gdp-wired 0.10.1 → 0.12.0

package/README.md

@@ -51,7 +51,8 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 
 - **Invariants**: a law that holds after every sequence of requests ("spend stays within the budget").
 - **Maps, sets and lists of names**: laws at every key ("no day passes its cap"), sets a request carries, conditions
-  about every key, lists kept in order (`examples/sets.ts`, `examples/lists.ts`).
+  about every key or every two keys ("a batch is taken only when its values increase"), lists kept in order
+  (`examples/sets.ts`, `examples/lists.ts`, `examples/pairs.ts`).
 - **Step laws**: what one step does ("a balance only goes down", "a grant adds one"), and laws over several steps in a
   row.
 - **Histories**: sums and queries over a log of requests, like a sliding-window rate limit.
@@ -69,8 +70,9 @@ All of these are proven automatically, and each proof is also a Lean theorem:
   (`examples/datatypes.ts`).
 - **Lists a request carries, and trees**: an invoice's lines, with folds over them (the total, the taxable part) and
   lemmas about the folds proven by induction over the lines (`examples/invoices.ts`); a fold over a tree as a value (a
-  spend roll-up over an org chart, sign-offs over a document's sections), its laws proven by induction over the tree
-  (`examples/folds.ts`).
+  spend roll-up, sign-offs over a document's sections, an org chart where a manager has any number of reports), its laws
+  proven by induction over the tree (`examples/folds.ts`); a search tree, and a sheet of rows of cells, kept in a rule's
+  state as tables of nodes (`examples/trees.ts`).
 - **Pure functions and two-run laws**: laws about what a function returns, and laws comparing two calls, like "the
   secret never changes the answer". `examples/jev-fabric/` ports a Bend project's policy core and proves all 59 laws its
   Bend proofs state.
@@ -228,13 +230,24 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the
   array, and a request that doesn't meet them isn't allowed), read as `Lines.fold.total`; `Lines.every`, `some`, `has`,
   `increasing(by)`, `at(i)`. A lemma about the folds (`({taxed, total}) => taxed.atMost(total)`) is proven by induction
-  over the items when the rule is built, then assumed at every prefix (`examples/invoices.ts`).
+  over the items when the rule is built, then assumed at every prefix. A fold's start and step, and a lemma, may read the
+  params (`{from: ({fee}) => fee, step: (acc, line, {ceil}) => acc.plus(min(line.amount, ceil))}`); a request is then
+  encoded with them, `rule.encodeInput(values, params)` (`examples/invoices.ts`).
 - **Folds over trees** (`fold(name).params(...).inputs(...).leaf(env => ({...})).node((env, left, right) => ({...}))`,
   `proveFold`): a tree as a value (`{leaf: inputs}` or `{node: inputs, left, right}`), each leaf's values from its inputs
   and each node's from its own and its children's; a law about the values is proven by induction over the tree (the
   kernel's leaf and node goals, Lean's `fold_sound`), `f.run(tree, params)` evaluates the terms proven and `f.crossCheck`
-  holds the builders to them (`examples/folds.ts`). A tree in a rule's state, and claims that need a lemma about the
-  tree's shape nobody stated, stay Lean's.
+  holds the builders to them. Nodes with any number of children: `.children(from, (acc, kid) => ..., lemmas)` folds a
+  node's children into `kids`, then `.node((env, kids) => ...)`; it is the kernel's binary fold underneath (each child
+  list a chain of glue nodes), so Lean's `fold_sound` checks it unchanged, and `f.run` takes `{node, children: [...]}`
+  (`examples/folds.ts`).
+- **Trees in a rule's state, and lists of lists** (`.nodes('Tree', record({key: nat}), ['left', 'right'], folds)`): a
+  table of nodes that only grows, node 0 the empty tree, `Tree.make(value, {left, right}, when)` making node size + 1 from
+  nodes already there; each fold (`{lo: {empty: 0, node: (x, kids) => when(kids.left.empty, x.key, kids.left.fold.lo)}}`)
+  kept with its node when it is made, and may read a table declared before (a row's total over its cells). A law about
+  a subtree is then a law about one node (`Tree.node(n).fold.lo`), proven like any law about every key; the table's own
+  laws (children earlier, folds coherent, nothing past the end) are proven beside it (`examples/trees.ts`: a search tree,
+  a sheet of rows of cells). Claims that need a lemma about the tree's shape nobody stated stay Lean's.
