gdp-wired 0.9.0 → 0.10.0

package/README.md

@@ -67,6 +67,10 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 - **Records and variants**: inputs, state, results, map cells and list items made of named fields, or one of several
   cases each with fields of its own (a payment by card or in cash, a seat free, held or sold), every case covered
   (`examples/datatypes.ts`).
+- **Lists a request carries, and trees**: an invoice's lines, with folds over them (the total, the taxable part) and
+  lemmas about the folds proven by induction over the lines (`examples/invoices.ts`); a fold over a tree as a value (a
+  spend roll-up over an org chart, sign-offs over a document's sections), its laws proven by induction over the tree
+  (`examples/folds.ts`).
 - **Pure functions and two-run laws**: laws about what a function returns, and laws comparing two calls, like "the
   secret never changes the answer". `examples/jev-fabric/` ports a Bend project's policy core and proves all 59 laws its
   Bend proofs state.
@@ -218,7 +222,19 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   twin see nothing new. Maps and lists of them: `.maps({Acct: record({...}).from({...})})` (`Acct.at(k)`,
   `Acct.set(k, value)`, `Acct.each(k => value)`) and `.items({Queue: Job})` (`push`, `pop`, `set`, `insertAt`,
   `removeAt`, `apply`, `has`, `within`, `increasing(by)`), one map per variable of the kind; `rule.decode` reads them back
-  as objects and arrays. Not as values: recursive types (a tree).
+  as objects and arrays.
+- **Lists a request carries** (`.carriesList('Lines', Line, folds, lemmas)`): the items one carried map per variable of
+  the kind, the length `Lines.len`, each fold (`{total: {from: 0, step: (acc, line) => acc.plus(line.amount)}}`) a
+  carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the
+  array, and a request that doesn't meet them isn't allowed), read as `Lines.fold.total`; `Lines.every`, `some`, `has`,
+  `increasing(by)`, `at(i)`. A lemma about the folds (`({taxed, total}) => taxed.atMost(total)`) is proven by induction
+  over the items when the rule is built, then assumed at every prefix (`examples/invoices.ts`).
+- **Folds over trees** (`fold(name).params(...).inputs(...).leaf(env => ({...})).node((env, left, right) => ({...}))`,
+  `proveFold`): a tree as a value (`{leaf: inputs}` or `{node: inputs, left, right}`), each leaf's values from its inputs
+  and each node's from its own and its children's; a law about the values is proven by induction over the tree (the
+  kernel's leaf and node goals, Lean's `fold_sound`), `f.run(tree, params)` evaluates the terms proven and `f.crossCheck`
+  holds the builders to them (`examples/folds.ts`). A tree in a rule's state, and claims that need a lemma about the
+  tree's shape nobody stated, stay Lean's.
 - **State of any kind**: `.state({open: bool.from(true), status: oneOf('new', 'done').from('new'), owner: str().from(''), note: maybe(nat).from(null)})`;
   a step writes each kind's own values, `when(c, a, b)` chooses between any two values of a kind, and `rule.decode(state)`
   reads them back as runtime values.
