬁrst-order logic, is uniformly OTM-realisable:

(∀x(P (x) ∨ ¬P (x)) ∧ ¬¬∃xP (x)) → ∃xP (x)

However, this formula is not a theorem of intuitionistic ﬁrst-order logic.

Proof. The realisability of every instance of Markov’s principle is realised follows by providing an OTM that executes a bounded search for a witness of P (x) within some big enough parameter Vα. A standard argument using Kripke semantics shows that Markov’s principle is not a theorem of intuitionistic ﬁrst- order logic.

These two results show that the propositional and ﬁrst-order logics of OTM-realisability are stronger than intuitionistic propositional and intuitionistic ﬁrst-order logic, respectively. 18 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

4.2. Set Theory. In this section, we will study the realisability of various axioms of set theory. Some of these statements were already proved for uniform realisability of finitary logic by the first author [3]; we include their proofs here for the sake of completeness. We will begin by proving that our notion of uniform realisability realises the axioms of the infinitary version of Kripke-Platek set theory (for the finite version, see also [3, Proposition 9.4.7]).

∈ Definition 38. We define infinitary Kripke-Platek set theory, denoted by L∞,∞-KP, on the basis of intuitionistic κ first-order logic for every cardinal κ with the following axioms and axiom schemata: (i) Axiom of extensionality:

∀x∀y(∀z((z ∈ x → z ∈ y) ∧ (z ∈ y → z ∈ x)) → x = y),

(ii) Axiom of empty set: ∃x∀y(y∈ / x); (iii) Axiom of pairing:

∀x∀y∃z∀w((w ∈ z → (w = x ∨ w = y)) ∧ ((w = x ∨ w = y) → w ∈ z)),

(iv) Axiom of union:

∀x∃y((y ∈ x → ∃z(y ∈ z ∧ z ∈ x)) ∧ (∃z(y ∈ z ∧ z ∈ x) → y ∈ x)),

(v) Axiom schema of induction:

∀y((∀x(∀z ∈ xϕ[z/x]) → ϕ) → ∀xϕ),

for every inﬁnitary formula ϕ(x, y), ∞ (vi) Axiom schema of ∆0 -separation: ∀y(∀w∃z∀w′((w′ ∈ z → (w′ ∈ w ∧ ϕ[w′/x])) ∧ ((w′ ∈ w ∧ ϕ[w′/x]) → w′ ∈ z))),

∞ for every inﬁnitary ∆0 -formula ϕ(x, y), and, ∞ (vii) Axiom schema of ∆0 -collection: ∀z(∀x∃yϕ → ∀w∃w′∀x ∈ w∃y ∈ w′ϕ),

∞ for every inﬁnitary ∆0 -formula ϕ(x, y, z).

∞ The axiom schema of full collection is obtained from ∆0 -collection by allowing arbitrary inﬁnitary formulas.

Theorem 39. The axioms of inﬁnitary Kripke-Platek set theory are uniformly realised. Moreover, the axiom schema of full collection is uniformly realised.

Proof. It is straightforward to construct realisers for the axioms of empty set, pairing, extensionality and union. For each of the remaining axioms, we will now give an informal description of an algorithm that realises it. First, consider the axiom schema of induction. For every inﬁnitary formula ϕ(x, y) we have to show that the corresponding instance is realisable:

∀y(∀x((∀z ∈ xϕ[z/x]) → ϕ) → ∀xϕ). REALISABILITY FOR INFINITARY INTUITIONISTIC SET THEORY 19

It is sufficient to describe a program c that takes a code a for a Y¯ , a code b for X and a realiser r for ∀x(∀z ∈ xϕ[z/x]) → ϕ as input, and computes a realiser ϕ[X/x]. A realiser of the corresponding instance of the induction axiom is then obtained through currying: transform c(·, ·, ·) into λa.λb.λr.c(a,b,r). We will describe a procedure to obtain a realiser of ϕ[X/x, Y/¯ y] by recursively building up realisers in the transitive closure of X. To do so, the program c uses two auxiliary tapes, Done and Realisers, to keep track of its progress. The tape Done is used to keep track of the sets Z in the transitive closure of X, for which a realiser of ϕ[Z/x, Y/¯ y] has already been computed. Meanwhile, Realisers is used as a stack on which the realisers for all sets in Done are saved. Now, until all members of the essential domain of b are in Done, the program keeps running through the elements of the essential domain of b. For each α in the essential domain of b, the program checks whether all its members are contained in Done. If so, the program uses the realisers contained in Realisers to compute a realiser of ∀z ∈ db(α)ϕ[z/x, Y¯ ]. Note that this can easily be done by using the pair hc′, {b,f}i, where f is a code of the current content of Realisers and c′ is the program that searches through f for a realiser of the set whose code is given ′ as input. Then the program computes r(d) to obtain a realiser r of ϕ[db(α)/x, Y/¯ y] and saves this pair hα, r′i in Realisers. Once realisers for every element of the essential domain of b are computed, the program computes a realiser of ϕ[X/x, Y/¯ y] in the same way and returns it. ∞ Second, consider the axiom schema of ∆0 -separation. By Lemma 20 and Lemma 22 it is enough to show that for every X and Y¯ , the set {Z ∈ X | ϕ[Z/x, Y/¯ y]} is computable. But this follows from Theorem 21 and Lemma 10. Finally, consider the axiom schema of collection. For every infinitary ϕ(x, y, z) we have the axiom ∀z(∀x∃yϕ → ∀w∃w′∀x ∈ w∃y ∈ w′ϕ). Let Z¯ be a sequence coded by some a. It suffices to show that there is a program that given realiser r of ∀x∃yϕ, and a code b for a set W , computes a code for a set W ′ such that ∀x ∈ W ∃y ∈ W ′ϕ. Our program uses an auxiliary stack Codes. The program searches through b and for every α ∈ dom(db) such that db(α) ∈ db(ρb) uses r to compute a code for a set Y such that ϕ[db(α)/x, Y/y, Z/¯ z] is realised and saves the computed code in Codes. The claim follows by Lemma 10.

The proof of the following lemma is analogous to a proof by the ﬁrst author ([3, Lemma 8.6.3]).

Lemma 40. Let Φ be an OTM-program. Then for every binary sequence s of size κ ≥ ω, we have the + + following: if Φ halts on s, then |Φ(s)| <κ . Moreover, there is γ<κ such that Φ(s) ∈ Lγ [s].

Proof. Assume κ ≥ ω and that Φ(s) halts. Note that Φ(s) cannot be longer than the halting time λ of Φ on input s. Indeed, Φ will need at least one step in order to compute each bit of the output. ω Let ϕ(x,y,z) be the ∆0 -formula expressing that x is the computation of the program y on input z. ∞ Consider the Σ1 -sentence ∃xϕ(x, Φ,s) expressing the fact that there is a computation of Φ on s. Let δ = max{ℵ0,κ,λ}. Note that Lδ+ [s] |= ∃xϕ(x, Φ,s). Indeed, Lδ+ [s] contains the computation σ of Φ over s, and ϕ is absolute between transitive models.

Now, let H be the Skolem hull of κ ∪{s} in Lδ+ [s]. Then, H has size κ and so does the transitive collapse M of H. But then M is a transitive model of ∃xϕ(x, Φ,s). Therefore, there is σ′ ∈ M such ′ ∞ that M |= ϕ(σ , Φ,s), and since ϕ is a ∆0 -formula it is absolute between transitive models of set theory. Therefore, σ′ is the computation of Φ with input s of size at most κ. Finally, λ ≥ κ and by the + + Condensation Lemma, M = Lγ [s] for some γ<δ = κ . So, Φ(s) ∈ Lγ [s].

Lemma 41 ([3, Proposition 9.4.3] ). The axiom of power set is not realised. 20 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

Proof. A realiser of the power set axiom is a pair hc, P i where c is the code of a program with parameter P that takes a code of a set X as input and returns a code for ℘(X). Now let a be any code for the set P . By Lemma 40, the output of program c with input a and parameter P has size <|P |+. Therefore, the result of the computation cannot be a code of ℘(P ).

Corollary 42. There are sentences ϕ and χ in the language of set theory such that ϕ → χ is uniformly realised but ϕ → χ is false.

Proof. Let ϕ be the power set axiom and χ be the sentence ∃x x 6= x. It is then trivial that ϕ → χ is uniformly realised by the previous Lemma 41. However, ϕ → χ is false since the power set axiom holds and ∃x x 6= x is false.

