gdp-wired 0.1.0 → 0.2.0

package/README.md

@@ -42,7 +42,8 @@ code. If the checker side finds new frontiers the scope may grow; until then:
 | It expresses and proves | It does not (today) |
 | --- | --- |
 | Step machines over naturals: scalars, maps from naturals to naturals (one write per map per step), named step conditions, preconditions on params, assumptions per request | Lists, sets or strings as values: membership, subsets, equality of lists of names |
-| Invariants of the state and params, laws about every key of a map; step laws relating one step's before and after (`s'`, `M'[k]`: "only increases", "stays retired") | Laws about runs of two or more steps ("a refund never follows a release" needs a state flag), or orderings beyond progress |
+| Invariants of the state and params, laws about every key of a map; step laws relating one step's before and after (`s'`, `M'[k]`: "only increases", "stays retired"), and k-step laws about k steps in a row ("two grants on one day add two", up to 16 steps) | Orderings over any number of steps ("a refund never follows a release", at any distance, needs a state flag), beyond progress |
+| Composition: rules side by side (`product`), taking turns (`interleave`), and one rule refining another (`refinement`: a forward simulation, the spec allowing every request it is sent), each built as a plain machine so every law above applies | Refinement where the spec needs more than one step per step of the implementation |
 | Laws about one key of a map at a time, or about scalars | Totals across a map's keys ("the sum of every client's holdings equals in-use") |
 | Histories: sums and queries over a log of requests, relations between them proven one record at a time, pruning | Unbounded recursion over data, quantifiers over sequences other than a machine's own history |
 | Decisions over facts: flags, one-of choices, optional facts, bounded naturals (`match` covers every case) | Datatypes beyond those encodings; division, modulo, reals |
@@ -66,11 +67,11 @@ check times.
 
 | Part | Trusted? | What it does |
 | --- | --- | --- |
-| `kernel/kernel.ts`, `core/check.ts` | **Yes** | Turns a machine and its laws into goals (the induction rules: step machines with maps and flags, step laws, loops with ranks, progress, folds over trees, histories) and checks a proof tree for each: splits on linear atoms, a Fourier–Motzkin derivation at each leaf. Refuses names a machine doesn't declare |
+| `kernel/kernel.ts`, `core/check.ts` | **Yes** | Turns a machine and its laws into goals and checks a proof tree for each: splits on linear atoms, a Fourier–Motzkin derivation at each leaf. Every rule (step machines with maps and flags, step laws and k-step laws, loops with ranks, progress, folds over trees) is a few moves of one small algebra of runs: conditions holding where a run is, a step taken from there, a conclusion read at the end or across the run. Histories become plain machines first. Refuses names a machine doesn't declare |
 | `kernel/prove.ts` | No | Grows the trees. If it's wrong, the kernel rejects the tree |
-| `lean-kernel/` | Optional | The kernel's twin in Lean 4.34.0, each rule proven sound (`Kern.sound`, `machine_sound`, `mmachine_sound`, `fmmachine_sound`, `loop_sound`, `fold_sound`, `progress_sound`, `steplaw_sound`, `hmachine_sound`), axioms `propext`, `Classical.choice`, `Quot.sound` only. The exporter sends the kernel's real trees; tampered ones compute to false |
+| `lean-kernel/` | Optional | The kernel's twin in Lean 4.34.0, each rule proven sound (`Kern.sound`, `machine_sound`, `mmachine_sound`, `fmmachine_sound`, `loop_sound`, `fold_sound`, `progress_sound`, `steplaw_sound`, `kstep_sound`, `hmachine_sound`), axioms `propext`, `Classical.choice`, `Quot.sound` only. The exporter sends the kernel's real trees; tampered ones compute to false |
 | `search/`, `synth/`, `hw/` | No | GPU work: counterexample search over every short history, and invariant/rank synthesis. Every hit is replayed by the interpreter or proven by the kernel before it counts |
-| `core/dsl.ts`, the runtimes | No | The builders compile to the kernel's plain values; the interpreter and generated JavaScript are held to the reference evaluator by the conformance test |
+| `core/dsl.ts`, `core/compose.ts`, the runtimes | No | The builders and combinators compile to the kernel's plain values; the interpreter and generated JavaScript are held to the reference evaluator by the conformance test, and the combinators to runs of their parts |
 
 How the untrusted parts are held to the trusted ones, automatically:
 
@@ -85,7 +86,7 @@ How the untrusted parts are held to the trusted ones, automatically:
 - **Tampering and mutation** (`kernel/tamper.test.ts`, `kernel/refusals.test.ts`, `kernel/mutants.ts`): real proofs
   broken structurally or offered for weakened goals that have a model must be rejected, every refusal the kernel makes is
   exercised, and every one-operator mutation of `kernel.ts` and `check.ts` is run against the tests to find what they
-  don't notice: 222 of 241 mutants are caught, and the 19 left are equivalent (`kernel/MUTANTS.md`).
+  don't notice: 239 of 261 mutants are caught, and the 22 left are equivalent (`kernel/MUTANTS.md`).
 - **Fuzz**: the kernel never accepts a refutation of something with a model (`kernel/kernel.test.ts`), and laws proven
   over histories hold on every run (`kernel/history.test.ts`).
 