 - **State of any kind**: `.state({open: bool.from(true), status: oneOf('new', 'done').from('new'), owner: str().from(''), note: maybe(nat).from(null)})`;
   a step writes each kind's own values, `when(c, a, b)` chooses between any two values of a kind, and `rule.decode(state)`
   reads them back as runtime values.
@@ -249,7 +262,8 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
 - **Arithmetic** over the naturals: `plus`, `minus` (truncated), `times(k)`, `mul` (a product of two terms), `min`,
   `max`, `when(cond, a, b)`, `count(cond)`; conditions `lt`, `atMost`, `eq`, `and`, `or`, `not`, `implies`.
 - **Sets and quantifiers**: `.carries(...)` for sets a request brings, `everyKey(k => ...)` (and `has`, `subsetOf`,
-  `disjointFrom`, `sameAs`) anywhere in a step or inside a law, `M.each(k => ...)` to write every key, and
+  `disjointFrom`, `sameAs`) anywhere in a step or inside a law, `everyKey((i, j) => ...)` in a step for every two keys
+  (each read on its own, compared with the other plainly: `i.lt(j)`), `M.each(k => ...)` to write every key, and
   `someKey(k => ..., witness?)` for "some key where", proven through a witness the prover finds or the one given.
 - **Functions** (`.fns({perMinute: divBy(60)})`, or `fn(arity, js, {facts, lean})` for your own): read like params that
   take arguments, `perMinute(t)`; the kernel knows each only by its facts (`.facts(...)`, and a library function's
@@ -329,7 +343,7 @@ Lean, compiled natively, wins where the state stays small. Details in [`docs/com
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |

package/dist/core/compose.js

@@ -37,7 +37,7 @@ function renameC(c, prefix, m, inputs) {
     if (c.op === 'and' || c.op === 'or')
         return { op: c.op, xs: c.xs.map(y => renameC(y, prefix, m, inputs)) };
     if (c.op === 'all')
-        return { op: 'all', key: `${prefix}${c.key}`, c: renameC(c.c, prefix, m, inputs) }; // the key renamed with its side
+        return { ...c, key: `${prefix}${c.key}`, ...(c.keys ? { keys: c.keys.map(k => `${prefix}${k}`) } : {}), c: renameC(c.c, prefix, m, inputs) }; // the keys renamed with their side
     return { ...c, a: rename(c.a, prefix, m, inputs), b: rename(c.b, prefix, m, inputs) };
 }
 // A condition (or law) of one side, read in the composed machine.

package/dist/core/dsl.d.ts

@@ -253,7 +253,7 @@ export type MapWrite = {
         at: (key: Term) => TermLike;
     };
 };
-export declare const everyKey: (f: (key: Term) => Cond) => Cond;
+export declare const everyKey: (f: (key: Term, key2: Term, key3: Term) => Cond) => Cond;
 export declare const someKey: (f: (key: Term) => Cond, witness?: TermLike) => Cond;
 export declare class MapRef {
     readonly name: string;
@@ -310,11 +310,11 @@ export type ItemsOp = {
     readonly parts: Record<string, ListOp>;
     readonly len: TermLike;
 };
-export type ListFold<V> = {
-    from: number;
-    step: (acc: Term, item: V) => TermLike;
+export type ListFold<V, P = any> = {
+    from: number | ((p: P) => TermLike);
+    step: (acc: Term, item: V, p: P) => TermLike;
 };
-export type ListLemma = (acc: Record<string, Term>, i: Term) => Cond;
+export type ListLemma<P = any> = (acc: Record<string, Term>, i: Term, p: P) => Cond;
 export declare class CarriedList<V, Fd extends string = never> {
     readonly name: string;
     readonly kind: Kind<V>;
@@ -322,8 +322,10 @@ export declare class CarriedList<V, Fd extends string = never> {
     readonly folds: Record<Fd, ListFold<V>>;
     private readonly map;
