@josd/eyecode 0.1.5 → 0.1.7

package/README.md

@@ -14,7 +14,7 @@ JavaScript library, and a browser application, with no dependencies.
 - **[Guide](https://eyereasoner.github.io/eyecode/GUIDE)**: run programs,
   write rules, check proofs, use the library, and develop eyecode.
 - **[Specification](https://eyereasoner.github.io/eyecode/SPEC)**: the
-  language, its canonical text, the proof format, and the C1–C7 checks.
+  language, its canonical text, the proof format, and the C1–C8 checks.
 - **[Examples](examples/)**: 63 runnable programs, with their conclusions,
   proofs and check reports, and a
   [card deck](https://eyereasoner.github.io/eyecode/examples/deck/) for each.

package/SPEC.md

@@ -2,7 +2,7 @@
 
 ```text
 Title:      The eyecode Rule Language and Proof Format
-Version:    eyecode 0.1.5
+Version:    eyecode 0.1.7
 Status:     Informational
 Author:     Jos De Roo, KNoWS office of IDLab, Ghent University - imec
 Repository: https://github.com/eyereasoner/eyecode
@@ -15,14 +15,14 @@ reasoning, and a proof format whose documents a separate checker verifies
 against the program that produced them. This document specifies the terms
 the language reasons over, how a program is stated in JavaScript, what a
 program concludes, the canonical text in which terms, conclusions, proofs and
-check reports are written and read back, the proof document, the seven
-conditions (C1-C7) a proof checker establishes, the check report, and the
+check reports are written and read back, the proof document, the eight
+conditions (C1-C8) a proof checker establishes, the check report, and the
 command line.
 
 ## Status of This Memo
 
 This document is not an Internet Standards Track specification. It describes
-the language and formats as implemented by eyecode 0.1.5, for readers who want
+the language and formats as implemented by eyecode 0.1.7, for readers who want
 to write programs, produce or consume proofs and reports, or implement a
 compatible reasoner or checker. Where this document and the implementation
 disagree, that is a defect in one of them.
@@ -393,7 +393,8 @@ concluded:
   shared. A variable that a value of the solution brought in, rather than a
   head variable, is named after its own variable, followed by `1`, `2`, ...
   when that name is taken. A rule that keeps meeting new activations does
-  not terminate (Section 7.3). Derived facts are therefore ground;
+  not terminate (Section 7.3). Derived facts are therefore ground. A
+  checker verifies the Skolem terms of a proof (C8, Section 11.9);
 - a head `'true'` reports the instance of the rule's body, as a conjunction,
   once per distinct instance (by identity of canonical text);
 - a head `'false'` records the conclusion `'false'` and stops all reasoning
@@ -593,7 +594,7 @@ empty bindings.
 A checker is given a program, a proof document and, when the proof answers
 goals asked from outside the program, those goals. It MUST NOT call a
 reasoner to supply a missing step; it MAY recompute primitives. It
-establishes seven conditions and records each failure with its condition, a
+establishes eight conditions and records each failure with its condition, a
 detail and, where there is one, the term concerned.
 
 ### 11.1 Reading the document
@@ -669,7 +670,28 @@ Otherwise the questions are, for each forward rule, each head other than
 question. Each step MUST be reachable from a conjunct of a claim through the
 conjuncts of uses.
 
-### 11.9 Counts and validity
+### 11.9 C8 Witness integrity
+
+A forward rule's head MAY contain variables its body does not contain; each
+says that something exists, and a reasoner concludes it with a Skolem term
+(Section 7.2). C1 alone would accept any value for such a variable, since any
+value gives an instance of the rule, so for a `clause(N)` step citing a
+forward rule, under the substitution of C1, each such variable `V` MUST be
+bound to `skolem(N, Name, Args)`, where:
+
+- `Name` is the name of `V` as the program writes it, or that name followed
+  by digits (Section 7.2);
+- `Args` is the same for every such variable of the step, and is the list of
+  the values of the heads' variables, in order of their first occurrence in
+  the heads, that are ground and contain no Skolem term `skolem(N, _, Args)`:
+  the values that do contain one hold a witness of this firing.
+
+A variable of the head that also occurs in the body is not checked by C8,
+even when the body leaves it unbound; its value comes from the uses, which
+other conditions check. A step citing a rule without such variables is not
+covered by C8.