@@ -313,7 +329,7 @@ Lean, compiled natively, wins where the state stays small. Details in [`docs/com
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |

package/dist/core/dsl.d.ts

@@ -1,5 +1,5 @@
 import { type C, type E, type Law, type Recurrence, type Machine, type Request, type State } from './machine.js';
-import { type Goal, type Liveness, type Loop, type StepLaw, type Tree } from '../kernel/kernel.js';
+import { type Fold, type Goal, type Liveness, type Loop, type StepLaw, type Tree } from '../kernel/kernel.js';
 export type TermLike = Term | number;
 export declare const termOf: (t: TermLike) => E;
 export declare class Term {
@@ -310,6 +310,35 @@ export type ItemsOp = {
     readonly parts: Record<string, ListOp>;
     readonly len: TermLike;
 };
+export type ListFold<V> = {
+    from: number;
+    step: (acc: Term, item: V) => TermLike;
+};
+export type ListLemma = (acc: Record<string, Term>, i: Term) => Cond;
+export declare class CarriedList<V, Fd extends string = never> {
+    readonly name: string;
+    readonly kind: Kind<V>;
+    readonly len: Term;
+    readonly folds: Record<Fd, ListFold<V>>;
+    private readonly map;
+    readonly lemmas: Record<string, ListLemma>;
+    readonly fold: Record<Fd, Term>;
+    constructor(name: string, kind: Kind<V>, len: Term, folds: Record<Fd, ListFold<V>>, map: (part: string) => MapRef, lemmas?: Record<string, ListLemma>);
+    at(i: TermLike): V;
+    after(fold: Fd, i: TermLike): Term;
+    every(f: (item: V, i: Term) => Cond): Cond;
+    some(f: (item: V, i: Term) => Cond): Cond;
+    has(x: V): Cond;
+    increasing(by: (item: V) => Term): Cond;
+    equations(): Cond[];
+    private running;
+    prove(): Verdict;
+    get maps(): string[];
+    encode(raw: Raw): {
+        maps: Record<string, Map<number, number>>;
+        len: number;
+    };
+}
 export declare class ItemsRef<V> {
     readonly name: string;
     readonly kind: Kind<V>;
@@ -392,6 +421,7 @@ type Spec = {
     items?: [string, Kind<unknown>][];
     kinded?: [string, Kind<unknown>][];
     carried?: string[];
+    lists2?: [string, Kind<unknown>, Record<string, ListFold<unknown>>, Record<string, ListLemma>][];
     fns?: [string, FnDef][];
     facts?: ((env: never) => Record<string, Cond | Forall>)[];
     flags: ((env: never) => Record<string, Cond>)[];
@@ -444,6 +474,9 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     carries<const N extends string>(...names: N[]): Rule<P, I & {
         [k in N]: MapRef;
     }, S, M, F, R, Su, Q>;
+    carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term) => Cond>): Rule<P, I & {
+        [k in N]: CarriedList<V, Fd>;
+    }, S, M, F, R, Su, Q>;
     flags<T extends Record<string, Cond>>(f: (env: P & I & S & M & F & Su & Q) => T): Rule<P, I, S, M, F & {
         [k in keyof T]: Cond;
     }, R, Su, Q>;
@@ -516,7 +549,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
         [k in keyof P]: Raw;
     }): Record<string, number>;
     encodeInput(values: {
-        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : Raw;
+        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
     }): Request;
     randomParams(rand: Rand, bound: number): Record<string, number>;
     randomInput(rand: Rand, bound: number): Request;
@@ -690,3 +723,55 @@ export declare function crossCheckDecision(d: Decision, opts?: {
     failure?: string;
 };
 export declare const proveLoop: (l: LoopRule<Obj, Obj, Obj>, laws: Law[]) => Verdict;
+export type TreeValue<I> = {
+    leaf: I;
+} | {
+    node: I;
+    left: TreeValue<I>;
+    right: TreeValue<I>;
+};
+type FoldSpec = {
+    name: string;
+    params: [string, Kind<unknown>][];
+    inputs: [string, Kind<unknown>][];
+    pre: ((p: never) => Cond)[];
+    assume: ((env: never) => Cond)[];
+    leaf?: (env: never) => Record<string, TermLike>;
+    node?: (env: never, left: never, right: never) => Record<string, TermLike>;
+};
+export declare class FoldRule<P extends Obj = {}, I extends Obj = {}, S extends Obj = {}> {
+    private readonly spec;
+    constructor(spec: FoldSpec);
+    private with;
+    get name(): string;
+    params<K extends Kinds>(kinds: K): FoldRule<P & ValuesOf<K>, I, S>;
+    inputs<K extends Kinds>(kinds: K): FoldRule<P, I & ValuesOf<K>, S>;
+    pre(f: (p: P) => Cond): FoldRule<P, I, S>;
+    assume(f: (env: P & I) => Cond): FoldRule<P, I, S>;
+    leaf<T extends Record<string, TermLike>>(f: (env: P & I) => T): FoldRule<P, I, {
+        [k in keyof T]: Term;
+    }>;
+    node(f: (env: P & I, left: S, right: S) => {
+        [k in keyof S]: TermLike;
+    }): FoldRule<P, I, S>;
+    private env;
+    private names;
+    private side;
+    law(name: string, f: (env: P & S) => Cond): Law;
+    get fold(): Fold;
+    run(tree: TreeValue<{
+        [k in keyof I]: Raw;
+    }>, params?: {
+        [k in keyof P]?: Raw;
+    }): {
+        [k in keyof S]: number;
+    };
+    crossCheck(laws?: Law[], opts?: {
+        trials?: number;
+        depth?: number;
+        bound?: number;
+        rand?: Rand;
+    }): Agreement;
+}
+export declare const fold: (name: string) => FoldRule;
+export declare const proveFold: (f: FoldRule<Obj, Obj, Obj>, laws: Law[]) => Verdict;

package/dist/core/dsl.js

@@ -15,9 +15,9 @@
 //
 // A step returns its updates as one object: every right-hand side reads the state before the step, as the kernel and
 // both runtimes do.