     readonly lemmas: Record<string, ListLemma>;
+    private readonly params?;
+    private readonly paramKinds;
     readonly fold: Record<Fd, Term>;
-    constructor(name: string, kind: Kind<V>, len: Term, folds: Record<Fd, ListFold<V>>, map: (part: string) => MapRef, lemmas?: Record<string, ListLemma>);
+    constructor(name: string, kind: Kind<V>, len: Term, folds: Record<Fd, ListFold<V>>, map: (part: string) => MapRef, lemmas?: Record<string, ListLemma>, params?: Record<string, unknown> | undefined, paramKinds?: [string, Kind<unknown>][]);
     at(i: TermLike): V;
     after(fold: Fd, i: TermLike): Term;
     every(f: (item: V, i: Term) => Cond): Cond;
@@ -331,6 +333,8 @@ export declare class CarriedList<V, Fd extends string = never> {
     has(x: V): Cond;
     increasing(by: (item: V) => Term): Cond;
     equations(): Cond[];
+    private get readsParams();
+    private p;
     private running;
     prove(): Verdict;
     get maps(): string[];
@@ -358,6 +362,35 @@ export declare class ItemsRef<V> {
     within(): Forall;
     increasing(by: (x: V) => Term): Forall;
 }
+export type NodeRef<V, C extends string, Fd extends string> = {
+    readonly index: Term;
+    readonly empty: Cond;
+    readonly value: V;
+    readonly fold: Record<Fd, Term>;
+    readonly kids: Record<C, Term>;
+};
+export type NodeFold<V, C extends string, Fd extends string = string, T = Record<string, NodeTable<any, any, any>>> = {
+    empty: number;
+    node: (value: V, kids: Record<C, NodeRef<V, C, Fd>>, tables: T) => TermLike;
+};
+type TablesOf<M> = {
+    [k in keyof M as M[k] extends NodeTable<any, any, any> ? k : never]: M[k];
+};
+export declare class NodeTable<V, C extends string = string, Fd extends string = string> {
+    readonly name: string;
+    readonly kind: Kind<V>;
+    readonly children: C[];
+    readonly folds: Record<Fd, NodeFold<V, C, Fd>>;
+    readonly size: Term;
+    private readonly map;
+    private readonly tables;
+    constructor(name: string, kind: Kind<V>, children: C[], folds: Record<Fd, NodeFold<V, C, Fd>>, size: Term, map: (part: string) => MapRef, tables?: Record<string, NodeTable<any, any, any>>);
+    node(n: TermLike): NodeRef<V, C, Fd>;
+    at(n: TermLike): V;
+    fits(kids: Record<C, TermLike>): Cond;
+    make(value: Writes<V>, kids: Record<C, TermLike>, when?: Cond): Record<string, TermLike | PartsWrite>;
+    laws(): [string, Forall][];
+}
 export type Forall = {
     readonly forall: (key: Term, ...more: Term[]) => Cond;
 };
@@ -419,6 +452,7 @@ type Spec = {
     lists?: string[];
     cells?: [string, Kind<unknown>][];
     items?: [string, Kind<unknown>][];
+    nodes?: [string, Kind<unknown>, string[], Record<string, NodeFold<unknown, string>>][];
     kinded?: [string, Kind<unknown>][];
     carried?: string[];
     lists2?: [string, Kind<unknown>, Record<string, ListFold<unknown>>, Record<string, ListLemma>][];
@@ -467,6 +501,13 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     }, M & {
         [k in keyof T]: ItemsRef<T[k] extends Kind<infer V> ? V : never>;
     }, F, R, Su, Q>;
+    nodes<const N extends string, V, const C extends string, Fd extends string = never>(name: N, of: Kind<V>, children: readonly C[], folds?: {
+        [f in Fd]: NodeFold<V, C, Fd, TablesOf<M>>;
+    }): Rule<P, I, S & {
+        [k in N as `${k}_size`]: Term;
+    }, M & {
+        [k in N]: NodeTable<V, C, Fd>;
+    }, F, R, Su, Q>;
     fns<T extends Record<string, FnDef>>(defs: T): Rule<P & {
         [k in keyof T]: (...args: TermLike[]) => Term;
