@bramas/simulant-lean 0.0.0-stage → 0.1.0

package/Simulant/Exec.lean

@@ -0,0 +1,150 @@
+import Simulant.Round
+
+/-!
+# Executions, tasks and non-vacuity (plan, Sections 3.9, 3.10 and 5.2)
+
+Every execution permitted by the round is considered (no fairness on the
+adversary's choices), except that a semi-synchronous round only admits
+scheduler-fair executions: every agent that acts forever is activated
+infinitely often.
+-/
+
+namespace Simulant
+
+inductive Verdict where
+  | success | failure | inProgress
+deriving DecidableEq, Repr
+
+inductive Goal where
+  | eventually | eventuallyAlways | safety
+deriving DecidableEq, Repr
+
+variable {σ : Sig}
+
+structure Execution (σ : Sig) where
+  config : Nat → Config σ
+  witness : Nat → Witness
+  active : Nat → List (Fin σ.k)
+
+def Satisfies (goal : Goal) (verdict : Config σ → Verdict) (e : Execution σ) : Prop :=
+  match goal with
+  | .safety => ∀ n, verdict (e.config n) ≠ .failure
+  | .eventually => ∃ n, verdict (e.config n) = .success ∧ ∀ j, j ≤ n → verdict (e.config j) ≠ .failure
+  | .eventuallyAlways =>
+    (∀ n, verdict (e.config n) ≠ .failure) ∧ ∃ n, ∀ j, n ≤ j → verdict (e.config j) = .success
+
+namespace Model
+
+variable [FlagSet σ.F] (m : Model σ) (act0 : σ.A) (init : ND (Config σ))
+
+/-- Starts in an initial configuration and follows the round. -/
+def Valid (e : Execution σ) : Prop :=
+  ND.Can init (e.config 0) ∧
+    ∀ n, (e.witness n, (e.active n, e.config (n + 1))) ∈ m.roundA act0 (e.config n)
+
+/-- Every agent that acts forever is activated infinitely often. -/
+def Fair (e : Execution σ) : Prop :=
+  ∀ a : Fin σ.k, (∀ n, FlagSet.acts (e.config n).agents[a].flags ≠ .never) →
+    ∀ n, ∃ j, n ≤ j ∧ a ∈ e.active j
+
+def Admissible (e : Execution σ) : Prop :=
+  m.Valid act0 init e ∧ (m.round = .ssync → Fair e)
+
+/-- The correctness statement: every admissible execution satisfies the goal. -/
+def Correct (verdict : Config σ → Verdict) (goal : Goal) : Prop :=
+  ∀ e, m.Admissible act0 init e → Satisfies goal verdict e
+
+inductive Reachable : Config σ → Prop where
+  | init {C} : ND.Can init C → Reachable C
+  | step {C C' w a} : Reachable C → (w, (a, C')) ∈ m.roundA act0 C → Reachable C'
+
+/-! Non-vacuity: the model is not empty, so a correctness theorem is not vacuous. -/
+
+omit [FlagSet σ.F] in
+/-- (The model is an argument only so that `m.HasInitial init` reads like the other statements.) -/
+def HasInitial (_m : Model σ) (init : ND (Config σ)) : Prop := ∃ C, ND.Can init C
+
+def Total : Prop := ∀ C, Reachable m act0 init C → ∃ w a C', (w, (a, C')) ∈ m.roundA act0 C
+
+def HasExecution : Prop := ∃ e, m.Admissible act0 init e
+
+end Model
+
+/-! ## Lassos
+
+A finite lasso found by the explorer, checked by evaluation, gives an
+admissible execution (for a synchronous round). -/
+
+structure Lasso (σ : Sig) where
+  start : Config σ