Lubarsky [17] suggested the following inﬁnity axiom in the context of intuitionistic Kripke-Platek set theory:

(Inﬁnity) ∃x(∅ ∈ x ∧ (∀y y ∈ x → y ∪{y} ∈ x) ∧ (∀y y ∈ x → (y = ∅ ∨ ∃z ∈ y y = z ∪{z}))).

Proposition 43. The inﬁnity axiom is uniformly realised.

∞ Proof. The inﬁnity axiom is a Σ1 -formula and, therefore, uniformly realised by Lemma 20. The following theorem is a variant of a result of the ﬁrst author ([2, Proposition 3]).

Theorem 44. Assume V = L. If ϕ is a true Π2-formula, then ϕ is realised.

Proof. Let ϕ be the Π2-statement ∀x∃yψ(x, y), where ψ is a ∆0-formula. A realiser of ϕ must consist in an OTM that, given a constructible set X, computes some constructible set Y and a realiser r for ψ(x, y)[X/x,Y/y]. Therefore, it is enough to show that there is a program that for every X computes a set Y such that ψ(x, y)[X/x,Y/y]. Split the tape into ω × On many disjoint portions. Let (Pi)i ∈ ω be a computable enumeration of Turing machine programs. On the (i, α)-th portion of the tape, run

Pi on input α. In this way, every OTM-computable set of ordinals will eventually be computed on one of the portions. As the OTM-computable sets of ordinals coincide with the constructible sets of ordinals (cf. Koepke [15]), all constructible sets of ordinals will eventually be on a portion of the tape. While producing all the constructible sets, our program uses Theorem 21 to look for a Y such that ψ(x, y)[X/x,Y/y] and stops when it ﬁnds one.

Proposition 45 (cf. [3, Proposition 9.4.4]). The axiom schema of separation is not realisable.

Proof. Let χ(y,y′) be the formula stating that y′ is the power set of y. Let ϕ = ∃y′χ. Further assume that r = hc, P i realises the corresponding instance of separation:

∀y∀w∃z∀w′((w′ ∈ z → (w′ ∈ w ∧ ϕ[w′/x])) ∧ ((w′ ∈ w ∧ ϕ[w′/x]) → w′ ∈ z).

Let a be a code for Y , b be a code for ∅ and c a code for {∅}. Then r(a)(c) is a realiser of:

∃z∀w′((w′ ∈ z → (w′ ∈ {∅}∧ ϕ[w′/x])) ∧ ((w′ ∈ {∅}∧ ϕ[w′/x]) → w′ ∈ z)[Y/y][W/w], i.e. r(a)(c)(0) = hd, si, where d is a code for a set and s a realiser. Since the formula ∃y′χ[Y/y] is trivially realised by taking the power set of y′ as a parameter, it follows that the set Z coded by d is non-empty and, in fact, Z = {∅}. Let t ∅ ∈ {∅}. It follows that s(b)(0)(t)(1) ϕ[w′/x]), i.e. s(b)(0)(t)(1) computes a power set of Y . This is in contradiction to Lemma 41. REALISABILITY FOR INFINITARY INTUITIONISTIC SET THEORY 21

Recall that a choice function f on X satisﬁes f(Y ) ∈ Y for all Y ∈ X. The axiom of choice is the principle that there is a choice function on every set X if X does not contain the empty set. The well-ordering principle states that every set is in bijection with an ordinal. The weak axiom of choice states that for every set X there is a function f satisfying ∀Y ∈ X(∃Z(Z ∈ Y ) → f(Y ) ∈ Y ).

Theorem 46. The weak axiom of choice is uniformly realised.

Proof. For each Y ∈ X, let rY be a uniform realiser of ∃Z(Z ∈ Y ). Then rY = haY ,sY i, where aY is the code of an element ZY of Y . These realisers can be combined into a function f with f(Y )= ZY to obtain a realiser of the weak axiom of choice.

Despite the fact that the axiom of choice and the weak axiom of choice are classically equivalent, the ﬁrst one is considerably stronger from the point of view of realisability.

Theorem 47. The axiom of regularity, the axiom of choice, and the well-ordering principle are realisable. If 0♯ exists, then these principles are not uniformly realisable.

