gdp-wired 0.20.0 → 0.21.0

package/README.md

@@ -76,8 +76,14 @@ All of these are proven automatically, and each proof is also a Lean theorem:
   proved them, as laws and lemmas with the source to paste.
 - **Invariants nobody wrote** (`gdp-wired/infer`): `inferLaws(rule, laws)` proves a law that holds but isn't inductive
   alone, with the laws it finds (bounds, sums and differences over the state, the same where a flag or a choice holds
-  one value, and laws about every key of a map), each proven by the kernel with yours and handed back as the
+  one value, remainders of a value or of a sum or difference of two, x mod 2 = 0 for a counter stepping by 2, and laws
+  about every key of a map), each proven by the kernel with yours and handed back as the
   `r.law(...)` call that states it; a false law comes back with the run that breaks it (`examples/infer.ts`).
+- **There exists**: laws that say some value is a witness, `exists(k => x.eq(k.times(2)))` ("x is even"), over
+  naturals, integers, yes/nos or a map's keys, each proven through a witness the prover finds from the kernel's
+  counterexamples (a term of the state, or a ghost the run carries: the witness before, moved by the request's values)
+  or the one given; an existential in the assumption is a value each request brings, and `inferLaws` finds parities
+  and multiples this way. Lean states each as `∃ w, ...`, proven by ⟨witness, proof⟩ (`examples/exists.ts`).
 - **Orderings at any distance**: "a refund never follows a release", through ghost state that watches the rule.
 - **Liveness**: "every ticket issued is served", in every run that keeps sending the requests that help, including under
   weak fairness (`examples/liveness.ts`).
@@ -97,6 +103,12 @@ All of these are proven automatically, and each proof is also a Lean theorem:
   goal reads), and the lemma a stuck one needs (g(x, 0) = 2x through g(x, a) = a + 2x; a bound on another function);
   `proveLoop` with no rank finds it (two phases' (x, y)) and the invariants it needs; the kernel checks the cyclic
   proof (`examples/cycles.ts`).
+- **Recursive datatypes as values** (`gdp-wired/data`): lists, trees, rose trees and their forests, declared by their
+  constructors; functions over them by structural recursion, or by any recursion whose termination is proven first (a
+  merge of two lists, a quicksort: the measure found, (size xs, size ys) or a sum of sizes, and each call's decrease
+  proven by the kernel before the function's equation is used; one that doesn't terminate is refused with the reason);
+  `proveData` finds the induction (structural, mutual, or the function's own call graph ranked by its measure) and the
+  lemmas, each proof checked in Lean against the `inductive` and the functions as declared (`examples/data.ts`).
 - **Records and variants**: inputs, state, results, map cells and list items made of named fields, or one of several
   cases each with fields of its own (a payment by card or in cash, a seat free, held or sold), every case covered
   (`examples/datatypes.ts`).
@@ -115,7 +127,9 @@ When a law is false, the GPU search finds a real run that breaks it. When a law
 **What it leaves to Lean or Bend.** Two things, and neither is a gap the next feature closes: proofs the prover would
 have to invent (induction over a recursive structure whose proof needs a lemma nobody stated and `discover` doesn't find, and arithmetic with
 products of unknowns beyond what products of facts and sums of squares give; integer arithmetic with induction or
-with products is undecidable; a lemma you state about a recurrence is proven, but a recursive datatype as a value is Lean's), and shipping an arbitrary algorithm as its proved source (gdp-wired ships the rule as JavaScript; Bend
+with products is undecidable; a lemma you state about a recurrence is proven, and `proveData` finds the induction and lemmas for a recursive datatype as a value, up to six symbols a lemma, for
+functions structural or whose termination it proves, its values naturals, integers (`integer`, Lean's `Int`, beside
+`natural`) and datatypes), and shipping an arbitrary algorithm as its proved source (gdp-wired ships the rule as JavaScript; Bend
 compiles the proved source itself). The full list of what is and isn't in scope is in
 [`docs/comparison.md`](docs/comparison.md#gdp-wireds-scope-in-detail).
 