+
+### 11.10 Counts and validity
 
 | Condition | Covered |
 | --- | --- |
@@ -680,6 +702,7 @@ conjuncts of uses.
 | C5 re_decision | `'builtin'` and `'control'` steps that passed C5 |
 | C6 boundary_consistency | boundaries decided |
 | C7 relevance | claims plus steps |
+| C8 witness_integrity | `clause` steps of forward rules with witnesses that passed C8 |
 
 A check also counts the **steps** it read, the **claims**, the `clause` steps
 **verified** by C1, the `'builtin'` steps **recomputed** by C5, the
@@ -689,7 +712,7 @@ steps **trusted**.
 A proof is **valid** when no condition failed. A valid proof with trusted
 boundaries is valid *conditional on* them.
 
-### 11.10 What a valid proof establishes
+### 11.11 What a valid proof establishes
 
 A valid proof establishes that each of its claims follows from the program
 by the recorded steps, given its trusted boundaries. It does not establish
@@ -702,23 +725,23 @@ leave conclusions out, and a run's own proof holds exactly its conclusions.
 A check report is a document (Section 9) holding, in this order, one fact per
 line:
 
-1. `condition(Id, Name, Outcome, Covered)` for C1 to C7, where `Outcome` is
+1. `condition(Id, Name, Outcome, Covered)` for C1 to C8, where `Outcome` is
    `'ok'` or `failed(N)`, `N` the number of that condition's failures;
 2. `failure(Condition, Subject, Detail)` per failure, where `Subject` is the
    term concerned or `'proof_document'`, and `Detail` an atom;
 3. `obligation(Kind, 'theory_scoped', Goal)` per trusted boundary, in step
    order, where `Kind` is `'absent'` or `'collected'`;
 4. `steps(N)`, `verified(N)`, `recomputed(N)`, `composed(N)`, `trusted(N)`,
-   `claims(N)`, the counts of Section 11.9;
+   `claims(N)`, the counts of Section 11.10;
 5. `verdict(V)`, where `V` is `failed(N)` when `N` failures were recorded,
    otherwise `'checked_with_obligations'` when there are obligations,
    otherwise `'checked'`.
 
 Failures are listed in the order they are found: those of reading the
 document (Section 11.1), in document order; C4 for each claim, in claim
-order; then for each step, in document order, C4 for its uses and the C1, C3
-or C5 failure of its justification; C6 for each boundary, in step order; C7
-for each claim, then for each step; and C2.
+order; then for each step, in document order, C4 for its uses and the C1, C3,
+C5 or C8 failure of its justification; C6 for each boundary, in step order;
+C7 for each claim, then for each step; and C2.
 
 `Detail` is a short human-readable text that names what failed, often with
 the canonical text of a term; it is informative, and implementations MAY word
@@ -733,6 +756,7 @@ it differently. eyecode's details are, by condition:
 | C5 | `primitive disagrees: ...`, `control step does not follow from its uses: ...`, `trusted boundary forbidden: absent` or `collected` |
 | C6 | `absence contradicted by evidence: ...`, `collected result is not a proper list: ...`, `collection misses ...: ...` |
 | C7 | `claim answers no goal: ...`, `step serves no claim: ...` |
+| C8 | `not the witness of this firing of clause N: ...` |
 
 The variables of each fact are renamed `A`, `B`, ..., `Z`, `A1`, ... in order
 of first occurrence. A report is ordinary data: `facts_from` (Section 4.2)
@@ -816,7 +840,7 @@ proofs SHOULD additionally bound document size, nesting depth and running
 time.
 
 A valid proof establishes that its claims follow from the program supplied
-to the checker (Section 11.10). It does not establish that the program is
+to the checker (Section 11.11). It does not establish that the program is
 correct or that the claims are all its conclusions, and a proof with
 obligations holds only conditional on them.
 
@@ -827,7 +851,7 @@ conclusions and proof documents in the canonical text, and checks every proof
 it produces as Section 11 describes. A conforming **checker** implements
 Sections 9, 11 and 12 and does not depend on a reasoner. For the same
 program, a conforming reasoner and checker MUST produce the same
-conclusions, proof documents and reports as eyecode 0.1.5, byte for byte,
+conclusions, proof documents and reports as eyecode 0.1.7, byte for byte,
 except for the `Detail` texts of failures (Section 12), the internal names of
 variables where Section 3 says so, and where the host's floating-point
 library functions (`exp`, `log`, the trigonometric and hyperbolic functions,
@@ -911,6 +935,7 @@ condition('C4', 'coverage', 'ok', 4)
 condition('C5', 're_decision', 'ok', 0)
 condition('C6', 'boundary_consistency', 'ok', 0)
 condition('C7', 'relevance', 'ok', 5)
+condition('C8', 'witness_integrity', 'ok', 0)
 steps(3)
 verified(3)
 recomputed(0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@josd/eyecode",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "A dependency-free JavaScript rule language with forward and backward reasoning and checkable proofs.",
   "type": "module",
   "main": "./src/index.js",

package/src/cli.js

@@ -8,7 +8,7 @@ import { VERSION } from './version.js';
 export const HELP = `Usage: eyecode [OPTION ...] [FILE ...]