Proof. Note that since the ∈-minimal elements of a set are computable. For this reason, the axiom of regularity can be realised by returning a code for the first ∈-minimal element that the machine finds. Similarly, for the axiom of choice, the machine just searches through the code of the input family and for each set in the family output the first element it finds. Finally, the well-ordering principle is realisable because every code of a set induces a well-ordering on the set which can be computed and returned by an OTM. Note that all these algorithms are not uniform because their output crucially depends on the specific codes of the input sets. To prove the second part, note that a uniform realiser of the axiom of regularity can easily be used to uniformly realise the axiom of choice by picking out an (∈-minimal) element of each set in the given collection. Similarly, a uniform realiser of the well-ordering principle can be used to uniformly realise the axiom of choice (see [3, Section 8.6.1]). For this reason, it is enough to show that the axiom of choice cannot be uniformly realised but this follows by [3, Lemma 8.6.22].

Friedman’s IZF has the standard axioms of ZF; we saw that not all of them are OTM-realisable. Aczel’s CZF has the axioms of extensionality, pairing, union, empty set, inﬁnity, bounded separation, strong collection, the subset collection scheme and the axiom of set induction. Of these, only the subset collection scheme is not OTM-realised. As we have seen, all axioms of Kripke-Platek set theory are OTM-realisable.

5. Proof-Theoretic Application: The Admissible Rules of IKP

In this section, we will apply our realisability techniques to answer a recent proof-theoretic question of Iemhoff and the third author concerning finitary intuitionistic Kripke-Platek set theory IKP (see [12, Question 66]). The theory IKP was introduced by Lubarsky [17] to study admissible sets in the context of intuitionistic set theory. In our context, IKP is obtained by restricting infinitary Kripke-Platek set theory to the standard finitary language of set theory, and then adding the infinity axiom (see Proposition 43). For the rest of this section, we restrict our attention to finitary language of set theory. If T is a theory, then a map σ from the set of propositional variables to the set of sentences in the language of T is called a T -substitution. Given a propositional formula A, we write Aσ for the formula obtained from A by replacing each propositional letter p with the formula σ(p). 22 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

Definition 48. A propositional rule is an ordered pair (A, B) of formulas in propositional logic, usually A A written B . A propositional rule B is called admissible for a theory T if for all substitutions σ of propositional letters for sentences in the language of T , we have that T ⊢ Aσ implies that T ⊢ Bσ. A σ σ A propositional rule B is called derivable for a theory T if T ⊢ A → B for all substitutions σ of propositional letters for sentences in the language of T . In contrast to the case of classical propositional logic, it is possible for intuitionistic and intermediate logics to have admissible rules that are not derivable. The structure of the admissible rules of intuitionistic propositional logic has been investigated since the 1970s. Rybakov [23] proved that the set of admissible rules of IPC is decidable, answering a question of Friedman [8, Question 40]. Visser [25] later showed that the propositional admissible rules of Heyting Arithmetic are exactly the admissible rules of intuitionistic propositional logic, and Iemhoff [11] provided an explicit description of the set of admissible rules (a so-called basis). Recently, Iemhoff and the third author [12] analysed the structure of propositional and first-order logics of intuitionistic Kripke-Platek set theory IKP, and showed, in particular, that the propositional logic of IKP is IPC.2 It follows that the set of propositional admissible rules of IKP is included in the set of propositional admissible rules of IPC. This suggests the question of whether the converse inclusion holds as well ([12, Question 66]). We will now show that this is indeed the case, and hence, that the propositional admissible rules of IKP are exactly the admissible rules of IPC. For technical purposes, we first need to consider a certain conservative extension of IKP (and show, of course, that it is indeed conservative). To keep all languages set-sized, we will from now on work with realisability over Vκ for some inaccessible cardinal κ. Hence, all notions of realisability are restricted to Vκ, and all realisers must be elements of Vκ as well. Recall that the elementary diagram of Vκ contains the statements ca ∈ cb whenever a ∈ b, and ca = cb whenever a = b. Definition 49. Let T be an extension of IKP in the language of set theory. The theory T ∗ is obtained from T by extending the language of IKP with constant symbols for every element of Vκ and adding the elementary diagram of Vκ to IKP. Lemma 50. Let the theory T be an extension of IKP. Then T ∗ is conservative (in the constant-free language of set theory) over T . Proof. Suppose that T ∗ ⊢ ϕ, where ϕ is a sentence in the language of IKP. By compactness we can assume that

ψj ∧ χi ⊢ ϕ j

χi ⊢ ψj → ϕ. i

∃ca0 ∃ca1 ... ∃cak χi ⊢ ψj → ϕ. i

Now the whole sequent is in the usual language of set theory, without constants. Applying the converse implication rule (see Proposition 28), we get