@@ -297,14 +311,20 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   reads them back as runtime values.
 - **Integers and decimals**: `int` and `decimal(places)` inputs, `.ints({...})` and `.decimals(places, {...})` state;
   `plus`, `minus`, `negate`, `times(k)` (k may be negative), `min`, `max`, `abs`, `isNegative`, comparisons with numbers
-  (a decimal's literals are scaled: `price.atMost(19.99)`). Each is two naturals underneath, so the kernel and the Lean
-  twin see nothing new; `rule.decode(state)` reads them back as numbers.
+  (a decimal's literals are scaled: `price.atMost(19.99)`), and `modBy(k)`, `divBy(k)` by Euclid's rule (−7 div 2 is
+  −4, −7 mod 2 is 1, as SMT-LIB and Lean's `Int` read them). Each is two naturals underneath, so the kernel twin sees
+  nothing new; the Lean export states each law about integers again over `Int` (`law0_int`, proven from the law over
+  the naturals by `omega`), and `rule.decode(state)` reads them back as numbers. A natural's `minus` stays truncated:
+  an integer is a kind of its own, chosen where a value may go below 0 (`examples/arith.ts`).
 - **Strings**: `str({like: ['*.internal'], maxLength: 64})`. A string is its interned name, its length and a bit per
   declared pattern (Cedar's glob), all computed from the string itself when the input is encoded. `s.like(pattern)`,
   `s.eq('admin')` (which carries the literal's length and pattern bits, so laws reason from either), `s.isEmpty`,
   `s.length`; sets of strings are carried maps keyed by `s.id`.
 - **Arithmetic** over the naturals: `plus`, `minus` (truncated), `times(k)`, `mul` (a product of two terms, a map's
-  cell among them: `Used.at(k).atMost(per.mul(Seats.at(k)))`), `min`, `max`, `when(cond, a, b)`, `count(cond)`;
+  cell among them: `Used.at(k).atMost(per.mul(Seats.at(k)))`), `modBy(k)` and `divBy(k)` by a constant k ≥ 1 (the rule's
+  functions mod$k and div$k, known to the kernel by x = k·(x div k) + x mod k and x mod k < k, Presburger arithmetic it
+  already decides; Lean's `%` and `/`, both facts proven by `omega`; division by a term isn't offered: x = y·q + r is a
+  product of two unknowns), `min`, `max`, `when(cond, a, b)`, `count(cond)`;
   conditions `lt`, `atMost`, `eq`, `and`, `or`, `not`, `implies`. Where a law with products isn't linear in its
   monomials, the prover multiplies facts together and adds squares, as Lean's `nlinarith` does: (x − y)² for each
   product x·y the law reads, its factors as the step leaves them, and for each monomial split in two halves
@@ -313,6 +333,17 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   `disjointFrom`, `sameAs`) anywhere in a step or inside a law, `everyKey((i, j) => ...)` in a step for every two keys
   (each read on its own, compared with the other plainly: `i.lt(j)`), `M.each(k => ...)` to write every key, and
   `someKey(k => ..., witness?)` for "some key where", proven through a witness the prover finds or the one given.
+- **There exists** (`exists(kind?, f, witness?)`, core/exists.ts): "some value of the kind (nat, int, bool, upTo(k))
+  where f holds", anywhere in a law where it reads so (under no `not`, not before `implies`), after its `forall` key if
+  it has one. The kernel never sees it: the law it proves is f with a witness term in place (a term of the state, for
+  each bound value), or f over ghosts the machine gains (a value at the start, and after each step one over the
+  witness before, the request and the state before), chosen by the kernel's counterexamples among what f's own atoms
+  solve for, 0, the state, the params, the request's values and shifts of the witness before, per case of the step; a
+  witness given, `exists(k => ..., lo)` or `{start, step: (k, env) => ...}`, is the only one tried. The verdict's
+  `witnesses` says how each reads. In the assumption (`exists(int, k => amount.eq(k.times(5)))`) or a precondition, it
+  is an input or a param the runtimes find (`encodeInput`, `encodeParams`: exact where it is one natural or integer
+  read linearly); a request no witness fits is refused. A run refutes a false one where no value can be a witness,
+  decided the same way.
 - **Functions** (`.fns({perMinute: divBy(60)})`, or `fn(arity, js, {facts, lean})` for your own): read like params that
   take arguments, `perMinute(t)`; the kernel knows each only by its facts (`.facts(...)`, and a library function's
   own), and the Lean export takes them as the hypothesis they are, proving them where the function has a Lean
@@ -395,7 +426,7 @@ Proving and checking: a law over 64 steps proves in about 5 s, and Lean checks i
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `guide.ts` (the guide's code), `groups.ts` (two groups decided at every pair), `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 64 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `guide.ts` (the guide's code), `groups.ts` (two groups decided at every pair), `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `exists.ts` (laws with "there exists"), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `arith.ts` (division and remainder by a constant, integers in rules and datatypes), `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 64 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |

package/dist/core/cycles.d.ts

@@ -37,6 +37,17 @@ export declare const argsKey: (args: E[]) => E;
 export declare const linE: (coef: Record<string, number>, c: number) => E;
 export declare const showE: (e: E) => string;
 export declare const showC: (c: C) => string;
+type Env = Record<string, number>;
+export declare function ranksOfRuns(vars: string[], points: Env[], edges: {
+    s: Env;
+    t: Env;
+}[], ms?: number): {
+    comps: {
+        coef: Record<string, number>;
+        c: number;
+    }[];
+    left: number;
+};
 export declare function claimInstances(facts: Fact[], claim: Claim, depth?: number): NodeSpec['insts'];
 export declare function findCycles(facts: Fact[], claims: Claim[], opts?: CycleOptions): CycleVerdict;
 export type RankVerdict = {
@@ -92,3 +103,4 @@ export declare function cycleLemmas(m: Machine, laws: Law[], stepLaws?: StepLaw[
     proof?: Cyclic;
     why?: string;
 };
+export {};

package/dist/core/cycles.js

@@ -625,6 +625,13 @@ function lexRanks(idx, nodes, samples, edges, name, until, onEdges = false, weak
     return { comps, left: left.length };
 }
 const gcd = (a, b) => (b === 0 ? a : gcd(b, a % b));
+// The same over named naturals and the edges of runs alone (core/data.ts: a recursive function's calls, each from its
+// parameters' sizes to its arguments'): each component's coefficient per variable and its constant.
+export function ranksOfRuns(vars, points, edges, ms = 1000) {
+    const node = { name: 'runs', hyps: [], concl: yes, vars, level: 0, given: true };
+    const { comps, left } = lexRanks([0], [node], [points.map(env => ({ env, calls: new Set() }))], edges.map(e => ({ from: 0, to: 0, s: e.s, t: e.t })), shared, performance.now() + ms);
+    return { comps: comps.map(c => ({ coef: Object.fromEntries(vars.map((x, j) => [x, c[shared(0, j)] ?? 0])), c: c[shared(0, 'b')] ?? 0 })), left };
+}
 const compE = (c, n, node, name) => unfeat(linE(Object.fromEntries(node.vars.map((x, j) => [x, c[name(n, j)] ?? 0])), c[name(n, 'b')] ?? 0));
 // Ranks of degree 2: a product of two of a node's variables (a square too) a further variable of the LP, its value at
 // each sample the product's, one product at a time (a sparse template: with every product at once, the runs fit a rank