     }, I, S, M, F, R, Su, Q>;
@@ -474,7 +515,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     carries<const N extends string>(...names: N[]): Rule<P, I & {
         [k in N]: MapRef;
     }, S, M, F, R, Su, Q>;
-    carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term) => Cond>): Rule<P, I & {
+    carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V, P>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term, p: P) => Cond>): Rule<P, I & {
         [k in N]: CarriedList<V, Fd>;
     }, S, M, F, R, Su, Q>;
     flags<T extends Record<string, Cond>>(f: (env: P & I & S & M & F & Su & Q) => T): Rule<P, I, S, M, F & {
@@ -550,9 +591,12 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     }): Record<string, number>;
     encodeInput(values: {
         [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
+    }, params?: {
+        [k in keyof P]: Raw;
     }): Request;
     randomParams(rand: Rand, bound: number): Record<string, number>;
-    randomInput(rand: Rand, bound: number): Request;
+    private paramValues;
+    randomInput(rand: Rand, bound: number, ps?: Record<string, number>): Request;
     decode(st: State): Record<string, Raw>;
     get orderedBy(): string | undefined;
     interpreter(): {
@@ -754,6 +798,15 @@ export declare class FoldRule<P extends Obj = {}, I extends Obj = {}, S extends
     node(f: (env: P & I, left: S, right: S) => {
         [k in keyof S]: TermLike;
     }): FoldRule<P, I, S>;
+    children<A extends Record<string, number | ((p: P) => TermLike)>>(from: A, step: (acc: {
+        [k in keyof A]: Term;
+    }, kid: S, p: P) => {
+        [k in keyof A]: TermLike;
+    }, lemmas?: Record<string, (acc: {
+        [k in keyof A]: Term;
+    }, p: P) => Cond>): RoseFold<P, I, S, {
+        [k in keyof A]: Term;
+    }>;
     private env;
     private names;
     private side;
@@ -774,4 +827,49 @@ export declare class FoldRule<P extends Obj = {}, I extends Obj = {}, S extends
     }): Agreement;
 }
 export declare const fold: (name: string) => FoldRule;
-export declare const proveFold: (f: FoldRule<Obj, Obj, Obj>, laws: Law[]) => Verdict;
+export declare const proveFold: (f: {
+    fold: Fold;
+    lemmas?: Law[];
+}, laws: Law[]) => Verdict;
+export type RoseValue<I> = {
+    leaf: I;
+} | {
+    node: I;
+    children: RoseValue<I>[];
+};
+type RoseSpec = {
+    from: Record<string, number | ((p: never) => TermLike)>;
+    step: (acc: never, kid: never, p: never) => Record<string, TermLike>;
+    lemmas: Record<string, (acc: never, p: never) => Cond>;
+};
+export declare class RoseFold<P extends Obj = {}, I extends Obj = {}, S extends Obj = {}, A extends Obj = {}> {
+    private readonly spec;
+    private readonly kids;
+    private readonly nodeOf?;
+    constructor(spec: FoldSpec, kids: RoseSpec, nodeOf?: ((env: never, kids: never) => Record<string, TermLike>) | undefined);
+    get name(): string;
+    node(f: (env: P & I, kids: A) => {
+        [k in keyof S]: TermLike;
+    }): RoseFold<P, I, S, A>;
+    private env;
+    private names;
+    private side;
+    private accs;
+    private start;
+    law(name: string, f: (env: P & S) => Cond): Law;
+    get lemmas(): Law[];
+    get fold(): Fold;
+    run(tree: RoseValue<{
+        [k in keyof I]: Raw;
+    }>, params?: {
+        [k in keyof P]?: Raw;
+    }): {
+        [k in keyof S]: number;
+    };
+    crossCheck(laws?: Law[], opts?: {
+        trials?: number;
+        depth?: number;
+        bound?: number;
+        rand?: Rand;
+    }): Agreement;
+}