ψj ∧ ∃ca0 ∃ca1 ... ∃cak χi ⊢ ϕ. j

X := ∃ca0 ∃ca1 ... ∃cak χi i

∈-relation between finitely many sets in some Vκ (which is, of course, well-founded by the foundation axiom). Hence, to see that X is a theorem of IKP it suffices to see that every such finite graph can be modelled by using the axioms of empty set, pairing and union. Our next step is to adapt the technique of glued realisability to our situation (see van Oosten’s survey [18] for the arithmetical version). Definition 51. Let T be a theory that is OTM-realised. We then define the T -realisability relation,

T by replacing conditions (iv) and (viii) of Deﬁnition 15 with the following clauses:

(iv’) r T ϕ → ψ if and only if T ⊢ ϕ → ψ and for every s T ϕ we have that r(s) T ψ, and,

(viii’) r T ∀xϕ if and only if T ⊢ ∀xϕ and r(X) T ϕ[X/x] for every set x. Note that we do not need to redefine condition (viii) in full generality for transfinite quantifiers as we are restricting to the finitary language in this chapter. Lemma 52. Let T be a theory extending IKP, and ϕ be a formula in the language of T ∗. ∗ (i) If T ⊢ ϕ and T is OTM-realised, then there is a realiser r T ϕ. ∗ (ii) If there is a realiser r T ϕ, then T ⊢ ϕ. Proof. The first statement is essentially proved in the same way as the fact that realisability is sound with respect to intuitionistic logic (see Corollary 34) and that all axioms of T are realised, paying attention to the fact that the new clauses (iv’) and (viii’) do not cause any problems. The second statement is proved with a straightforward induction on the complexity of the formula ϕ (in the extended language of T ∗), using the definition of T ∗ and Lemma 17 for the atomic cases. Proposition 53. Let T be a theory extending IKP, and ϕ be a formula in the language of T .

(i) If T ⊢ ϕ and T is OTM-realised, then there is a realiser r T ϕ.

(ii) If there is a realiser r T ϕ, then T ⊢ ϕ. Proof. This is a direct consequence of the previous Lemmas 50 and 52. This concludes our preparations and we are now ready to apply this to some proof-theoretic properties. Theorem 54 (Disjunction Property). Intuitionistic Kripke-Platek Set Theory IKP has the disjunction property, i.e., if IKP ⊢ ϕ ∨ ψ, then IKP ⊢ ϕ or IKP ⊢ ψ.

Proof. This is now a straightforward consequence of our preparations: If IKP ⊢ ϕ ∨ ψ, then IKP ϕ ∨ ψ by Proposition 53. By deﬁnition, it follows that IKP ϕ ∨ ψ. Hence, IKP ϕ or IKP ψ. Applying Proposition 53 again yields IKP ⊢ ϕ or IKP ⊢ ψ. 24 MERLIN CARL, LORENZO GALEOTTI, AND ROBERT PASSMANN

The restricted Visser’s rules {Vn}n<ω are deﬁned as follows: n

(pi → qi) → (pn+1 ∨ pn+2) i=1 ! ^n+2 n (pi → qi) → pj j=1 i=1 ! _ ^ a c Denote by Vn the antecedent and by Vn the consequent of the rule. We will make use of the following theorem, which is a direct corollary of Iemhoﬀ’s results [10].

Theorem 55 (Iemhoﬀ, [10, Theorem 3.9, Corollary 3.10]). If the restricted Visser’s rules are propositional admissible for a theory T with the disjunction property, then the propositional admissible rules of T are exactly the propositional admissible rules of intuitionistic propositional logic.

Theorem 56. The propositional admissible rules of IKP are exactly the admissible rules of IPC.