@@ -109,7 +110,9 @@ const dayCap = caps.law('day cap', ({Day, d}) => forall(k => Day.at(k).atMost(d)
 // Step laws: about one step, for every request the rule allows; `after` reads the state and maps after it.
 const onlyUp = caps.stepLaw('no count goes down', ({Day}, after) => forall(k => Day.at(k).atMost(after.Day.at(k))))
 const once = caps.stepLaw('a grant adds one to its day', ({day, Day}, after) => after.Day.at(day).eq(Day.at(day).plus(1)), ({granted}) => granted)
-proveSteps(caps, [dayCap], [onlyUp, once]) // {proven: true, checked: true}
+// k-step laws: about k steps in a row; `requests` holds each step's request, `when` narrows the j-th step's.
+const twice = caps.stepsLaw('two grants on one day add two', 2, ({day, Day}, after, [, next]) => next!.day.eq(day).implies(after.Day.at(day).eq(Day.at(day).plus(2))), ({granted}) => granted)
+proveSteps(caps, [dayCap], [onlyUp, once, twice]) // {proven: true, checked: true}
 
 // Histories: a log of requests, a sum over it (state), a query over it at the request's time (an input the runtime
 // computes), and a relation between them proven one record at a time.
@@ -136,6 +139,10 @@ const failsClosed = trial.decide('a missing fact means no trial', ({spent}) => s
 - **Arithmetic** over the naturals: `plus`, `minus` (truncated), `times(k)`, `mul` (a product of two terms), `min`,
   `max`, `when(cond, a, b)`, `count(cond)`; conditions `lt`, `atMost`, `eq`, `and`, `or`, `not`, `implies`.
 - **Loops** (`loop(...)`): state, `while`, `body`, a `rank` (or a tuple of ranks) that must drop each turn.
+- **Composition** (`gdp-wired/compose`): `product(a, b)`, `interleave(a, b)` and `refinement(impl, spec, {relation, witness})`
+  build plain machines from machines (each side's state named `a_x`, `b_x`). A refinement's laws are the relation, proven
+  by induction, and its step law says the spec allows the request `witness` sends it at each of the implementation's:
+  `examples/composition.ts` proves a meter that counts down refines one that counts up, and refuses two broken ones.
 - **Running it**: `rule.interpreter()` is persistent (searches branch from any state); `rule.compiled()` is what an app
   ships: maps and the log updated in place, so a step costs the same however long the history. Both refuse params and
   inputs that aren't naturals below 2^53 and any value past 2^53 − 1, where the proofs over the naturals stop describing
@@ -179,15 +186,15 @@ its Lean twin in 1.35 s. What each proves, what each ships at runtime, and where
 
 | Path | What |
 | --- | --- |
-| `core/` | Machines, the interpreter and JS compiler, the linear solver and its checker, Houdini invariants, models, the first Lean export |
+| `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean/`, `lean-kernel/` | Lean: the derivation checker `Cert.lean`, and the kernel's twin with its exported trees |
 | `search/`, `hw/`, `modal-gpu/` | Counterexample search on the GPU: a hand-written WGSL kernel, and the same through the Handwired fork's word stages |
 | `synth/` | Invariants and ranks found on the GPU, proven by the kernel |
-| `next/` | Guards synthesized from laws, relational laws (migrations, tenant isolation), a ReBAC audit |
+| `next/` | Guards synthesized from laws, relational laws (migrations, tenant isolation, through `core/compose.ts`), a ReBAC audit |
 | `sat/` | Bit-vector laws: bit-blasted, solved, LRAT-checked in TypeScript, optionally by Lean |
 | `enum/`, `perf/` | The enumeration, and the benchmarks |
-| `examples/` | The builders at work: `domains/` (92 rules across nine domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts` |
+| `examples/` | The builders at work: `domains/` (92 rules across nine domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `composition.ts` |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `spec.ts`, `gdp.ts`, `circuit.ts`, `laws.ts` | The audit path: gdp-ts predicates written once, as trusted provers per request and as a Handwired circuit that decides every (user, project) pair at once |
 | `modal/` | Everything above as Modal jobs: `suite.json` is the regression suite |
@@ -196,7 +203,8 @@ its Lean twin in 1.35 s. What each proves, what each ships at runtime, and where
 
 ## Running
 
-The npm package is the library: the builders (`gdp-wired`), the runtimes (`gdp-wired/machine`), the kernel
+The npm package is the library: the builders (`gdp-wired`), the runtimes (`gdp-wired/machine`), composition
+(`gdp-wired/compose`), the kernel
 (`gdp-wired/kernel`), the prover (`gdp-wired/prove`), the derivation checker and solver (`gdp-wired/check`,
 `gdp-wired/solver`). Everything else here (examples, comparisons, the Lean twin, the GPU searches) runs from a clone and
 needs [Bun](https://bun.sh); Lean 4.34.0 for `lean/` and `lean-kernel/`; a WebGPU runtime (Chrome, or Dawn's node
@@ -210,7 +218,7 @@ bun test core/compile.test.ts core/runtime.test.ts kernel/history.test.ts
 cd kernel && bun run-kernel.ts && bun test kernel.test.ts
 ```
 
-The whole suite (107 jobs, about 15 minutes of wall time) runs on [Modal](https://modal.com):
+The whole suite (110 jobs, about 15 minutes of wall time) runs on [Modal](https://modal.com):
 