 Programs are JavaScript; forward rules run to a fixpoint.
   --proof             Print the claims with clause(...) and step(...) records
-  --check-proof FILE  Print a C1-C7 check report of a proof (- for stdin)
+  --check-proof FILE  Print a C1-C8 check report of a proof (- for stdin)
   --json              Print the check report as JSON instead
   --goal GOAL         Ask a backward goal after forward reasoning; with
                       --check-proof, the goal the proof answers

package/src/index.js

@@ -3,7 +3,7 @@
 // Facts and rules are JavaScript. Forward rules materialize conclusions until
 // a fixpoint, backward rules are decided when a goal asks for them, and every
 // answer can come with a proof that a separate checker verifies against the
-// program, condition by condition (C1-C7).
+// program, condition by condition (C1-C8).
 export { VERSION } from './version.js';
 export { Result, run, unusedClauses } from './engine.js';
 export { readGoal } from './goals.js';

package/src/proof.js

@@ -1,4 +1,4 @@
-// Proof documents: rendering, and checking C1-C7 against the source program.
+// Proof documents: rendering, and checking C1-C8 against the source program.
 //
 // A proof document is JavaScript source, one expression per line: first the
 // claims, then clause(N, Display) for every source clause the proof cites,
@@ -15,7 +15,7 @@ import { CONTROL_KEYS, Program } from './program.js';
 import { readTerms } from './reader.js';
 import {
   Env, EyecodeError, Struct, Var, conjunction, copyResolved, deref, flattenConjunction, freshTerm,
-  isCallable, isGround, isTerm, key, listFromItems, properListItems, unify,
+  isCallable, isGround, isTerm, key, listFromItems, properListItems, unify, variables,
 } from './terms.js';
 import { Lettering, letterName, quote, write, writeNotingVariables } from './writer.js';
 
@@ -209,6 +209,7 @@ function check(program, claims, steps, goals, allowTrusted, fail, spellings, nam
     { id: 'C5', name: 're_decision', covered: tally.redecided + tally.composed, failed: failed('C5') },
     { id: 'C6', name: 'boundary_consistency', covered: confronted, failed: failed('C6') },
     { id: 'C7', name: 'relevance', covered: claims.length + steps.size, failed: failed('C7') },
+    { id: 'C8', name: 'witness_integrity', covered: tally.witnessed, failed: failed('C8') },
   ];
   return {
     valid: !fail.items.length,
@@ -294,7 +295,7 @@ const CONTROL_BY = 'control';
 // instance of the clause it cites, a recomputed primitive, a control composed
 // of its uses, or a trusted boundary the later checks confront.
 function checkSteps(program, steps, allowTrusted, fail, spellings, name) {
-  const tally = { verified: 0, redecided: 0, composed: 0, boundaries: [], trusted: [] };
+  const tally = { verified: 0, redecided: 0, composed: 0, witnessed: 0, boundaries: [], trusted: [] };
 
   function covered(goal) {
     if (isTerm(goal, 'and', 2)) return flattenConjunction(goal).every(covered);
@@ -316,7 +317,7 @@ function checkSteps(program, steps, allowTrusted, fail, spellings, name) {
       if (!covered(use)) fail.add('C4', `unjustified use ${text(use)}`, goal);
     }
     if (isTerm(by, 'clause', 1)) {
-      if (checkResolution(program, step, fail)) tally.verified++;
+      if (checkResolution(program, step, fail, tally)) tally.verified++;
     } else if (by === BUILTIN_BY) {
       if (bindings.length || uses.length || !isCallable(goal) || !PRIMITIVE_KEYS.has(key(goal))) {
         fail.add('C3', 'invalid builtin justification', goal);
@@ -415,8 +416,9 @@ function flatResolution(clause, goal, bindings, uses) {
 
 // C1: a clause step names a source clause, its bindings name distinct
 // variables of that clause, and under them one of the clause's heads is the
-// step's goal and its body is exactly the step's uses.