+  /-- Each step: witness, activated agents, next configuration. -/
+  steps : List (Witness × List (Fin σ.k) × Config σ)
+  /-- The last configuration equals the configuration at this position (0 is `start`). -/
+  loop : Nat
+
+namespace Lasso
+
+def configs (l : Lasso σ) : List (Config σ) := l.start :: l.steps.map (·.2.2)
+
+/-- The position in the lasso after `n` steps. -/
+def pos (l : Lasso σ) : Nat → Nat
+  | 0 => 0
+  | n + 1 => if l.pos n + 1 = l.steps.length then l.loop else l.pos n + 1
+
+theorem pos_lt (l : Lasso σ) (h : l.loop < l.steps.length) : ∀ n, l.pos n < l.steps.length := by
+  intro n
+  induction n with
+  | zero => simp [pos]; omega
+  | succ n ih => simp only [pos]; split <;> omega
+
+theorem length_configs (l : Lasso σ) : l.configs.length = l.steps.length + 1 := by
+  simp [configs]
+
+def toExecution (l : Lasso σ) (h : l.loop < l.steps.length) : Execution σ where
+  config n := l.configs[l.pos n]'(by have := l.pos_lt h n; rw [length_configs]; omega)
+  witness n := (l.steps[l.pos n]'(l.pos_lt h n)).1
+  active n := (l.steps[l.pos n]'(l.pos_lt h n)).2.1
+
+variable [FlagSet σ.F]
+
+/-- Every step of the lasso is a step of the round, and it closes on itself. -/
+def Valid (m : Model σ) (act0 : σ.A) (l : Lasso σ) : Prop :=
+  l.loop < l.steps.length ∧
+  (∀ i (h : i < l.steps.length),
+    l.steps[i] ∈ m.roundA act0 (l.configs[i]'(by rw [length_configs]; omega))) ∧
+  l.configs[l.steps.length]? = l.configs[l.loop]?
+
+omit [FlagSet σ.F] in
+theorem config_succ (l : Lasso σ) (h : l.loop < l.steps.length)
+    (hclose : l.configs[l.steps.length]? = l.configs[l.loop]?) (n : Nat) :
+    (l.toExecution h).config (n + 1) =
+      (l.steps[l.pos n]'(l.pos_lt h n)).2.2 := by
+  have hp := l.pos_lt h n
+  simp only [toExecution, pos]
+  split
+  · rename_i heq
+    have h1 : l.configs[l.pos n + 1]? = some (l.steps[l.pos n]'hp).2.2 := by
+      simp [configs, hp]
+    rw [heq] at h1
+    rw [hclose] at h1
+    exact Option.some.inj ((List.getElem?_eq_getElem _).symm.trans h1)
+  · simp [configs]
+
+theorem toExecution_valid (m : Model σ) (act0 : σ.A) (init : ND (Config σ)) (l : Lasso σ)
+    (hv : l.Valid m act0) (hinit : ND.Can init l.start) :
+    m.Valid act0 init (l.toExecution hv.1) := by
+  obtain ⟨hlt, hsteps, hclose⟩ := hv
+  refine ⟨by simpa [toExecution, pos, configs] using hinit, fun n => ?_⟩
+  have hp := l.pos_lt hlt n
+  rw [config_succ l hlt hclose n]
+  have := hsteps (l.pos n) hp
+  simpa [toExecution] using this
+
+/-- For a synchronous round, a valid lasso is an admissible execution. -/
+theorem hasExecution (m : Model σ) (act0 : σ.A) (init : ND (Config σ)) (l : Lasso σ)
+    (hround : m.round = .fsync) (hv : l.Valid m act0) (hinit : ND.Can init l.start) :
+    m.HasExecution act0 init :=
+  ⟨l.toExecution hv.1, toExecution_valid m act0 init l hv hinit, fun h => by rw [hround] at h; cases h⟩
+
+end Lasso
+end Simulant