 ```sh
 modal run modal/run.py --jobs modal/suite.json --out runs/modal/suite && sh modal/reap.sh

package/dist/core/compose.d.ts

@@ -0,0 +1,24 @@
+import { type C, type E, type Law, type Machine } from './machine.js';
+import type { StepLaw } from '../kernel/kernel.js';
+export declare const side: (m: Machine, prefix: "a_" | "b_", c: C) => C;
+export declare function product(a: Machine, b: Machine, opts?: {
+    name?: string;
+    params?: string[];
+    inputs?: string[];
+    bInputs?: Record<string, E>;
+    assume?: C;
+}): Machine;
+export declare function interleave(a: Machine, b: Machine, opts?: {
+    name?: string;
+    turn?: string;
+}): Machine;
+export declare function refinement(impl: Machine, spec: Machine, opts: {
+    relation: Law[];
+    witness: Record<string, E>;
+    name?: string;
+}): {
+    machine: Machine;
+    laws: Law[];
+    stepLaws: StepLaw[];
+};
+export declare function agree(a: Machine): Law[];

package/dist/core/compose.js

@@ -0,0 +1,121 @@
+// Composition: machines built from machines. Each combinator returns a plain Machine, so every capability (laws by
+// induction, step laws, k-step laws, progress, the runtimes, the Lean twin) applies to what it builds, and nothing here
+// is trusted: a proof is about the machine built, and the combinators are tested against runs of their parts.
+//   product(a, b)      both step on every request (their params and inputs shared by name)
+//   interleave(a, b)   one of them steps on each request, `turn` picking which
+//   refinement(impl, spec, {relation, witness})
+//                      impl refines spec: the spec, sent the request `witness` names for each of impl's, always allows it,
+//                      and `relation` holds of the two states at every step (a forward simulation)
+// Each side's state, maps and flags are renamed a_x and b_x; params and inputs keep their names.
+import { all, any, bit, not, same, unreachable, x } from "./machine.js";
+function rename(e, prefix, m, inputs) {
+    switch (e.op) {
+        case 'var': return m.params.includes(e.name) ? e : m.inputs.includes(e.name) ? (inputs[e.name] ?? e) : x(`${prefix}${e.name}`);
+        case 'const': return e;
+        case 'mul': return { ...e, a: rename(e.a, prefix, m, inputs) };
+        case 'if': return { op: 'if', c: renameC(e.c, prefix, m, inputs), then: rename(e.then, prefix, m, inputs), else: rename(e.else, prefix, m, inputs) };
+        case 'get': return { op: 'get', map: `${prefix}${e.map}`, key: rename(e.key, prefix, m, inputs) };
+        case 'add':
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'prod': return { ...e, a: rename(e.a, prefix, m, inputs), b: rename(e.b, prefix, m, inputs) };
+        default: return unreachable(e);
+    }
+}
+function renameC(c, prefix, m, inputs) {
+    if (c.op === 'flag')
+        return { op: 'flag', name: `${prefix}${c.name}` };
+    if (c.op === 'not')
+        return { op: 'not', x: renameC(c.x, prefix, m, inputs) };
+    if (c.op === 'and' || c.op === 'or')
+        return { op: c.op, xs: c.xs.map(y => renameC(y, prefix, m, inputs)) };
+    return { ...c, a: rename(c.a, prefix, m, inputs), b: rename(c.b, prefix, m, inputs) };
+}
+// A condition (or law) of one side, read in the composed machine.
+export const side = (m, prefix, c) => renameC(c, prefix, m, {});
+// One side renamed; `stays` (if given) is when its state doesn't move: each update and write keeps the old value then.
+function renamed(m, p, inputs, stays) {
+    if (m.history)
+        throw new Error(`${m.name}: a machine with a history is composed as its plain machine (historyMachine)`);
+    const keep = (now, old) => (stays ? { op: 'if', c: stays, then: old, else: now } : now);
+    return {
+        state: Object.fromEntries(Object.entries(m.state).map(([n, e]) => [`${p}${n}`, rename(e, p, m, {})])),
+        maps: Object.fromEntries(Object.entries(m.maps ?? {}).map(([n, v]) => [`${p}${n}`, v])),
+        step: {
+            flags: Object.fromEntries(Object.entries(m.step.flags ?? {}).map(([n, c]) => [`${p}${n}`, renameC(c, p, m, inputs)])),
+            state: Object.fromEntries(Object.entries(m.step.state ?? {}).map(([n, e]) => [`${p}${n}`, keep(rename(e, p, m, inputs), x(`${p}${n}`))])),
+            maps: Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([n, w]) => {
+                const key = rename(w.key, p, m, inputs);
+                return [`${p}${n}`, { key, value: keep(rename(w.value, p, m, inputs), { op: 'get', map: `${p}${n}`, key }) }];
+            })),
+        },
+        assume: m.assume ? renameC(m.assume, p, m, inputs) : undefined,
+    };
+}
+const join = (a, b) => ({
+    state: { ...a.state, ...b.state }, maps: { ...a.maps, ...b.maps },
+    step: { flags: { ...a.step.flags, ...b.step.flags }, state: { ...a.step.state, ...b.step.state }, maps: { ...a.step.maps, ...b.step.maps } },
+});
+const conj = (cs) => { const xs = cs.filter((c) => c !== undefined); return xs.length ? all(...xs) : undefined; };
+// a and b stepped by the same requests. `bInputs` rewrites what b sees (other tenants' requests as no-ops, say).
+export function product(a, b, opts = {}) {
+    const A = renamed(a, 'a_', {}), B = renamed(b, 'b_', opts.bInputs ?? {});
+    const assume = conj([A.assume, B.assume, opts.assume]), pre = conj([a.pre, b.pre]);
+    return {
+        name: opts.name ?? `${a.name} | ${b.name}`,
+        params: [...new Set([...a.params, ...b.params, ...(opts.params ?? [])])],
+        inputs: [...new Set([...a.inputs, ...b.inputs, ...(opts.inputs ?? [])])],
+        ...join(A, B),
+        ...(assume ? { assume } : {}),
+        ...(pre ? { pre } : {}),
+    };
+}
+// One of a and b steps on each request: a when turn = 0, b when turn = 1; the other keeps its state and maps. Each
+// side's assumption is about its own turns only.
+export function interleave(a, b, opts = {}) {
+    const turn = opts.turn ?? 'turn';
+    if ([...a.params, ...a.inputs, ...b.params, ...b.inputs].includes(turn))
+        throw new Error(`interleave: ${turn} is already a name of ${a.name} or ${b.name}`);
+    const isA = same(x(turn), { op: 'const', value: 0 }), isB = same(x(turn), { op: 'const', value: 1 });
+    const A = renamed(a, 'a_', {}, isB), B = renamed(b, 'b_', {}, isA);
+    const pre = conj([a.pre, b.pre]);
+    return {
+        name: opts.name ?? `${a.name} || ${b.name}`,
+        params: [...new Set([...a.params, ...b.params])],
+        inputs: [...new Set([...a.inputs, ...b.inputs, turn])],
+        ...join(A, B),
+        assume: all(bit(turn), ...(A.assume ? [any(not(isA), A.assume)] : []), ...(B.assume ? [any(not(isB), B.assume)] : [])),
+        ...(pre ? { pre } : {}),
+    };
+}
+// impl refines spec. The machine is impl and spec side by side, the spec sent, at each of impl's requests, the request
+// `witness` names (a term per spec input over impl's request, the params and both states, a_ and b_ names). The spec's
+// assumption is not assumed there: the step law `allowed` proves the spec allows every request it is sent. `relation`
+// (conditions over both states) holds at the start and after every step: the laws, proven by induction. With the
+// precondition: impl's is assumed, and the spec's, if any, is a law (it holds of every impl's params).
+// So every run of impl is matched, step by step, by a run of the spec that its own rules allow, related by `relation`.
+export function refinement(impl, spec, opts) {
+    if (!spec.inputs.every(i => i in opts.witness))
+        throw new Error(`refinement: name every input of ${spec.name} (${spec.inputs.join(', ')})`);
+    const A = renamed(impl, 'a_', {}), B = renamed(spec, 'b_', opts.witness);
+    const allowedBy = B.assume;
+    const machine = {
+        name: opts.name ?? `${impl.name} refines ${spec.name}`,
+        params: [...new Set([...impl.params, ...spec.params])],
+        inputs: impl.inputs,
+        ...join(A, B),
+        ...(A.assume ? { assume: A.assume } : {}),
+        ...(impl.pre ? { pre: impl.pre } : {}),
+    };
+    const laws = [...opts.relation, ...(spec.pre ? [{ name: `${spec.name}'s precondition`, holds: spec.pre }] : [])];
+    const stepLaws = allowedBy ? [{ name: `${spec.name} allows the request it is sent`, then: allowedBy }] : [];
+    return { machine, laws, stepLaws };
+}
+// "a and b agree" in a product of a machine with another of its shape: every scalar equal, every map equal at every key.
+export function agree(a) {
+    return [
+        ...Object.keys(a.state).map(n => ({ name: `a.${n} = b.${n}`, holds: same(x(`a_${n}`), x(`b_${n}`)) })),
+        ...Object.keys(a.maps ?? {}).map(n => ({ name: `a.${n}[k] = b.${n}[k]`, holds: same({ op: 'get', map: `a_${n}`, key: x('k') }, { op: 'get', map: `b_${n}`, key: x('k') }), forall: 'k' })),
+    ];
+}