-import { carriedView, compileFunction, evalC, interpret, loadJs, numbersOf } from "./machine.js";
+import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf } from "./machine.js";
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
-import { check, loopObligations } from "../kernel/kernel.js";
+import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
 import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
@@ -867,6 +867,89 @@ export class CellsRef {
         return { parts: Object.fromEntries(this.kind.vars(this.name).map(part => [part, this.map(part).each(k => partsOf(this.kind, this.name, f(k))[part])])) };
     }
 }
+export class CarriedList {
+    name;
+    kind;
+    len;
+    folds;
+    map;
+    lemmas;
+    fold;
+    constructor(name, kind, len, folds, map, lemmas = {}) {
+        this.name = name;
+        this.kind = kind;
+        this.len = len;
+        this.folds = folds;
+        this.map = map;
+        this.lemmas = lemmas;
+        this.fold = Object.fromEntries(Object.keys(folds).map(f => [f, map(`${name}$${f}`).at(len)]));
+    }
+    at(i) { return this.kind.build(this.name, part => this.map(part).at(i)); }
+    // The running value of a fold after the first i items.
+    after(fold, i) { return this.map(`${this.name}$${fold}`).at(i); }
+    every(f) { return everyKey(k => k.lt(this.len).implies(f(this.at(k), k))); }
+    some(f) { return this.every((x, i) => f(x, i).not()).not(); }
+    has(x) { return this.some(y => same(y, x)); }
+    // Each item's `by` below the next one's (so no two alike).
+    increasing(by) { return everyKey(k => k.plus(1).lt(this.len).implies(by(this.at(k)).lt(by(this.at(k.plus(1)))))); }
+    // What every request is assumed to meet: each fold's start, and at every key one condition (the item's own laws and
+    // each fold's step below the length, each lemma up to it), so the prover closes one quantifier, not one per part.
+    equations() {
+        const folds = Object.entries(this.folds), lemmas = Object.values(this.lemmas);
+        const at = (k) => {
+            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x)));
+            const below = [...this.kind.invariant(x), ...steps];
+            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k))))] : []));
+        };
+        const any = this.kind.invariant(this.kind.value(this.name)).length + folds.length + lemmas.length > 0;
+        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(d.from)), ...(any ? [everyKey(at)] : [])];
+    }
+    running(k) { return Object.fromEntries(Object.keys(this.folds).map(f => [f, this.after(f, k)])); }
+    // The lemmas, proven: the folds as a machine counting i up from 0 over items that are functions of i known only by
+    // the kind's own laws, each lemma a law of it (so it holds after every prefix of every list).
+    prove() {
+        if (!Object.keys(this.lemmas).length)
+            return { proven: true, checked: true };
+        const parts = this.kind.vars(this.name), fname = (p) => `item$${p.replaceAll('.', '$')}`;
+        const item = (i) => this.kind.build(this.name, p => new Term({ op: 'get', map: fname(p), key: i.e }));
+        // Every item is a value of the kind (its own laws, as a fact of the first part's function).
+        const kindFact = this.kind.invariant(this.kind.value(this.name)).length ? { 'every item is a value of its kind': forall(k => all(...this.kind.invariant(item(k)))) } : {};
+        const fns = Object.fromEntries(parts.map((p, j) => [fname(p), fn(1, 'x => 0', j === 0 ? { facts: () => kindFact } : {})]));
+        const folds = Object.entries(this.folds);
+        const r = rule(`${this.name}'s folds, by induction`).fns(fns).inputs({}).state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.from])) })
+            .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i))])) }));
+        const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i))));
+    }
+    // Every carried map it is kept in: the items' parts, then each fold's.
+    get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
+    // A request's list as those maps and its length: each fold computed by its step, as the builders compute it.