Proof. By Theorem 55 and the fact that IKP has the disjunction property (see Theorem 54) it suﬃces to show that the restricted Visser’s rules are propositional admissible. To this end, let σ be a substitution. IKP a σ We will write ϕi for σ(pi), and ψj for σ(qj ). Now, assume that ⊢ (Vn ) , i.e., spelling this out, n

IKP ⊢ (ϕi → ψi) → (ϕn+1 ∨ ϕn+2). i=1 ^ a σ IKP Denote the antecedent of (Vn ) by δ. We will now consider the theory + δ. There are two cases. IKP a σ In the first case, suppose that there is a realiser r IKP+δ δ. By assumption, ⊢ (Vn ) , and hence, a σ a σ with Proposition 53.(i), it follows that there is a realiser s IKP (Vn ) , and thus s IKP+δ (Vn ) . Hence, σ s(r) IKP+δ ϕn+1∨ϕn+2. It follows that ϕn+k is IKP+D -realised for some k< 2. By Proposition 53.(ii), we have IKP+δ ⊢ ϕn+k, and with the deduction theorem and some propositional reasoning, we conclude IKP c σ that ⊢ (Vn ) . In the second case, suppose that δ is not IKP + δ-realisable. By the definition of IKP + δ-realisability, this means that there is some i, 1 ≤ i ≤ n, such that ϕi → ψi is not IKP + δ-realised. This means that IKP + δ 6⊢ ϕi → ψi, or that for every potential realiser r, there is a realiser s ϕi such that r(s) 6 ψi. As ϕi → ψi is a consequence of δ, it follows, in particular, that there is a realiser r IKP+δ ϕi. IKP σ By Proposition 53.(ii), we have that + δ ⊢ ϕi . An application of the deduction theorem yields IKP IKP c σ ⊢ δ → ϕi. In this situation, it is immediate that ⊢ (Vn ) . IKP a σ IKP c σ In conclusion, we have shown that ⊢ (Vn ) implies that ⊢ (Vn ) for every substitution σ. This shows that Visser’s rule Vn is admissible for IKP for every n<ω. The difficulty in generalising this technique to the infinitary case seems to lie in generalising Lemma 50.

Question 57. Is it possible to generalise the techniques presented in this chapter to obtain proof- theoretic results for inﬁnitary Kripke-Platek set theory?

References

[1] Merlin Carl. A Note on OTM-Realizability and Constructive Set Theories. 2019. [2] Merlin Carl. Eﬀectivity and Reducibility with Ordinal Turing Machines. 2018. [3] Merlin Carl. Ordinal Computability. An Introduction to Inﬁnitary Machines. Berlin, Boston: De Gruyter, 2019. REFERENCES 25

[4] Merlin Carl, Benedikt Löwe, and Benjamin G. Rin. “Koepke Machines and Satisfiability for In- finitary Propositional Languages”. In: Unveiling Dynamics and Complexity: 13th Conference on Computability in Europe, CiE 2017, Turku, Finland, June 12–16, 2017, Proceedings. Ed. by Jarkko Kari, Florin Manea, and Ion Petre. 2017, pp. 187–197. [5] Merlin Carl, Sabrina Ouazzani, and Philip D. Welch. “Taming Koepke’s Zoo”. In: Sailing Routes in the World of Computation: 14th Conference on Computability in Europe, CiE 2018, Kiel, Ger- many, July 30 – August 3, 2018, Proceedings. Ed. by Florin Manea, Russell G. Miller, and Dirk Nowotka. 2018, pp. 126–135. [6] B. Dawson. “Ordinal Time Turing Computation”. PhD thesis. University of Bristol, 2009. [7] Christian Espíndola. A complete axiomatization of infinitary first-order intuitionistic logic over