package/Simulant/Invariants.lean

@@ -0,0 +1,89 @@
+import Simulant.NonVacuity
+
+/-!
+# Invariants of public states
+
+The public state of an agent changes only through the algorithm's step:
+components never write it, and agents that do not decide keep it. So a
+property of public states that the step preserves holds of every agent in
+every reachable configuration, whatever the components.
+-/
+
+namespace Simulant
+
+variable {σ : Sig} [FlagSet σ.F]
+
+omit [FlagSet σ.F] in
+theorem Decision.idle_pub (a : Agent σ) (act : σ.A) : (Decision.idle a act).pub = a.pub := rfl
+
+theorem Config.apply_pub (C : Config σ) (e : Effect σ) (i : Fin σ.k) : (C.apply e).agents[i].pub = C.agents[i].pub := by
+  rw [Config.apply_agent]
+
+theorem moveAll_pub (ts : TState) (C : Config σ) (ds : Fin σ.k → Decision σ) (i : Fin σ.k) :
+    (moveAll ts C ds).agents[i].pub =
+      if ((ds i).decided && FlagSet.acts C.agents[i].flags != .never) = true then (ds i).pub else C.agents[i].pub := by
+  simp only [moveAll, Fin.getElem_fin, Vector.getElem_ofFn]
+  split <;> rfl
+
+namespace Model
+
+variable (m : Model σ) (act0 : σ.A) (P : σ.P → Prop)
+
+theorem options_pub (ts : TState) (C : Config σ) (i : Fin σ.k)
+    (hstep : ∀ mem pub v, P pub → P (m.step mem pub v).pub) (hC : P C.agents[i].pub)
+    {d : Decision σ} (hd : ND.Can (m.options act0 ts C i) d) : P d.pub := by
+  unfold Model.options at hd
+  dsimp only at hd
+  split at hd
+  · obtain ⟨_, -, rfl⟩ := ND.can_map.1 hd
+    exact hC
+  · obtain ⟨f, -, hd⟩ := ND.can_bind.1 hd
+    obtain ⟨v, -, hd⟩ := ND.can_bind.1 hd
+    rw [ND.can_pure.1 hd]
+    exact hstep _ _ _ hC
+
+theorem decideAll_pub (ts : TState) (C : Config σ)
+    (hstep : ∀ mem pub v, P pub → P (m.step mem pub v).pub) (hC : ∀ i : Fin σ.k, P C.agents[i].pub) :
+    ∀ (active : List (Fin σ.k)) (init : Fin σ.k → Decision σ), (∀ j, P (init j).pub) →
+      ∀ ds, ND.Can (active.foldlM (fun ds i => do
+          let d ← m.options act0 ts C i
+          pure fun j => if j = i then d else ds j) init) ds → ∀ j, P (ds j).pub
+  | [], init, hinit, ds, hds => by
+    rw [List.foldlM_nil, ND.can_pure] at hds
+    subst hds
+    exact hinit
+  | i :: rest, init, hinit, ds, hds => by
+    rw [List.foldlM_cons] at hds
+    obtain ⟨acc, hacc, hds⟩ := ND.can_bind.1 hds
+    obtain ⟨d, hd, rfl⟩ := ND.can_map.1 hacc
+    refine decideAll_pub ts C hstep hC rest _ ?_ ds hds
+    intro j
+    by_cases h : j = i
+    · simp only [h, ite_true]; exact m.options_pub act0 P ts C i hstep (hC i) hd
+    · simp only [h, ite_false]; exact hinit j
+
+/-- A property of public states preserved by the step holds of every agent after a round. -/
+theorem step_pub {C C' : Config σ} {w : Witness} (hstep : ∀ mem pub v, P pub → P (m.step mem pub v).pub)
+    (h : m.Step act0 C w C') (hC : ∀ i : Fin σ.k, P C.agents[i].pub) : ∀ i : Fin σ.k, P C'.agents[i].pub := by
+  obtain ⟨_, h⟩ := h
+  simp only [Model.roundA, ND.mem_bind, ND.mem_pure] at h
+  obtain ⟨_, ts, _, -, ⟨_, e1, _, -, ⟨_, act, _, -, ⟨_, ds, _, hd, ⟨_, e2, _, -, ⟨_, e3, _, -, ⟨-, heq⟩, -⟩, -⟩, -⟩, -⟩, -⟩, -⟩ := h
+  obtain ⟨-, rfl⟩ := Prod.mk.inj heq
+  have h1 : ∀ i : Fin σ.k, P (C.apply e1).agents[i].pub := by intro i; rw [Config.apply_pub]; exact hC i
+  have hds := m.decideAll_pub act0 P ts (C.apply e1) hstep h1 act _ (fun j => by rw [Decision.idle_pub]; exact h1 j) ds ⟨_, hd⟩
+  intro i
+  rw [Config.apply_pub, moveAll_pub, Config.apply_pub]
+  split
+  · exact hds i
+  · exact h1 i
+
+/-- ... and so of every agent in every reachable configuration. -/
+theorem reachable_pub (init : ND (Config σ)) (hstep : ∀ mem pub v, P pub → P (m.step mem pub v).pub)
+    (hinit : ∀ C, ND.Can init C → ∀ i : Fin σ.k, P C.agents[i].pub) {C : Config σ}
+    (h : m.Reachable act0 init C) : ∀ i : Fin σ.k, P C.agents[i].pub := by
+  induction h with
+  | init hC => exact hinit _ hC
+  | step _ hs ih => exact m.step_pub act0 P hstep ⟨_, hs⟩ ih
+
+end Model
+end Simulant