+    encode(raw) {
+        if (!Array.isArray(raw))
+            throw new RangeError(`${this.name} must be a list, not ${shown(raw)}`);
+        const items = raw.map(x => this.kind.encode(this.name, x));
+        const maps = Object.fromEntries(this.maps.map(m => [m, new Map()]));
+        items.forEach((enc, i) => { for (const [part, x] of Object.entries(enc))
+            if (x !== 0)
+                maps[part].set(i, x); });
+        for (const [f, d] of Object.entries(this.folds)) {
+            const acc = maps[`${this.name}$${f}`];
+            let value = d.from;
+            if (value !== 0)
+                acc.set(0, value);
+            items.forEach((enc, i) => {
+                const item = this.kind.build(this.name, part => new Term({ op: 'const', value: enc[part] }, enc[part]));
+                const next = valOf(d.step(new Term({ op: 'const', value }, value), item));
+                if (next === undefined || !Number.isSafeInteger(next) || next < 0)
+                    throw new RangeError(`${this.name}'s fold ${f} reads more than its items`);
+                value = next;
+                if (value !== 0)
+                    acc.set(i + 1, value);
+            });
+        }
+        return { maps, len: items.length };
+    }
+}
 export class ItemsRef {
     name;
     kind;
@@ -1371,6 +1454,27 @@ export class Rule {
     facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
     // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
+    // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
+    //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
+    carriesList(name, of, folds = {}, lemmas = {}) {
+        const entries = [[name, of, folds, lemmas]];
+        for (const [n, , fs] of entries)
+            for (const f of Object.keys(fs))
+                if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                    throw new Error(`${n}: ${f} is not a plain fold name`);
+        // The folds' lemmas, proven now (a lemma that isn't throws, with the verdict).
+        for (const [n, k, fs, ls] of entries) {
+            const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls).prove();
+            if (!(v2.proven && v2.checked))
+                throw new Unproven(`${n}'s fold lemmas`, v2);
+        }
+        for (const [n, , fs] of entries)
+            for (const f of Object.keys(fs))
+                if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                    throw new Error(`${n}: ${f} is not a plain fold name`);
+        const maps = entries.flatMap(([n, k, fs]) => [...k.vars(n), ...Object.keys(fs).map(f => `${n}$${f}`)]);
+        return this.with({ carried: [...(this.spec.carried ?? []), ...maps], inputs: [...this.spec.inputs, ...entries.map(([n]) => [`${n}_len`, nat])], lists2: [...(this.spec.lists2 ?? []), ...entries] });
+    }
     // Named conditions of the step, decided once per step before it; each call's flags may read the earlier calls'. A flag
     // named again replaces the earlier definition in place (what a variant needs: one call, the step unchanged); the new
     // definition may read only the flags defined before the original's place, as the kernel checks.
@@ -1500,6 +1604,8 @@ export class Rule {
     //   r.relate('the secret is irrelevant', (a, b) => a.user.eq(b.user), (a, b) => a.allowed.iff(b.allowed))
     relate(name, given, then) {
         const s = this.spec, b = (n) => `b.${n}`, own = [...s.inputs.map(([n]) => n), ...(s.carried ?? [])];
+        if (s.lists2?.length)
+            throw new Error(`${s.name}: a decision about two requests takes no carried list`);
         const second = (env) => ({ ...env, ...Object.fromEntries(own.map(n => [n, env[b(n)]])) });
         const pair = new Rule({ ...s, inputs: [...s.inputs, ...s.inputs.map(([n, k]) => [b(n), k])], carried: [...(s.carried ?? []), ...(s.carried ?? []).map(b)],
             assume: [...s.assume, ...s.assume.map(f => (env) => f(second(env)))], flags: [], step: undefined, record: undefined, sums: [], queries: [], keep: undefined, relations: undefined, prune: undefined });
@@ -1543,6 +1649,12 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
+                const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls);
+                for (const part of l.maps)
+                    delete out[part];
+                out[n] = l;
+            }
         }
         if (parts.state !== false) {
             for (const [n] of this.spec.state)
@@ -1653,7 +1765,7 @@ export class Rule {
                 state[n] = hoist.term(termOf(u));
         }
         const pre = [...this.kindAssumptions('params'), ...s.pre.map(f => f(pEnv).c)];
-        const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => hoist.cond(f(env).c))];
+        const assume = [...this.kindAssumptions('inputs'), ...(s.lists2 ?? []).flatMap(([n]) => env[n].equations().map(c => hoist.cond(c.c))), ...s.assume.map(f => hoist.cond(f(env).c))];
         placed();
         // Functions, and their facts: each function's own (named after it), then the rule's.