package/dist/core/dsl.d.ts

@@ -166,6 +166,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     prune(order: keyof R & string, after: (p: P) => TermLike): Rule<P, I, S, M, F, R, Su, Q>;
     law(name: string, f: (env: P & S & M & Su) => Cond | Forall): Law;
     stepLaw(name: string, then: (before: P & I & S & M & F & Su & Q, after: S & M & Su) => Cond | Forall, when?: (before: P & I & S & M & F & Su & Q) => Cond): StepLaw;
+    stepsLaw(name: string, k: number, then: (first: P & I & S & M & F & Su & Q, last: S & M & Su, requests: (I & Q)[]) => Cond | Forall, when?: (before: P & I & S & M & F & Su & Q, j: number) => Cond | undefined): StepLaw;
     decide(name: string, given: (env: P & I) => Cond | Cond[], then: (env: P & I) => Cond): Decision;
     private kindAssumptions;
     private env;

package/dist/core/dsl.js

@@ -223,6 +223,24 @@ export const forall = (f) => ({ forall: f });
 // For histories: `holds` (a <= b, homogeneous over sums and queries) wherever `when` (params and plain inputs) holds.
 export const relation = (holds, whenever = yes) => ({ when: whenever, holds });
 let keyCounter = 0;
+// A k-step law's later requests are built over marked names (j:name, which no rule can declare: ':' is reserved); the
+// kernel reads them as name@j.
+const markedName = (name) => { const m = /^(\d+):(.*)$/.exec(name); return m ? `${m[2]}@${m[1]}` : name; };
+const markedE = (e) => {
+    switch (e.op) {
+        case 'var': return { op: 'var', name: markedName(e.name) };
+        case 'const': return e;
+        case 'mul': return { ...e, a: markedE(e.a) };
+        case 'if': return { op: 'if', c: marked(e.c), then: markedE(e.then), else: markedE(e.else) };
+        case 'get': return { op: 'get', map: e.map, key: markedE(e.key) };
+        case 'add':
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'prod': return { ...e, a: markedE(e.a), b: markedE(e.b) };
+    }
+};
+const marked = (c) => c.op === 'flag' ? c : c.op === 'not' ? { op: 'not', x: marked(c.x) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(marked) } : { ...c, a: markedE(c.a), b: markedE(c.b) };
 // P params, I inputs, S state, M maps, F flags, R a history's record, Su its sums, Q its queries: each a record of the
 // values the builders hand out, grown by each call.
 export class Rule {
@@ -295,6 +313,36 @@ export class Rule {
         const key = `key$${++keyCounter}`;
         return { name, forall: key, then: out.forall(v(key)).c, ...w };
     }
+    // A law about k steps in a row (k from 2 to 16): `then(first, last, requests)` relates what the first step reads to the
+    // state, maps and sums after the last, with each step's request and queries (requests[0] is the first's); `when(before,
+    // j)` narrows the j-th step's request (j from 0), read at the state that step starts from.
+    //   meter.stepsLaw('two requests spend at most 2m', 2, ({spent, m}, after) => after.spent.atMost(spent.plus(m).plus(m)))
+    stepsLaw(name, k, then, when) {
+        const env = this.env();
+        const after = {};
+        for (const [n] of this.spec.state)
+            after[n] = v(`${n}'`);
+        for (const [n] of this.spec.sums)
+            after[n] = v(`${n}'`);
+        for (const [n, init] of this.spec.maps)
+            after[n] = new MapRef(`${n}'`, init);
+        // The j-th request's values over marked names, renamed to the kernel's input@j once built.
+        const mark = (j) => `${j}:`;
+        const requests = Array.from({ length: k }, (_, j) => {
+            if (j === 0)
+                return Object.fromEntries([...this.spec.inputs.map(([n]) => n), ...this.spec.queries.map(([n]) => n)].map(n => [n, env[n]]));
+            return Object.fromEntries([...this.spec.inputs.map(([n, kind]) => [n, kind.value(n, mark(j + 1))]), ...this.spec.queries.map(([n]) => [n, v(`${mark(j + 1)}${n}`)])]);
+        });
+        const out = then(env, after, requests);
+        const whens = when ? Array.from({ length: k }, (_, j) => when(env, j)) : [];
+        while (whens.length && whens.at(-1) === undefined)
+            whens.pop();
+        const w = whens.length ? { when: whens.map(c => (c ?? lit(0).atMost(0)).c) } : {};
+        if (out instanceof Cond)
+            return { name, steps: k, then: marked(out.c), ...w };
+        const key = `key$${++keyCounter}`;
+        return { name, steps: k, forall: key, then: marked(out.forall(v(key)).c), ...w };
+    }
     // A decision: whenever the params and the request meet `given`, `then` holds. Decisions don't read the state.
     decide(name, given, then) {
         const env = this.env({ flags: false, state: false, queries: false });

package/dist/kernel/kernel.d.ts

@@ -61,9 +61,10 @@ export declare function progressObligations(m: Machine, laws: Law[], instances:
 }): Goal[];
 export type StepLaw = {
     name: string;
-    when?: C;
+    when?: C | C[];
     then: C;
     forall?: string;
+    steps?: number;
 };
 export declare function stepLawObligations(machine: Machine, laws: Law[], instances: Instances, sl: StepLaw): Goal[];
 export declare function checkStepLaws(m: Machine, laws: Law[], stepLaws: StepLaw[], proof: {