package/Simulant/Lemmas.lean

@@ -0,0 +1,146 @@
+import Simulant.Exec
+
+/-!
+# Library lemmas about the round, for any components (plan, Section 4)
+-/
+
+namespace Simulant
+
+variable {σ : Sig} [FlagSet σ.F]
+
+theorem mem_chooseIfMany {site : String} {l : List α} {w : Witness} {x : α}
+    (h : (w, x) ∈ chooseIfMany site l) : x ∈ l := by
+  unfold chooseIfMany at h
+  split at h
+  · simp only [ND.mem_pure] at h; rw [h.2]; exact List.mem_singleton_self _
+  · exact ND.can_choose.1 ⟨w, h⟩
+
+@[simp] theorem Config.apply_world (C : Config σ) (e : Effect σ) : (C.apply e).world = e.world C.world := rfl
+
+@[simp] theorem Config.apply_agent (C : Config σ) (e : Effect σ) (i : Fin σ.k) :
+    (C.apply e).agents[i] = { C.agents[i] with flags := FlagSet.merge C.agents[i].flags (e.raise i) } := by
+  simp [Config.apply]
+
+theorem moveAll_never (ts : TState) (C : Config σ) (ds : Fin σ.k → Decision σ) (i : Fin σ.k)
+    (h : FlagSet.acts C.agents[i].flags = .never) : (moveAll ts C ds).agents[i] = C.agents[i] := by
+  simp only [Fin.getElem_fin] at h
+  simp [moveAll, h]
+
+@[simp] theorem moveAll_world (ts : TState) (C : Config σ) (ds : Fin σ.k → Decision σ) :
+    (moveAll ts C ds).world = C.world := rfl
+
+variable [LawfulFlagSet σ.F]
+
+theorem apply_never (C : Config σ) (e : Effect σ) (i : Fin σ.k)
+    (h : FlagSet.acts C.agents[i].flags = .never) : FlagSet.acts (C.apply e).agents[i].flags = .never := by
+  rw [Config.apply_agent]
+  exact LawfulFlagSet.acts_merge_never _ _ h
+
+/-- An agent that never acts (crashed, dead) neither moves nor acts again, whatever the components. -/
+theorem never_stays (m : Model σ) (act0 : σ.A) {C C' : Config σ} {w : Witness} (h : m.Step act0 C w C')
+    (i : Fin σ.k) (hn : FlagSet.acts C.agents[i].flags = .never) :
+    C'.agents[i].pos = C.agents[i].pos ∧ FlagSet.acts C'.agents[i].flags = .never := by
+  obtain ⟨_, h⟩ := h
+  simp only [Model.roundA, ND.mem_bind, ND.mem_pure] at h
+  obtain ⟨_, ts, _, -, ⟨_, e1, _, -, ⟨_, _, _, -, ⟨_, ds, _, -, ⟨_, e2, _, -, ⟨_, e3, _, -, ⟨-, heq⟩, -⟩, -⟩, -⟩, -⟩, -⟩, -⟩ := h
+  obtain ⟨-, rfl⟩ := Prod.mk.inj heq
+  have h1 := apply_never C e1 i hn
+  have h2 := apply_never _ e2 i h1
+  have hm := moveAll_never ts ((C.apply e1).apply e2) ds i h2
+  refine ⟨?_, ?_⟩
+  · simp only [Config.apply_agent] at hm ⊢
+    rw [hm]
+  · apply apply_never
+    rw [hm]
+    exact h2
+
+end Simulant
+
+/-! ## World parts that the round preserves
+
+An observation `g` of the world (typically: a component's part) is
+preserved by the round when every component preserves it. Components
+built from `Hooks` preserve every part they do not own (`toComponent_preserves`). -/
+
+namespace Simulant
+
+variable {σ : Sig} [FlagSet σ.F] {T : Type}
+
+/-- Every effect the component's hooks can produce preserves `g`. -/
+def Component.Preserves (c : Component σ) (g : σ.W → T) : Prop :=
+  (∀ ts C e, ND.Can (c.beforeLook ts C) e → ∀ w, g (e.world w) = g w) ∧
+  (∀ ts C ds e, ND.Can (c.beforeMove ts C ds) e → ∀ w, g (e.world w) = g w) ∧
+  (∀ ts C e, ND.Can (c.afterMove ts C) e → ∀ w, g (e.world w) = g w)
+
+omit [FlagSet σ.F] in
+theorem Component.Preserves.comp {c : Component σ} {g : σ.W → T} (h : c.Preserves g) (f : T → U) :
+    c.Preserves (fun w => f (g w)) := by
+  obtain ⟨h1, h2, h3⟩ := h
+  exact ⟨fun ts C e he w => congrArg f (h1 ts C e he w), fun ts C ds e he w => congrArg f (h2 ts C ds e he w),
+    fun ts C e he w => congrArg f (h3 ts C e he w)⟩