Lκ+,κ. 2018. [8] Harvey Friedman. “One Hundred and Two Problems in Mathematical Logic”. In: The Journal of Symbolic Logic 40.2 (1975), pp. 113–129. [9] Wilfrid Hodges. “On the effectivity of some field constructions”. In: Proc. London Math. Soc. (3) 32.1 (1976), pp. 133–162. [10] Rosalie Iemhoff. “Intermediate Logics and Visser’s Rules”. In: Notre Dame J. Formal Logic 46.1 (Jan. 2005), pp. 65–81. [11] Rosalie Iemhoff. “On the Admissible Rules of Intuitionistic Propositional Logic”. In: The Journal of Symbolic Logic 66.1 (2001), pp. 281–294. [12] Rosalie Iemhoff and Robert Passmann. “Logics of intuitionistic Kripke-Platek set theory”. In: Annals of Pure and Applied Logic 172.10 (2021), pp. 1–22. [13] T. Jech. Set Theory: The Third Millennium Edition, revised and expanded. Springer Monographs in Mathematics. Springer, 2006. [14] P. Koepke and B. Seyfferth. “Ordinal machines and admissible recursion theory”. In: Annals of Pure and Applied Logic 160.3 (2009), pp. 310–318. [15] Peter Koepke. “Turing Computations on Ordinals”. In: Bulletin of Symbolic Logic 11.3 (2005), pp. 377–397. [16] E. Lewis. “Computation with Infinite Programs”. MA thesis. ILLC Master of Logic Thesis Series MoL-2018-14, Universiteit van Amsterdam, 2018. [17] Robert S. Lubarsky. “IKP and friends”. In: J. Symbolic Logic 67.4 (2002), pp. 1295–1322. [18] Jaap van Oosten. “Realizability: a historical essay”. In: Mathematical Structures in Computer Science 12.3 (2002), pp. 239–263. [19] Robert Paßmann. “De Jongh’s Theorem for Intuitionistic Zermelo-Fraenkel Set Theory”. In: 28th EACSL Annual Conference on Computer Science Logic, CSL 2020, January 13-16, 2020, Barcelona, Spain. Ed. by Maribel Fernández and Anca Muscholl. Vol. 152. LIPIcs. Schloss Dagstuhl - Leibniz- Zentrum für Informatik, 2020, 33:1–33:16. [20] Valery Plisko. “A survey of propositional realizability logic”. In: Bull. Symbolic Logic 15.1 (2009), pp. 1–42. [21] B. Rin. “The computational strengths of α-tape infinite time Turing machines”. In: Annals of Pure and Applied Logic 165.9 (2014), pp. 1501–1511. [22] Gene F. Rose. “Propositional calculus and realizability”. In: Trans. Amer. Math. Soc. 75 (1953), pp. 1–19. 26 REFERENCES

[23] Vladimir V. Rybakov. Admissibility of logical inference rules. Vol. 136. Studies in Logic and the Foundations of Mathematics. North-Holland Publishing Co., Amsterdam, 1997, pp. ii+617. [24] B. Seyﬀerth. “Three Models of Ordinal Computability”. PhD thesis. Rheinische Friedrich-Wilhelms- Universität Bonn, 2013. [25] Albert Visser. “Rules and arithmetics”. In: Notre Dame J. Formal Logic 40.1 (1999). Special issue in honor and memory of George S. Boolos (Notre Dame, IN, 1998), pp. 116–140.

Appendix A. Low-level coding

We will now introduce a coding of sets of ordinals as binary sequences of ordinal length and prove a few basic properties of this coding.

Remark 58. Note that sets of ordinals can in principle also be coded using characteristic functions. Unfortunately, since the largest ordinal in the set is not computable from the code, bounded searches are not computable with this simple coding and we would not be able to compute basic operations over sets, such as computing the image of a set under a computable function.

Given a binary sequence b ∈ 2

0i00i10 ... 0iα0 ... 11 ... where iα =1 if and only if α ∈ X. Note that the ﬁnal sequence 11 marks the end of the code of the set, i.e, none of the further bits matter in determining the set encoded by the sequence.3 In Section 2.3.2, we code sets as pairs hα, Xi consisting of an ordinal α and a set X of ordinals including α. For this reason, we will now extend the previous coding to pairs in On × ℘(On). The idea is to start with a code of X as described before and encode α in the ﬁnal part of the binary sequence. A sequence b ∈ 2

0i00i10 ... 0iγ0 ... 11 0000 ... 1000 ... α Code of X of length β + 2 where as before i =1 if and only if γ ∈ X. γ | {z } | {z } We take χ to be the class function that associates to every sequence encoding a pair hα, Xi the corresponding pair. It is easy to see that χ is bijective. We will say that a program c computes a class function F : On×℘(On) → On×℘(On) with parameters P if an OTM executing c with parameter P , and a sequence encoding a pair hα, Xi ∈ On × ℘(On) as input, returns a sequence that encodes F (hα, Xi). Moreover, we will say that c computes the class function F : ℘(On) → ℘(On) with parameter P if for every set X ∈ ℘(On), an OTM executing c with parameter P , and a sequence that encodes h0,Xi as input, returns a sequence that encodes h0, F (X)i. The previous coding can be easily extended to sequences in (On × ℘(On))