package/dist/kernel/kernel.js

@@ -274,6 +274,45 @@ const preOf = (o) => {
         throw new Error('a precondition reads only the params');
     return o.pre ? [o.pre] : [];
 };
+const identity = { vars: {}, maps: {}, flags: {} };
+const from = (at = identity) => ({ hyps: [], at });
+// Conditions that hold where the run is.
+const holds = (r, cs) => ({ hyps: [...r.hyps, ...cs.map(c => substC(c, r.at))], at: r.at });
+// Names read where the run is: inputs named for this step (a request's terms, or fresh names for a later step).
+const reading = (r, vars) => ({ hyps: r.hyps, at: { ...r.at, vars: { ...r.at.vars, ...vars } } });
+// One step: each name the update sets is its term read where the run is; a map read after it is the written value at
+// the written key, and what the map held before elsewhere.
+const step = (r, u) => {
+    const at = r.at, before = (map, key) => (at.maps[map] ? at.maps[map](key) : { op: 'get', map, key });
+    return { hyps: r.hyps, at: {
+            vars: { ...at.vars, ...Object.fromEntries(Object.entries(u.vars).map(([n, e]) => [n, substE(e, at)])) },
+            maps: { ...at.maps, ...Object.fromEntries(Object.entries(u.maps).map(([map, w]) => [map, (key) => ({ op: 'if', c: { op: '=', a: key, b: substE(w.key, at) }, then: substE(w.value, at), else: before(map, key) })])) },
+            flags: at.flags,
+        } };
+};
+// The conclusion read at the run's end: plain names at the last frame.
+const atEnd = (r, c) => substC(c, r.at);
+// The conclusion read across the run: plain names at the first frame, primed names (s', and M'[k] as a read of the map
+// named M') at the last; the first step's inputs as it read them, and its flags, decided where it was taken.
+const across = (r, c, state, maps, first) => substC(c, {
+    vars: { ...first.inputs, ...Object.fromEntries(state.map(n => [`${n}'`, r.at.vars[n] ?? { op: 'var', name: n }])) },
+    maps: Object.fromEntries(maps.map(map => [`${map}'`, (key) => (r.at.maps[map] ? r.at.maps[map](key) : { op: 'get', map, key })])),
+    flags: first.flags,
+});
+const goal = (name, r, conclusion) => ({ name, hyps: [...r.hyps, { op: 'not', x: conclusion }] });
+// A machine's step as an update, its flags inlined (they are decided before the step, over the frame it starts from).
+const updateOf = (m) => {
+    const flags = { vars: {}, maps: {}, flags: m.step.flags ?? {} };
+    return {
+        vars: Object.fromEntries(Object.entries(m.step.state ?? {}).map(([n, e]) => [n, substE(e, flags)])),
+        maps: Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([map, w]) => [map, { key: substE(w.key, flags), value: substE(w.value, flags) }])),
+    };
+};
+const inlineFlags = (m, c) => substC(c, { vars: {}, maps: {}, flags: m.step.flags ?? {} });
+// The laws assumed where the run is: each plain law, and each every-key law at the keys the proof names.
+const assumed = (laws, instances) => laws.flatMap(l => (l.forall ? (instances[l.name] ?? []).map(key => substC(l.holds, { vars: { [l.forall]: key }, maps: {}, flags: {} })) : [l.holds]));
+// The start: the state's start values over the params, every map cell its constant.
+const startOf = (m) => ({ vars: { ...m.state }, maps: Object.fromEntries(Object.entries(m.maps ?? {}).map(([map, c]) => [map, () => ({ op: 'const', value: c })])), flags: {} });
 function reads(t, out = { vars: new Set(), maps: new Set(), flags: new Set() }) {
     switch (t.op) {
         case 'var':
@@ -429,28 +468,15 @@ export function obligations(m, laws, instances = {}) {
         && Object.values(m.step.flags ?? {}).every(naturalC) && laws.every(l => naturalC(l.holds)) && Object.values(m.maps ?? {}).every(c => Number.isInteger(c) && c >= 0);
     if (!ok || laws.some(l => mentions(l.holds, m.inputs)))
         throw new Error('a negative constant or factor, or a law about a request, is outside the kernel');
-    const fresh = (law) => `${law.forall}#`;
-    const atKey = (law, key) => substC(law.holds, { vars: { [law.forall]: key }, maps: {}, flags: {} });
-    const goal = (law) => (law.forall ? atKey(law, { op: 'var', name: fresh(law) }) : law.holds);
-    const pre = preOf(m);
-    // At the start: the precondition, and no request.
-    const start = { vars: Object.fromEntries(Object.entries(m.state)), maps: Object.fromEntries(Object.entries(m.maps ?? {}).map(([map, c]) => [map, () => ({ op: 'const', value: c })])), flags: {} };
-    // One step: the state after, as terms over the state before; a map read after the step is the written value at the
-    // written key, and the old cell elsewhere.
-    const flags = { vars: {}, maps: {}, flags: m.step.flags ?? {} };
-    const inline = (c) => substC(c, flags), inlineE = (e) => substE(e, flags);
-    const step = {
-        vars: Object.fromEntries(Object.entries(m.step.state ?? {}).map(([name, e]) => [name, inlineE(e)])),
-        flags: {},
-        maps: Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([map, w]) => [map, (key) => ({ op: 'if', c: { op: '=', a: key, b: inlineE(w.key) }, then: inlineE(w.value), else: { op: 'get', map, key } })])),
