Imagine you designed a blueprint for a bridge, handed it to a contractor, and the contractor built something that looks right from the highway — but nobody checked whether the load-bearing joints actually match the engineering spec. That's the state of analog quantum error correction today. You write down a Hamiltonian that should protect quantum information, map it onto a chip, and hope the unwanted interactions don't wreck the code space. This paper builds an automated inspector that checks the joints. The core claim: for the first time, an end-to-end pipeline uses the Lean proof assistant to formally verify that a physical device Hamiltonian preserves the intended code space of a topological quantum error-correcting code. The demonstration target is an eight-qubit toric-code array on a superconducting device. An AI agent searches for device parameters within a prescribed leakage budget, and Lean verifies that four isolated low-energy states exist and closely match the ideal code space. This isn't a simulation claiming viability — it's a machine-checked proof that the mapping worked. The architectural move is layered. Starting from qubits and parity checks, the pipeline constructs the ideal Hamiltonian, determines the excitation gap protecting the code space, then tests whether the device retains the required number of isolated low-energy states and quantifies subspace fidelity. Three different bounds on unwanted energy shifts are compared: a naive sum of interaction strengths, a Pauli anticommuting-group bound, and full diagonalization. The Pauli grouping bound is tighter than the sum and closer to diagonalization, which matters practically because overly conservative bounds force you to overcompensate with hardware tuning you may not need. The integrity story is unusual for quantum computing papers — and stronger for it. Lean verification is not a simulation that could be quietly tuned. It's a proof checker: either the theorem compiles or it doesn't. The pipeline also identifies the strongest unwanted interactions and the specific qubits they affect, giving hardware engineers actionable targets rather than aggregate error metrics. That said, the demonstration is on an eight-qubit system, and no physical experiment on actual hardware is reported — the device model is the object of verification, not measured device behavior. The AI agent component uses an LLM to navigate Lean proof construction and parameter search, which is a pragmatic choice: formal verification is notoriously labor-intensive, and automating even part of the proof-search process is what makes this a pipeline rather than a one-off heroic proof. The workflow is designed to be extensible — different codes, different device models, different hardware platforms — though extensibility is claimed, not demonstrated beyond the toric code. Where does this sit against prior art? Formal verification has been applied to quantum circuits (gate-level), but connecting a code space definition to a continuous device Hamiltonian through Lean is new territory. The closest comparisons are numerical Hamiltonian simulation tools (which don't provide formal guarantees) and circuit-level verification frameworks (which don't address analog implementations). The gap this fills is real: as analog QEC implementations scale, the mapping-verification problem becomes intractable by hand. The milestone to watch is scaling. Eight qubits with four-body interactions is a proof of concept. The next meaningful target is a distance-3 or distance-5 surface code on 17-50+ qubits, where the unwanted interaction landscape becomes genuinely complex and hand-analysis breaks down. If the Lean verification and AI agent scale to that regime — where the Hilbert space is too large for full diagonalization — the pipeline becomes indispensable rather than merely impressive.