-function checkResolution(program, step, fail) {
+// step's goal and its body is exactly the step's uses. C8 is checked under
+// the same substitution.
+function checkResolution(program, step, fail, tally) {
   const { goal, by, bindings, uses } = step;
   const clauseId = by.args[0];
   const clause = clauseNamed(program, clauseId);
@@ -444,6 +446,7 @@ function checkResolution(program, step, fail) {
   }
   const heads = clause.forward ? flattenConjunction(head) : [head];
   let resolution = false;
+  let witnesses = null;
   for (const candidate of heads) {
     const mark = env.mark();
     let matches = unify(candidate, goal, env) && body.length === uses.length;
@@ -452,6 +455,9 @@ function checkResolution(program, step, fail) {
     }
     if (matches && resolvesTo(candidate, env, goal) && body.every((item, i) => resolvesTo(item, env, uses[i]))) {
       resolution = true;
+      // Any head the step can be an instance of decides; a verified witness wins.
+      const found = clause.forward ? checkWitnesses(clause, head, names, env) : null;
+      if (found !== null && witnesses !== true) witnesses = found;
     }
     env.undo(mark);
   }
@@ -459,9 +465,65 @@ function checkResolution(program, step, fail) {
     fail.add('C1', `not an instance of source clause ${clauseId}: ${text(goal)}`, goal);
     return false;
   }
+  if (witnesses === false) fail.add('C8', `not the witness of this firing of clause ${clauseId}: ${text(goal)}`, goal);
+  else if (witnesses === true) tally.witnessed++;
   return true;
 }
 
+// The variables of a forward rule's conclusions that its premise does not
+// mention: each stands for something that exists, its witness.
+function witnessNames(clause) {
+  if (clause.witnessNames === undefined) {
+    const inBody = new Set();
+    for (const goal of clause.body) for (const name of variables(goal).keys()) inBody.add(name);
+    clause.witnessNames = [...variables(clause.head).keys()].filter((name) => !inBody.has(name));
+  }
+  return clause.witnessNames;
+}
+
+// C8: under a step's substitution, each witness of a forward rule is the
+// Skolem term of this firing, skolem(Rule, Variable, Arguments), where
+// Arguments are the ground values of the conclusions' other variables, in
+// order of first occurrence, leaving out those that hold a witness of this
+// firing: the term the reasoner makes (Section 7.2). Returns null when the
+// rule has no witnesses, else whether they all hold; head is the rule's
+// renamed conclusions and names maps its variables to their renamed ones.
+function checkWitnesses(clause, head, names, env) {
+  const witnessed = witnessNames(clause);
+  if (!witnessed.length) return null;
+  let firing = null;
+  for (const name of witnessed) {
+    const value = copyResolved(names.get(name), env);
+    if (!isTerm(value, 'skolem', 3) || value.args[0] !== BigInt(clause.id) || !witnessName(value.args[1], name)) return false;
+    if (firing === null) firing = value.args[2];
+    else if (text(value.args[2]) !== text(firing)) return false;
+  }
+  const ofThisFiring = (term) => {
+    const pending = [term];
+    while (pending.length) {
+      const item = pending.pop();
+      if (!(item instanceof Struct)) continue;
+      if (item.name === 'skolem' && item.args.length === 3 && item.args[0] === BigInt(clause.id) &&
+          text(item.args[2]) === text(firing)) return true;
+      pending.push(...item.args);
+    }
+    return false;
+  };
+  const expected = [];
+  for (const variable of variables(head).values()) {
+    const value = copyResolved(variable, env);
+    if (isGround(value) && !ofThisFiring(value)) expected.push(value);
+  }
+  return text(listFromItems(expected)) === text(firing);
+}
+
+// The name a witness of variable name carries: the name itself, or with a
+// number when a value of the firing brought in a variable of the same name.
+function witnessName(written, name) {
+  if (typeof written !== 'string' || !written.startsWith(name)) return false;
+  return written === name || /^[0-9]+$/.test(written.slice(name.length));
+}
+
 // C6: a trusted boundary cannot be proved, but evidence at hand can refute
 // it. An absence fails when a source fact, a step of this certificate or a
 // recomputed primitive is a solution; a collection fails when such a solution

package/src/version.js

@@ -1,2 +1,2 @@
 // The release this checkout is; ./release keeps it in step with package.json.
-export const VERSION = '0.1.5';
+export const VERSION = '0.1.7';