package/dist/core/data.d.ts

@@ -6,10 +6,14 @@ export declare const self: {
 };
 export declare const natural: "nat";
 export declare const boolean: "bool";
-export type FieldSort = 'nat' | {
+export declare const integer: "int";
+export type FieldSort = 'nat' | 'int' | {
+    data: string;
+};
+export type Sort = 'nat' | 'bool' | 'int' | Data;
+export declare const isDataField: (s: FieldSort) => s is {
     data: string;
 };
-export type Sort = 'nat' | 'bool' | Data;
 export type Ctor = {
     name: string;
     fields: {
@@ -31,6 +35,35 @@ export type X = {
     op: 'mul';
     k: number;
     a: X;
+} | {
+    op: 'prod';
+    a: X;
+    b: X;
+} | {
+    op: 'mod' | 'div';
+    k: number;
+    a: X;
+} | {
+    op: 'int';
+    value: number;
+} | {
+    op: 'iadd' | 'isub';
+    a: X;
+    b: X;
+} | {
+    op: 'ineg';
+    a: X;
+} | {
+    op: 'imul';
+    k: number;
+    a: X;
+} | {
+    op: 'ofnat';
+    a: X;
+} | {
+    op: 'imod' | 'idiv';
+    k: number;
+    a: X;
 } | {
     op: 'if';
     c: Y;
@@ -66,11 +99,19 @@ export type X = {
 } | {
     op: 'bool';
     c: Y;
+} | {
+    op: 'size';
+    data: string;
+    of: X;
 };
 export type Y = {
     op: '<' | '<=' | '=';
     a: X;
     b: X;
+} | {
+    op: 'i<' | 'i<=';
+    a: X;
+    b: X;
 } | {
     op: 'and' | 'or';
     xs: Y[];
@@ -86,12 +127,17 @@ export type Y = {
     op: 'holds';
     x: X;
 };
+export declare const bindName: (field: string) => string;
 export declare class Nat {
     readonly x: X;
     constructor(x: X);
     plus(b: NatLike): Nat;
     minus(b: NatLike): Nat;
     times(k: number): Nat;
+    mul(b: NatLike): Nat;
+    modBy(k: number): Nat;
+    divBy(k: number): Nat;
+    toInt(): Integer;
     lt(b: NatLike): Bool;
     atMost(b: NatLike): Bool;
     gt(b: NatLike): Bool;
@@ -99,13 +145,30 @@ export declare class Nat {
     eq(b: NatLike): Bool;
     ne(b: NatLike): Bool;
     match(cases: {
-        zero: () => Nat | Bool | Val | number;
+        zero: () => Nat | Bool | Val | Integer | number;
         succ: (f: {
             pred: Nat;
-        }) => Nat | Bool | Val | number;
+        }) => Nat | Bool | Val | Integer | number;
     }): any;
 }
 export type NatLike = Nat | number;
+export declare class Integer {
+    readonly x: X;
+    constructor(x: X);
+    plus(b: IntegerLike): Integer;
+    minus(b: IntegerLike): Integer;
+    negate(): Integer;
+    times(k: number): Integer;
+    modBy(k: number): Integer;
+    divBy(k: number): Integer;
+    lt(b: IntegerLike): Bool;
+    atMost(b: IntegerLike): Bool;
+    gt(b: IntegerLike): Bool;
+    atLeast(b: IntegerLike): Bool;
+    eq(b: IntegerLike): Bool;
+    ne(b: IntegerLike): Bool;
+}
+export type IntegerLike = Integer | number;
 export declare class Bool {
     readonly y: Y;
     constructor(y: Y);
@@ -121,13 +184,14 @@ export declare class Val {
     readonly data: Data;
     readonly x: X;
     constructor(data: Data, x: X);
-    match(cases: Record<string, (fields: Record<string, any>) => Nat | Bool | Val | number>): any;
+    match(cases: Record<string, (fields: Record<string, any>) => Nat | Bool | Val | Integer | number>): any;
     is(ctor: string): Bool;
+    size(): Nat;
     eq(b: Val): Bool;
     ne(b: Val): Bool;
 }
-export declare const wrap: (s: Sort, x: X) => Nat | Bool | Val;
-export declare function when<T extends Nat | Val | Bool | number>(c: Bool, a: T, b: T): T extends number ? Nat : T;
+export declare const wrap: (s: Sort, x: X) => Nat | Bool | Val | Integer;
+export declare function when<T extends Nat | Val | Bool | Integer | number>(c: Bool, a: T, b: T): T extends number ? Nat : T;
 export declare const dataNamed: (name: string) => Data;
 export declare const fieldSort: (f: {
     sort: FieldSort;
@@ -143,14 +207,14 @@ export declare class Data {
     constructor(name: string, decl: Record<string, Record<string, FieldSort>>, group?: string[]);
     index(ctor: string): number;
     get nullary(): number;
-    make(ctor: string, ...args: (Val | NatLike)[]): Val;
+    make(ctor: string, ...args: (Val | NatLike | Integer)[]): Val;
     ctorHeight(c: Ctor): number;
     get height(): number;
 }
 export declare function weakOrder(ds: Data[]): Map<string, number>;
 type Decl = Record<string, Record<string, unknown>>;
 export declare function data<const D extends Decl>(name: string, decl: D): Data & {
-    [c in keyof D]: keyof D[c] extends never ? Val : (...args: (Val | NatLike)[]) => Val;
+    [c in keyof D]: keyof D[c] extends never ? Val : (...args: (Val | NatLike | Integer)[]) => Val;
 };
 export declare function mutual<const G extends Record<string, Decl>>(decls: G): {
     [n in keyof G]: Data & Record<string, any>;
@@ -166,14 +230,41 @@ export type Fn = {
     readonly decreases?: number;
     readonly ring: string[];
     paramFns: string[];
+    readonly measure?: Measure;
+    readonly termination?: Termination;