+
+theorem ND.can_map {m : ND α} {f : α → β} {b : β} :
+    ND.Can (do let a ← m; pure (f a)) b ↔ ∃ a, ND.Can m a ∧ b = f a := by
+  rw [ND.can_bind]
+  exact exists_congr fun _ => and_congr_right fun _ => ND.can_pure
+
+theorem parallel_preserves {g : σ.W → T} (C : Config σ) :
+    ∀ (hooks : List (Config σ → ND (Effect σ))),
+      (∀ hk ∈ hooks, ∀ e, ND.Can (hk C) e → ∀ w, g (e.world w) = g w) →
+      ∀ e, ND.Can (parallel hooks C) e → ∀ w, g (e.world w) = g w
+  | [], _, e, he, w => by
+    simp only [parallel, ND.can_pure] at he
+    subst he
+    rfl
+  | hk :: hs, h, e, he, w => by
+    simp only [parallel, ND.can_bind, ND.can_pure] at he
+    obtain ⟨e1, h1, r, hr, rfl⟩ := he
+    have ih := parallel_preserves C hs (fun hk' hm => h hk' (List.mem_cons_of_mem _ hm)) r hr
+    show g (r.world (e1.world w)) = g w
+    rw [ih, h hk (List.mem_cons_self) e1 h1 w]
+
+/-- If every component preserves `g`, so does the round. -/
+theorem Model.step_preserves (m : Model σ) (act0 : σ.A) {g : σ.W → T}
+    (h : ∀ c ∈ m.components, c.Preserves g) {C C' : Config σ} {w : Witness}
+    (hs : m.Step act0 C w C') : g C'.world = g C.world := by
+  obtain ⟨_, hs⟩ := hs
+  simp only [Model.roundA, ND.mem_bind, ND.mem_pure] at hs
+  obtain ⟨_, ts, _, -, ⟨_, e1, _, h1, ⟨_, _, _, -, ⟨_, ds, _, -, ⟨_, e2, _, h2, ⟨_, e3, _, h3, ⟨-, heq⟩, -⟩, -⟩, -⟩, -⟩, -⟩, -⟩ := hs
+  obtain ⟨-, rfl⟩ := Prod.mk.inj heq
+  have p1 := parallel_preserves C _ (by
+    intro hk hm e he; simp only [List.mem_map] at hm; obtain ⟨c, hc, rfl⟩ := hm; exact (h c hc).1 ts C e he) e1 ⟨_, h1⟩
+  have p2 := parallel_preserves _ _ (by
+    intro hk hm e he; simp only [List.mem_map] at hm; obtain ⟨c, hc, rfl⟩ := hm; exact (h c hc).2.1 ts _ ds e he) e2 ⟨_, h2⟩
+  have p3 := parallel_preserves _ _ (by
+    intro hk hm e he; simp only [List.mem_map] at hm; obtain ⟨c, hc, rfl⟩ := hm; exact (h c hc).2.2 ts _ e he) e3 ⟨_, h3⟩
+  simp only [Config.apply_world, moveAll_world]
+  rw [p3, p2, p1]
+
+omit [FlagSet σ.F] in
+/-- A component preserves every part of the world that its own lens does not touch. -/
+theorem Hooks.toComponent_preserves (h : Hooks σ Wc) (L : Lens σ.W Wc) (g : σ.W → T)
+    (hg : ∀ w x, g (L.set w x) = g w) : (h.toComponent L).Preserves g := by
+  refine ⟨fun ts C e he w => ?_, fun ts C ds e he w => ?_, fun ts C e he w => ?_⟩ <;>
+  · obtain ⟨e, -, rfl⟩ := ND.can_map.1 he
+    exact hg _ _
+
+omit [FlagSet σ.F] in
+/-- A component preserves an observation of its own part that each of its own effects preserves. -/
+theorem Hooks.toComponent_preserves_own (h : Hooks σ Wc) (L : Lens σ.W Wc) [LawfulLens L] (g : Wc → T)
+    (hown : (∀ ts C e, ND.Can (h.beforeLook ts C) e → ∀ x, g (e.world x) = g x) ∧
+      (∀ ts C ds e, ND.Can (h.beforeMove ts C ds) e → ∀ x, g (e.world x) = g x) ∧
+      (∀ ts C e, ND.Can (h.afterMove ts C) e → ∀ x, g (e.world x) = g x)) :
+    (h.toComponent L).Preserves (fun w => g (L.get w)) := by
+  obtain ⟨h1, h2, h3⟩ := hown
+  refine ⟨fun ts C e he w => ?_, fun ts C ds e he w => ?_, fun ts C e he w => ?_⟩
+  · obtain ⟨e', he', rfl⟩ := ND.can_map.1 he
+    simp only [OwnEffect.lift, LawfulLens.get_set]
+    exact h1 ts C e' he' _
+  · obtain ⟨e', he', rfl⟩ := ND.can_map.1 he
+    simp only [OwnEffect.lift, LawfulLens.get_set]
+    exact h2 ts C ds e' he' _
+  · obtain ⟨e', he', rfl⟩ := ND.can_map.1 he
+    simp only [OwnEffect.lift, LawfulLens.get_set]
+    exact h3 ts C e' he' _
+
+end Simulant