-    };
-    const out = [];
-    for (const law of laws) {
-        out.push({ name: `${law.name} @start`, hyps: [...pre, { op: 'not', x: substC(goal(law), start) }] });
-        const before = laws.flatMap(l => (l.forall ? (instances[law.name]?.[l.name] ?? []).map(key => atKey(l, key)) : [l.holds]));
-        out.push({ name: `${law.name} @step`, hyps: [...pre, ...(m.assume ? [inline(m.assume)] : []), ...before, { op: 'not', x: substC(goal(law), step) }] });
-    }
-    return out;
+    // A law that holds at every key is proven at a fresh one.
+    const proven = (law) => (law.forall ? substC(law.holds, { vars: { [law.forall]: { op: 'var', name: `${law.forall}#` } }, maps: {}, flags: {} }) : law.holds);
+    const pre = preOf(m), u = updateOf(m), assume = m.assume ? [inlineFlags(m, m.assume)] : [];
+    return laws.flatMap(law => {
+        // At the start: the precondition, and no request. One step: from a state where the laws hold, a request allowed.
+        const start = holds(from(startOf(m)), pre);
+        const turn = step(holds(from(), [...pre, ...assume, ...assumed(laws, instances[law.name] ?? {})]), u);
+        return [goal(`${law.name} @start`, start, atEnd(start, proven(law))), goal(`${law.name} @step`, turn, atEnd(turn, proven(law)))];
+    });
 }
 // The whole set at once: every goal has a tree, and every tree checks.
 export function checkLaws(m, laws, proof) {
@@ -476,15 +502,12 @@ export function loopObligations(l, laws, rank) {
         throw new Error('a rank reads the state and params, not the turn\'s input');
     if (!parts.every(natural) || !naturalC(l.while) || !laws.every(law => !law.forall && naturalC(law.holds) && !mentions(law.holds, l.inputs)))
         throw new Error('outside the kernel');
-    const start = { vars: l.state, maps: {}, flags: {} }, turn = { vars: l.body, maps: {}, flags: {} };
     const pre = preOf(l);
-    const during = [...pre, ...(l.assume ? [l.assume] : []), l.while, ...laws.map(law => law.holds)];
+    const start = holds(from({ vars: { ...l.state }, maps: {}, flags: {} }), pre);
+    const turn = step(holds(from(), [...pre, ...(l.assume ? [l.assume] : []), l.while, ...laws.map(law => law.holds)]), { vars: l.body, maps: {} });
     return [
-        ...laws.flatMap(law => [
-            { name: `${law.name} @start`, hyps: [...pre, { op: 'not', x: substC(law.holds, start) }] },
-            { name: `${law.name} @turn`, hyps: [...during, { op: 'not', x: substC(law.holds, turn) }] },
-        ]),
-        { name: 'rank drops', hyps: [...during, { op: 'not', x: drops(ranks, turn) }] },
+        ...laws.flatMap(law => [goal(`${law.name} @start`, start, atEnd(start, law.holds)), goal(`${law.name} @turn`, turn, atEnd(turn, law.holds))]),
+        goal('rank drops', turn, drops(ranks, turn.at)),
     ];
 }
 const drops = (ranks, turn) => {
@@ -505,49 +528,45 @@ export function progressObligations(m, laws, instances, p) {
             throw new Error('a request is named from the state and params');
     const req = { vars: p.request, maps: {}, flags: {} };
     const flags = Object.fromEntries(Object.entries(m.step.flags ?? {}).map(([f, c]) => [f, substC(c, req)]));
-    const now = (e) => substE(substE(e, { vars: {}, maps: {}, flags: m.step.flags ?? {} }), req);
-    const after = {
-        vars: { ...p.request, ...Object.fromEntries(Object.keys(m.state).map(n => [`${n}'`, { op: 'var', name: n }])), ...Object.fromEntries(Object.entries(m.step.state ?? {}).map(([n, e]) => [`${n}'`, now(e)])) },
-        maps: {
-            ...Object.fromEntries(Object.keys(m.maps ?? {}).map(map => [`${map}'`, (key) => ({ op: 'get', map, key })])),
-            ...Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([map, w]) => [`${map}'`, (key) => ({ op: 'if', c: { op: '=', a: key, b: now(w.key) }, then: now(w.value), else: { op: 'get', map, key } })])),
-        },
-        flags,
-    };
-    const before = [...preOf(m), ...laws.flatMap(l => (l.forall ? (instances[l.name] ?? []).map(key => substC(l.holds, { vars: { [l.forall]: key }, maps: {}, flags: {} })) : [l.holds])), p.when];
+    // The run: a state where the laws and `when` hold, then the step the named request causes.
+    const before = holds(from(), [...preOf(m), ...assumed(laws, instances), p.when]);
+    const caused = step(reading(before, p.request), updateOf(m));
     return [
-        ...(m.assume ? [{ name: `${p.name}: the request is allowed`, hyps: [...before, { op: 'not', x: substC(m.assume, req) }] }] : []),
-        { name: `${p.name}: the step it causes`, hyps: [...before, { op: 'not', x: substC(p.then, after) }] },
+        ...(m.assume ? [goal(`${p.name}: the request is allowed`, before, substC(m.assume, req))] : []),
+        goal(`${p.name}: the step it causes`, caused, across(caused, p.then, Object.keys(m.state), Object.keys(m.maps ?? {}), { inputs: p.request, flags })),
     ];
 }
 export function stepLawObligations(machine, laws, instances, sl) {
     const m = machine.history ? historyMachine(machine).machine : machine;
     scope(m, laws);
+    const k = sl.steps ?? 1;