         // The functions a function reads come first, each named <function>.<use>.
@@ -1865,9 +1977,16 @@ export class Rule {
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
     // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    // A carried list is an array of its items' runtime values (its length and folds computed from them).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     encodeInput(values) {
-        const out = encode(this.spec.inputs, values);
+        const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(values[n])]));
+        const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
+        for (const l of Object.values(lists))
+            Object.assign(out, l.maps);
         for (const n of this.spec.carried ?? []) {
+            if (n in out)
+                continue;
             const given = values[n];
             out[n] = given instanceof Map ? new Map(given) : new Map([...given].map(key => [key, 1]));
         }
@@ -1879,6 +1998,11 @@ export class Rule {
         const out = Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound)));
         for (const n of this.spec.carried ?? [])
             out[n] = new Map(Array.from({ length: bound + 1 }, (_, key) => [key, rand(2)]).filter(([, cell]) => cell === 1));
+        // A carried list: items drawn by their kind, its length and folds as the encoding computes them.
+        for (const [n, k, fs] of this.spec.lists2 ?? []) {
+            const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(Array.from({ length: rand(bound + 1) }, () => k.sample(rand, bound)));
+            Object.assign(out, l.maps, { [`${n}_len`]: l.len });
+        }
         return out;
     }
     // The state's scalars as runtime values: each kinded variable as its kind decodes it (an integer as one signed
@@ -2105,3 +2229,112 @@ export function crossCheckDecision(d, opts = {}) {
     return { checked };
 }
 export const proveLoop = (l, laws) => goalsVerdict(loopObligations(l.loop, laws, l.rankTerms));
+export class FoldRule {
+    spec;
+    constructor(spec) {
+        this.spec = spec;
+    }
+    with(more) { return new FoldRule({ ...this.spec, ...more }); }
+    get name() { return this.spec.name; }
+    params(kinds) { return this.with({ params: [...this.spec.params, ...Object.entries(kinds)] }); }
+    inputs(kinds) { return this.with({ inputs: [...this.spec.inputs, ...Object.entries(kinds)] }); }
+    pre(f) { return this.with({ pre: [...this.spec.pre, f] }); }
+    // What every leaf's and node's inputs satisfy (with their kinds' own assumptions).
+    assume(f) { return this.with({ assume: [...this.spec.assume, f] }); }
+    leaf(f) { return this.with({ leaf: f }); }
+    node(f) { return this.with({ node: f }); }
+    env(inputs = true) {
+        const out = {};
+        for (const [n, k] of this.spec.params)
+            out[n] = k.value(n);
+        if (inputs)
+            for (const [n, k] of this.spec.inputs)
+                out[n] = k.value(n);
+        return out;
+    }
+    names() {
+        if (!this.spec.leaf)
+            throw new Error(`${this.spec.name}: a fold needs a leaf`);
+        return Object.keys(this.spec.leaf(this.env()));
+    }
+    side(prefix) { return Object.fromEntries(this.names().map(n => [n, v(`${prefix}${n}`)])); }
+    // A law about the values (and the params): it reads no input.
+    law(name, f) { return { name, holds: f({ ...this.env(false), ...this.side('') }).c }; }
+    get fold() {
+        const s = this.spec;
+        if (!s.leaf || !s.node)
+            throw new Error(`${s.name}: a fold needs a leaf and a node`);
+        const env = this.env(), pEnv = this.env(false);
+        const pre = [...s.params.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.pre.map(f => f(pEnv).c)];
+        const assume = [...s.inputs.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.assume.map(f => f(env).c)];
+        const terms = (r) => Object.fromEntries(Object.entries(r).map(([n, t]) => [n, termOf(t)]));
+        const leaf = terms(s.leaf(env)), node = terms(s.node(env, this.side('l_'), this.side('r_')));
+        return { name: s.name, params: s.params.flatMap(([n, k]) => k.vars(n)), inputs: s.inputs.flatMap(([n, k]) => k.vars(n)), leaf, node,
+            ...(pre.length ? { pre: pre.length === 1 ? pre[0] : { op: 'and', xs: pre } } : {}), ...(assume.length ? { assume: assume.length === 1 ? assume[0] : { op: 'and', xs: assume } } : {}) };
+    }
+    // The values of a tree, by the terms that were proven (each leaf's and node's inputs as their kinds encode them; one
+    // that doesn't meet `assume` is refused, as the laws are claimed only of trees that meet it).