package/Simulant/Library/BlackHole.lean

@@ -0,0 +1,54 @@
+import Simulant
+
+/-! Generated from the IR of component `BlackHole` by packages/lean-gen. Do not edit. -/
+
+set_option linter.unusedVariables false
+
+namespace Simulant.Library.BlackHole
+open Simulant
+
+inductive HolePolicy where
+  | none
+  | initiallyPresent
+  | mayEmerge
+deriving DecidableEq, Repr, Inhabited
+
+structure World (N : Nat) where
+  site : Fin N
+  active : Bool
+deriving DecidableEq, Repr
+
+/-- The flags declared by `BlackHole`, with the laws of a composition's flags. -/
+class Flags (F : Type) [FlagSet F] where
+  dead : F → Bool
+  raise_dead : F
+  dead_raise : dead raise_dead = true
+  dead_merge : ∀ a b : F, dead (FlagSet.merge a b) = (dead a || dead b)
+  dead_none : dead (FlagSet.none : F) = false
+
+class Actions (A : Type) where
+
+/-- What the composition gives the component: lenses on the state it owns. -/
+structure Ctx (σ : Sig) where
+  world : Lens σ.W (World σ.N)
+
+def initWorld {N : Nat} [NeZero N] (policy : HolePolicy) (site : Fin N) : ND (World N) := do
+  let site ← (pure site)
+  let active ← (pure (policy == HolePolicy.initiallyPresent))
+  pure { site := site, active := active }
+
+section
+variable {σ : Sig} [FlagSet σ.F] [Flags σ.F] [Actions σ.A]
+
+/-- The hooks, on the part of the world the component owns. -/
+def hooks (policy : HolePolicy) (L : Ctx σ) : Hooks σ (World σ.N) where
+  beforeLook := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+  beforeMove := fun ts C ds => pure ⟨id, fun _ => FlagSet.none⟩
+  afterMove := fun ts C => (do let active ← (if ((policy == HolePolicy.mayEmerge) && (!((L.world.get C.world).active))) then (ND.choose "BlackHole.active" ([false, true] : List (Bool))) else (pure ((L.world.get C.world).active))); (pure ({ world := fun x => { x with active := active }, raise := fun a => (if (fun (a : Fin σ.k) => ((FlagSet.present C.agents[a].flags) && active && ((C.agents[a].pos) == ((L.world.get C.world).site)))) a then (Flags.raise_dead : σ.F) else FlagSet.none) } : OwnEffect σ (World σ.N))))
+
+def component (policy : HolePolicy) (L : Ctx σ) : Component σ :=
+  (hooks policy L).toComponent L.world
+
+end
+
+end Simulant.Library.BlackHole

package/Simulant/Library/CrashAtNode.lean

@@ -0,0 +1,46 @@
+import Simulant
+
+/-! Generated from the IR of component `CrashAtNode` by packages/lean-gen. Do not edit. -/
+
+set_option linter.unusedVariables false
+
+namespace Simulant.Library.CrashAtNode
+open Simulant
+
+structure World (N : Nat) where
+  crashNode : Fin N
+deriving DecidableEq, Repr
+
+/-- The flags declared by `CrashAtNode`, with the laws of a composition's flags. -/
+class Flags (F : Type) [FlagSet F] where
+  crashed : F → Bool
+  raise_crashed : F
+  crashed_raise : crashed raise_crashed = true
+  crashed_merge : ∀ a b : F, crashed (FlagSet.merge a b) = (crashed a || crashed b)
+  crashed_none : crashed (FlagSet.none : F) = false
+
+class Actions (A : Type) where
+
+/-- What the composition gives the component: lenses on the state it owns. -/
+structure Ctx (σ : Sig) where
+  world : Lens σ.W (World σ.N)
+
+def initWorld {N : Nat} [NeZero N]  (crashNode : Fin N) : ND (World N) := do
+  let crashNode ← (pure crashNode)
+  pure { crashNode := crashNode }
+
+section
+variable {σ : Sig} [FlagSet σ.F] [Flags σ.F] [Actions σ.A]
+
+/-- The hooks, on the part of the world the component owns. -/
+def hooks  (L : Ctx σ) : Hooks σ (World σ.N) where
+  beforeLook := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+  beforeMove := fun ts C ds => (do let S ← (ND.choose "CrashAtNode.S" (B.subsets ((List.finRange σ.k).filter (fun (a : Fin σ.k) => ((FlagSet.correct C.agents[a].flags) && ((C.agents[a].pos) == ((L.world.get C.world).crashNode))))))); (pure ({ world := id, raise := fun a => (if (S).contains a then (Flags.raise_crashed : σ.F) else FlagSet.none) } : OwnEffect σ (World σ.N))))
+  afterMove := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+
+def component  (L : Ctx σ) : Component σ :=
+  (hooks  L).toComponent L.world
+
+end
+
+end Simulant.Library.CrashAtNode