+    if (!Number.isInteger(k) || k < 1 || k > 16)
+        throw new Error(`step law ${sl.name}: steps is a whole number from 1 to 16`);
+    const whens = sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when];
+    if (whens.length > k)
+        throw new Error(`step law ${sl.name}: one when per step at most`);
     const state = Object.keys(m.state), maps = Object.keys(m.maps ?? {}), flagNames = Object.keys(m.step.flags ?? {});
     const primes = [...state, ...maps].map(n => `${n}'`);
+    const later = Array.from({ length: k - 1 }, (_, i) => m.inputs.map(input => `${input}@${i + 2}`)).flat();
     const taken = [...m.params, ...m.inputs, ...state, ...maps];
-    for (const p of primes)
+    for (const p of [...primes, ...later])
         if (taken.includes(p))
-            throw new Error(`${m.name}: ${p} is a name of the machine and a primed name of a step law`);
-    if (sl.forall && [...taken, ...primes].includes(sl.forall))
+            throw new Error(`${m.name}: ${p} is a name of the machine and a name a step law reads`);
+    if (sl.forall && [...taken, ...primes, ...later].includes(sl.forall))
         throw new Error(`step law ${sl.name}'s key ${sl.forall} is already a name of ${m.name}`);
-    inScope(`step law ${sl.name}`, [sl.then], [...taken, ...state.map(n => `${n}'`), ...(sl.forall ? [sl.forall] : [])], [...maps, ...maps.map(n => `${n}'`)], flagNames);
-    if (sl.when)
-        inScope(`step law ${sl.name}'s when`, [sl.when], taken, maps, flagNames);
-    if (!naturalC(sl.then) || (sl.when && !naturalC(sl.when)))
+    inScope(`step law ${sl.name}`, [sl.then], [...taken, ...state.map(n => `${n}'`), ...later, ...(sl.forall ? [sl.forall] : [])], [...maps, ...maps.map(n => `${n}'`)], flagNames);
+    for (const w of whens)
+        inScope(`step law ${sl.name}'s when`, [w], taken, maps, flagNames);
+    if (!naturalC(sl.then) || !whens.every(naturalC))
         throw new Error(`step law ${sl.name}: a negative constant or factor is outside the kernel`);
-    const flags = { vars: {}, maps: {}, flags: m.step.flags ?? {} };
-    const now = (e) => substE(e, flags), nowC = (c) => substC(c, flags);
-    const after = {
-        vars: Object.fromEntries(state.map(n => [`${n}'`, now(m.step.state?.[n] ?? { op: 'var', name: n })])),
-        maps: Object.fromEntries(maps.map(map => {
-            const w = m.step.maps?.[map];
-            return [`${map}'`, (key) => (w ? { op: 'if', c: { op: '=', a: key, b: now(w.key) }, then: now(w.value), else: { op: 'get', map, key } } : { op: 'get', map, key })];
-        })),
-        flags: m.step.flags ?? {},
-    };
-    const before = laws.flatMap(l => (l.forall ? (instances[l.name] ?? []).map(key => substC(l.holds, { vars: { [l.forall]: key }, maps: {}, flags: {} })) : [l.holds]));
-    return [{ name: `${sl.name} @step law`, hyps: [...preOf(m), ...before, ...(m.assume ? [nowC(m.assume)] : []), ...(sl.when ? [nowC(sl.when)] : []), { op: 'not', x: substC(sl.then, after) }] }];
+    const u = updateOf(m), assume = m.assume ? [inlineFlags(m, m.assume)] : [];
+    let run = holds(from(), preOf(m));
+    for (let j = 1; j <= k; j++) {
+        if (j > 1)
+            run = reading(run, Object.fromEntries(m.inputs.map(input => [input, { op: 'var', name: `${input}@${j}` }])));
+        run = step(holds(run, [...assumed(laws, instances), ...assume, ...(whens[j - 1] ? [inlineFlags(m, whens[j - 1])] : [])]), u);
+    }
+    return [goal(k === 1 ? `${sl.name} @step law` : `${sl.name} @${k} steps`, run, across(run, sl.then, state, maps, { inputs: {}, flags: m.step.flags ?? {} }))];
 }
 // The laws' proof and every step law's tree: all must check.
 export function checkStepLaws(m, laws, stepLaws, proof) {
@@ -566,9 +585,9 @@ export function foldObligations(f, laws) {
     inScope(`${f.name}'s laws`, laws.map(law => law.holds), [...f.params, ...names]);
     const side = (p) => ({ vars: Object.fromEntries(names.map(n => [n, { op: 'var', name: `${p}${n}` }])), maps: {}, flags: {} });
     // A fold's inputs are each leaf's and node's own, so its assumption holds at every leaf and node it reads them at.
+    // A leaf is a start from its inputs; a node, a step from the frame of its two children, the laws holding at each.
     const assume = [...preOf(f), ...(f.assume ? [f.assume] : [])];
-    return laws.flatMap(law => [
-        { name: `${law.name} @leaf`, hyps: [...assume, { op: 'not', x: substC(law.holds, { vars: f.leaf, maps: {}, flags: {} }) }] },
-        { name: `${law.name} @node`, hyps: [...assume, ...laws.flatMap(h => [substC(h.holds, side('l_')), substC(h.holds, side('r_'))]), { op: 'not', x: substC(law.holds, { vars: f.node, maps: {}, flags: {} }) }] },
-    ]);
+    const leaf = holds(from({ vars: { ...f.leaf }, maps: {}, flags: {} }), assume);
+    const node = step(holds(from(), [...assume, ...laws.flatMap(h => [substC(h.holds, side('l_')), substC(h.holds, side('r_'))])]), { vars: f.node, maps: {} });
+    return laws.flatMap(law => [goal(`${law.name} @leaf`, leaf, atEnd(leaf, law.holds)), goal(`${law.name} @node`, node, atEnd(node, law.holds))]);
 }