+    stated?: Measure;
 };
-export type Callable = ((...args: (Val | NatLike | Bool)[]) => any) & {
+export type Callable = ((...args: (Val | NatLike | Bool | Integer)[]) => any) & {
     fn: Fn;
 };
-export declare function define(name: string, params: Record<string, Sort>, ret: Sort, body: (args: Record<string, any>) => Nat | Bool | Val | number): Callable;
+export declare function define(name: string, params: Record<string, Sort>, ret: Sort, body: (args: Record<string, any>) => Nat | Bool | Val | Integer | number, opts?: {
+    measure?: (string | string[])[];
+}): Callable;
 export declare const fnParam: (name: string) => ((x: NatLike) => Nat) & {
     param: string;
 };
+export type Measure = {
+    comps: {
+        coef: number[];
+        c: number;
+    }[];
+};
+export type Termination = {
+    measure: Measure;
+    text: string;
+    obligations: {
+        law: DataLaw;
+        proof?: CyclicVerdict;
+        scheme?: string;
+        lemmas: string[];
+    }[];
+    ms: number;
+};
+export declare const terminationMs: {
+    ms: number;
+};
+export declare const showMeasure: (f: Pick<Fn, "params">, m: Measure) => string;
+export declare function measureX(f: Pick<Fn, 'params'>, c: Measure['comps'][number], args: X[]): X;
 export type DataLaw = {
     name: string;
     vars: {
@@ -189,8 +280,16 @@ export type Value = number | {
     f: Value[];
 };
 type Env = Map<string, Value>;
-export declare function evalX(x: X, env: Env, params: Record<string, (n: number) => number>): Value;
-export declare function evalY(y: Y, env: Env, params: Record<string, (n: number) => number>): boolean;
+export declare const fnNamed: (name: string) => Fn | undefined;
+export declare class EvalLimit extends RangeError {
+}
+export declare const evalBounds: {
+    on: boolean;
+    depth: number;
+    calls: number;
+};
+export declare function evalX(x: X, env: Env, params: Record<string, (n: number) => number>, d?: number): Value;
+export declare function evalY(y: Y, env: Env, params: Record<string, (n: number) => number>, d?: number): boolean;
 export declare const showValue: (d: Sort, v: Value) => string;
 type Rand = () => number;
 export declare const rng: (seed: number) => Rand;
@@ -205,6 +304,7 @@ export declare function samples(vars: {
     sort: Sort;
 }[], paramNames: string[], n: number, seed?: number): Sample[];
 export declare const keyOf: (args: E[]) => E;
+export declare function argsOf(key: E, n: number): E[] | undefined;
 export declare const tagMap: (d: string) => string, sizeMap: (d: string) => string;
 export declare const fieldMap: (d: Data, j: number, i: number) => string;
 export declare const ctorMap: (d: Data, j: number) => string;
@@ -212,8 +312,14 @@ export type Program = {
     datas: Data[];
     fns: Fn[];
     params: string[];
+    divisors: number[];
+    ints: boolean;
 };
 export declare function programOf(laws: DataLaw[], extra?: Fn[]): Program;
+export declare const divMap: (k: number) => string, modMap: (k: number) => string;
+export declare const zig: (z: number) => number;
+export declare const unzig: (c: number) => number;
+export declare const posMap = "int$pos", negMap = "int$neg";
 export declare function encX(p: Program, x: X, env: Map<string, E>): E;
 export declare function encY(p: Program, y: Y, env: Map<string, E>): C;
 export type Facts = {
@@ -264,6 +370,7 @@ export type DataVerdict = {
     tried: number;
     program?: Program;
     node?: number;
+    through?: string[];
 };
 export type Options = {
     samples?: number;
@@ -273,6 +380,7 @@ export type Options = {
     induction?: boolean;
     seed?: number;
     patience?: number;
+    transfer?: boolean;
 };
 export declare function refute(l: DataLaw, n?: number, seed?: number): Record<string, string> | undefined;
 type SchemeUse = {
@@ -288,6 +396,8 @@ type Scheme = {
     };
     uses: SchemeUse[];
     companions?: Companion[];
+    rank?: E[];
+    shapes?: E[];
 };
 type Companion = {
     law: DataLaw;
@@ -298,6 +408,11 @@ type Companion = {
     uses: SchemeUse[];
 };
 export declare const schemesOf: (p: Program, l: DataLaw) => Scheme[];
+export type Proven = {
+    law: DataLaw;
+    spec: NodeSpec;
+    nodes: NodeSpec[];
+};
 export declare const attemptMs: {
     ms: number;
 };
@@ -310,5 +425,15 @@ export declare function conjectures(p: Program, l: DataLaw, max?: number, maxSiz
 export declare const showX: (x: X) => string;
 export declare const showY: (y: Y) => string;
 export declare function proveData(l: DataLaw, opts?: Options): DataVerdict;
+export type SearchCtx = {
+    p: Program;
+    fs: Facts;
+    base: Proven[];
+    level: number;
+};
+export declare function searchIn(l: DataLaw, opts: Options, until: number, ctx?: SearchCtx, phase?: 'all' | 'first' | 'rest'): {
+    verdict: DataVerdict;
+    out?: Proven;
+};
 export declare const proveDataToday: (l: DataLaw) => DataVerdict;
 export {};