package/Simulant/Library/CrashStop.lean

@@ -0,0 +1,38 @@
+import Simulant
+
+/-! Generated from the IR of component `CrashStop` by packages/lean-gen. Do not edit. -/
+
+set_option linter.unusedVariables false
+
+namespace Simulant.Library.CrashStop
+open Simulant
+
+/-- The flags declared by `CrashStop`, with the laws of a composition's flags. -/
+class Flags (F : Type) [FlagSet F] where
+  crashed : F → Bool
+  raise_crashed : F
+  crashed_raise : crashed raise_crashed = true
+  crashed_merge : ∀ a b : F, crashed (FlagSet.merge a b) = (crashed a || crashed b)
+  crashed_none : crashed (FlagSet.none : F) = false
+
+class Actions (A : Type) where
+
+/-- What the composition gives the component: lenses on the state it owns. -/
+structure Ctx (σ : Sig) where
+
+
+section
+variable {σ : Sig} [FlagSet σ.F] [Flags σ.F] [Actions σ.A]
+
+/-- The hooks, on the part of the world the component owns. -/
+def hooks (f : Nat) (L : Ctx σ) : Hooks σ Unit where
+  beforeLook := fun ts C => (do let S ← (ND.chooseSuch "CrashStop.S" (B.subsets ((List.finRange σ.k).filter (fun (x0 : Fin σ.k) => (FlagSet.correct C.agents[x0].flags)))) (fun (S : List (Fin σ.k)) => (decide ((((List.finRange σ.k).countP (fun (x1 : Fin σ.k) => (Flags.crashed C.agents[x1].flags))) + S.length) ≤ f)))); (pure ({ world := id, raise := fun a => (if (S).contains a then (Flags.raise_crashed : σ.F) else FlagSet.none) } : OwnEffect σ Unit)))
+  beforeMove := fun ts C ds => pure ⟨id, fun _ => FlagSet.none⟩
+  afterMove := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+
+def component (f : Nat) (L : Ctx σ) : Component σ :=
+  (hooks f L).toComponent (Lens.unit σ.W)
+
+end
+
+end Simulant.Library.CrashStop

package/Simulant/Library/Pebbles.lean

@@ -0,0 +1,51 @@
+import Simulant
+
+/-! Generated from the IR of component `Pebbles` by packages/lean-gen. Do not edit. -/
+
+set_option linter.unusedVariables false
+
+namespace Simulant.Library.Pebbles
+open Simulant
+
+inductive PebbleAction where
+  | none
+  | drop
+  | pick
+deriving DecidableEq, Repr, Inhabited
+
+structure World (N : Nat) where
+  pebbles : List (Fin N)
+deriving DecidableEq, Repr
+
+/-- The flags declared by `Pebbles`, with the laws of a composition's flags. -/
+class Flags (F : Type) [FlagSet F] where
+
+class Actions (A : Type) where
+  pebble : A → PebbleAction
+
+/-- What the composition gives the component: lenses on the state it owns. -/
+structure Ctx (σ : Sig) where
+  world : Lens σ.W (World σ.N)
+
+def initWorld {N : Nat} [NeZero N]   : ND (World N) := do
+  let pebbles ← (pure ([] : List (Fin N)))
+  pure { pebbles := pebbles }
+
+section
+variable {σ : Sig} [FlagSet σ.F] [Flags σ.F] [Actions σ.A]
+
+def sensor_pebblesHere (L : Ctx σ)  (ts : TState) (C : Config σ) (me : Fin σ.k) (frame : Bool) : ND (Nat) :=
+  (pure (((L.world.get C.world).pebbles).countP (fun (x0 : Fin σ.N) => (x0 == (C.agents[me].pos)))))
+
+/-- The hooks, on the part of the world the component owns. -/
+def hooks  (L : Ctx σ) : Hooks σ (World σ.N) where
+  beforeLook := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+  beforeMove := fun ts C ds => (pure (let picks := (((List.finRange σ.k).filter (fun (a : Fin σ.k) => (((ds a).decided) && ((Actions.pebble (ds a).act) == PebbleAction.pick)))).map (fun (x0 : Fin σ.k) => C.agents[x0].pos)); (let drops := (((List.finRange σ.k).filter (fun (a : Fin σ.k) => (((ds a).decided) && ((Actions.pebble (ds a).act) == PebbleAction.drop)))).map (fun (x0 : Fin σ.k) => C.agents[x0].pos)); ({ world := fun x => { x with pebbles := ((B.diff ((L.world.get C.world).pebbles) picks) ++ drops) }, raise := fun a => FlagSet.none } : OwnEffect σ (World σ.N)))))
+  afterMove := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+
+def component  (L : Ctx σ) : Component σ :=
+  (hooks  L).toComponent L.world
+
+end
+
+end Simulant.Library.Pebbles