3For example, 0 is encoded by any sequence starting with 011, 1= {0} is encoded by any sequence starting with 01011, ω 0101010101 ... 011 and is encoded by any sequence starting with the sequence | {z } . length ω REFERENCES 27 order they appear in hhαβ,Xβi | β < ηi followed by a sequence of four 1s to mark the end of the code of the sequence. Therefore, a sequence hhαβ,Xβi | β < ηi is coded as follows: 0 0 0 1 1 1 0i00i10 ... 0iγ0 0 ... 11 0000 ... 10i00i10 ... 0iγ1 0 ... 11 0000 ... 1 ... 1111 α0 α1 Code of X0 Code of X1 β | {z } | {z } where, as before,|iγ =1 if{z and only if} γ ∈ Xβ for| all β <{z η. As mentioned} above, this coding induces a notion of computability over (On × ℘(On))

(iii) the function that given a code for hhαγ ,Xγi | γ < ηi and an ordinal β < η returns a code for

hαβ,Xβi,

(iv) the function that given a code for hhαγ ,Xγi | γ < ηi and an ordinal β < η returns a code for

the list obtained by removing the β-th element from hhαγ ,Xγi | γ < ηi, and,

(v) the function that given a code for hhαγ ,Xγi | γ < ηi, and a code for hα, Xi returns the a code

of the list hhαγ ,Xγi | γ < η +1i where hαη,Xηi = hα, Xi, (vi) conducting a bounded search through a set of ordinals. Proof. Given a code of a set of ordinals X as a binary sequence, and given some ordinal α such that

α< sup{2β +2 | β ∈ X}, an OTM can stop at the position of the tape which contains the iα bit of the code of X. In what follows, we will refer to this the cell of the tape as the position of iα on the tape. This can be computed by the program that moves the head of the tape left increasing a counter γ each time that the head is moved to a cell with an even index. Once γ reaches α, the machine moves to the next position of the tape and stops.

For (i), consider the program that goes through the code of X until it reaches the cell containing iα, copies the content of that cell to the output tape and then stops. For (ii), consider the program that runs through the representation of X and for each α ∈ X, first computes f(α), then writes a 1 in the position of if(α) on the output tape, and saves the index of the first cell of the output tape after which the output tape was not modified in an auxiliary counter γ. Once the program sees the sequence 011 in the representation of X, it moves the head of the output tape to position γ, writes 011 and stops.

For (iii), the program goes trough the code of hhαγ ,Xγi | γ < ηi while increasing a counter α as follows: each time that the program sees the sequence 011, it looks for the ﬁrst 1 after it and then increases α by 1. As soon as α = β, the program copies the input tape from the current position until the ﬁrst occurence of the sequence 011, then it copies all 0s following this and stops as soon as it reaches a cell with a 1.

For (iv), the program goes trough the code of hhαγ ,Xγi | γ < ηi while increasing a counter α as for (iii) and copying the input tape on the output tape. Once β = α the program continues to go through the representation of X without copying it to the output tape the until it sees the ﬁrst occurrence of the sequence 011 and the next 1 after that. Then the program continues copying the input tape to the output tape until it sees the sequence 1111. 28 REFERENCES

Note that (v) can be trivially computed by an algorithm that copies the representation of hhαγ ,Xγi | γ < ηi on the output tape except for the sequence 1111. Then the program copies the representation of hα, Xi on the output tape and writes the sequence 1111 when done. Finally, (vi) can be computed by combining the previous items. Note, in particular, that our choice of coding allows us an OTM to recognise when it reaches the end of a code.

By Lemma 59 we are now justiﬁed in treating tapes as stacks. If c is a code for an OTM-program,

P a parameter-set, and X and Y are sets of ordinals, we will write cP (X)= Y to mean that an OTM- computation of the program c with parameters P and input χ−1(X) halts with χ−1(Y ) on the output tape. We write cP (X)↑ if this computation does not halt. By using the coding deﬁned in the previous section we can extend the notion of computability to V.

Given two sets X and Y , we write cP (X)= Y when, given a code a for X, cP (a) computes a code of Y .

Note that the class relation cP on V is in general not a function but a multi-valued function—indeed, the set coded by the output of cP could depend on the speciﬁc code of X. Figure 1 shows how the codings interact with each other.

a 7→ da(ρa) χ V o On × ℘(On) o 2

Figure 1. An illustration of the stratiﬁcation of codings used in this paper. The

double arrow indicates the fact that R := {hX, Y i | cP (X)= Y } where c is the program computing f with parameter-set P could be a multi-valued function.