package/dist/kernel/prove.js

@@ -269,7 +269,7 @@ export function proveStepLaws(m, laws, stepLaws) {
     if (!base.proven || !base.proof)
         return { proven: false, nodes: base.nodes, leaves: base.leaves, ...(base.failed ? { failed: base.failed } : {}), checked: false };
     const plain = m.history ? historyMachine(m).machine : m;
-    const keys = [...readKeys(plain, laws), ...stepLaws.flatMap(sl => [...readKeysC(sl.then), ...(sl.when ? readKeysC(sl.when) : [])])];
+    const keys = [...readKeys(plain, laws), ...stepLaws.flatMap(sl => [sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC))];
     const instances = Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, keys]));
     const trees = {};
     let nodes = base.nodes, leaves = base.leaves;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdp-wired",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Laws about stateful rules (budgets, caps, windows, workflows, policy decisions), proven automatically by a small checked kernel, with the rule shipped as code",
   "keywords": [
     "verification",
@@ -32,6 +32,10 @@
       "types": "./dist/core/machine.d.ts",
       "default": "./dist/core/machine.js"
     },
+    "./compose": {
+      "types": "./dist/core/compose.d.ts",
+      "default": "./dist/core/compose.js"
+    },
     "./kernel": {
       "types": "./dist/kernel/kernel.d.ts",
       "default": "./dist/kernel/kernel.js"
@@ -65,7 +69,7 @@
     "build": "bun scripts/build.ts",
     "prepublishOnly": "bun scripts/build.ts",
     "smoke": "sh scripts/smoke.sh",
-    "test": "cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/budget.ts"
+    "test": "cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/budget.ts"
   },
   "devDependencies": {
     "@types/bun": "1.3.1",