package/Simulant/Library/PersistentReflection.lean

@@ -0,0 +1,40 @@
+import Simulant
+
+/-! Generated from the IR of component `PersistentReflection` by packages/lean-gen. Do not edit. -/
+
+set_option linter.unusedVariables false
+
+namespace Simulant.Library.PersistentReflection
+open Simulant
+
+structure Fields (N : Nat) where
+  mirrored : Bool
+deriving DecidableEq, Repr
+
+/-- The flags declared by `PersistentReflection`, with the laws of a composition's flags. -/
+class Flags (F : Type) [FlagSet F] where
+
+class Actions (A : Type) where
+
+/-- What the composition gives the component: lenses on the state it owns. -/
+structure Ctx (σ : Sig) where
+  fields : Lens σ.X (Fields σ.N)
+
+def init_mirrored {N : Nat} [NeZero N]   (i : Nat) : ND (Bool) :=
+  (ND.choose "PersistentReflection.mirrored" ([false, true]))
+
+section
+variable {σ : Sig} [FlagSet σ.F] [Flags σ.F] [Actions σ.A]
+
+/-- The hooks, on the part of the world the component owns. -/
+def hooks  (L : Ctx σ) : Hooks σ Unit where
+  beforeLook := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+  beforeMove := fun ts C ds => pure ⟨id, fun _ => FlagSet.none⟩
+  afterMove := fun ts C => pure ⟨id, fun _ => FlagSet.none⟩
+
+def component  (L : Ctx σ) : Component σ :=
+  (hooks  L).toComponent (Lens.unit σ.W)
+
+end
+
+end Simulant.Library.PersistentReflection

package/Simulant/Library/Visited.lean

@@ -0,0 +1,41 @@
+import Simulant
+
+/-! Generated from the IR of component `Visited` by packages/lean-gen. Do not edit. -/
+
+set_option linter.unusedVariables false
+
+namespace Simulant.Library.Visited
+open Simulant
+
+structure World (N : Nat) where
+  visited : List (Fin N)
+deriving DecidableEq, Repr
+
+/-- The flags declared by `Visited`, with the laws of a composition's flags. -/
+class Flags (F : Type) [FlagSet F] where
+
+class Actions (A : Type) where
+
+/-- What the composition gives the component: lenses on the state it owns. -/
+structure Ctx (σ : Sig) where
+  world : Lens σ.W (World σ.N)
+
+def initWorld {N : Nat} [NeZero N]   : ND (World N) := do
+  let visited ← (pure ([] : List (Fin N)))
+  pure { visited := visited }
+
+section
+variable {σ : Sig} [FlagSet σ.F] [Flags σ.F] [Actions σ.A]
+
+/-- The hooks, on the part of the world the component owns. -/
+def hooks  (L : Ctx σ) : Hooks σ (World σ.N) where
+  beforeLook := fun ts C => (pure ({ world := fun x => { x with visited := (((L.world.get C.world).visited) ++ (((List.finRange σ.k).filter (fun (x0 : Fin σ.k) => (FlagSet.present C.agents[x0].flags))).map (fun (x0 : Fin σ.k) => C.agents[x0].pos))).eraseDups }, raise := fun a => FlagSet.none } : OwnEffect σ (World σ.N)))
+  beforeMove := fun ts C ds => pure ⟨id, fun _ => FlagSet.none⟩
+  afterMove := fun ts C => (pure ({ world := fun x => { x with visited := (((L.world.get C.world).visited) ++ (((List.finRange σ.k).filter (fun (x0 : Fin σ.k) => (FlagSet.present C.agents[x0].flags))).map (fun (x0 : Fin σ.k) => C.agents[x0].pos))).eraseDups }, raise := fun a => FlagSet.none } : OwnEffect σ (World σ.N)))
+
+def component  (L : Ctx σ) : Component σ :=
+  (hooks  L).toComponent L.world
+
+end
+
+end Simulant.Library.Visited

package/Simulant/Library.lean

@@ -0,0 +1,6 @@
+import Simulant.Library.BlackHole
+import Simulant.Library.CrashStop
+import Simulant.Library.CrashAtNode
+import Simulant.Library.Pebbles
+import Simulant.Library.PersistentReflection
+import Simulant.Library.Visited