+    run(tree, params = {}) {
+        const f = this.fold, ps = encode(this.spec.params, params), none = { name: f.name, params: [], inputs: [], state: {}, step: {} };
+        const st = { scalars: {}, maps: {} };
+        if (f.pre && !evalC(f.pre, ps, st, none))
+            throw new RangeError(`${f.name}: the params don't meet its precondition`);
+        const go = (t) => {
+            const own = 'leaf' in t ? t.leaf : t.node, env = { ...ps, ...encode(this.spec.inputs, own) };
+            if (f.assume && !evalC(f.assume, env, st, none))
+                throw new RangeError(`${f.name}: ${JSON.stringify(own)} doesn't meet its assumption`);
+            if ('leaf' in t)
+                return Object.fromEntries(Object.entries(f.leaf).map(([n, e]) => [n, evalE(e, env, st, none)]));
+            const l = go(t.left), r = go(t.right);
+            const both = { ...env, ...Object.fromEntries(Object.entries(l).map(([n, x]) => [`l_${n}`, x])), ...Object.fromEntries(Object.entries(r).map(([n, x]) => [`r_${n}`, x])) };
+            return Object.fromEntries(Object.entries(f.node).map(([n, e]) => [n, evalE(e, both, st, none)]));
+        };
+        return go(tree);
+    }
+    // The builders against what they built, on random trees: each value by the callbacks' own arithmetic against the
+    // terms the kernel proved (as run evaluates them), and each law's callback against its condition.
+    crossCheck(laws = [], opts = {}) {
+        const s = this.spec, rand = opts.rand ?? seeded(13), bound = opts.bound ?? 6, f = this.fold;
+        let checked = 0;
+        const sample = (kinds) => Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)]));
+        const tree = (d) => (d === 0 || rand(3) === 0 ? { leaf: sample(s.inputs) } : { node: sample(s.inputs), left: tree(d - 1), right: tree(d - 1) });
+        const known = (vals) => Object.fromEntries(Object.entries(vals).map(([n, x]) => [n, new Term({ op: 'const', value: x }, x)]));
+        for (let t = 0; t < (opts.trials ?? 200); t++) {
+            const params = sample(s.params), ps = encode(s.params, params);
+            const pv = known(ps), pEnv = Object.fromEntries(s.params.map(([n, k]) => [n, k.build(n, part => pv[part])]));
+            const builder = (tr) => {
+                const own = 'leaf' in tr ? tr.leaf : tr.node, iv = known(encode(s.inputs, own)), env = { ...pEnv, ...Object.fromEntries(s.inputs.map(([n, k]) => [n, k.build(n, part => iv[part])])) };
+                const out = 'leaf' in tr ? s.leaf(env) : (() => { const l = builder(tr.left), r = builder(tr.right); return l && r ? s.node(env, known(l), known(r)) : undefined; })();
+                if (!out)
+                    return undefined;
+                const vals = Object.entries(out).map(([n, x]) => [n, valOf(x)]);
+                return vals.every(([, x]) => x !== undefined) ? Object.fromEntries(vals) : undefined;
+            };
+            const tr = tree(opts.depth ?? 3);
+            let ours;
+            try {
+                ours = this.run(tr, params);
+            }
+            catch {
+                continue;
+            }
+            const theirs = builder(tr);
+            if (!theirs)
+                continue;
+            for (const [n, x] of Object.entries(theirs)) {
+                checked++;
+                if (ours[n] !== x)
+                    return { checked, failure: `${f.name}: ${n} is ${x} by its callbacks, ${ours[n]} by the terms proven, for ${JSON.stringify(tr)}` };
+            }
+            for (const law of laws) {
+                const ok = evalC(law.holds, { ...ps, ...ours }, { scalars: {}, maps: {} }, { name: f.name, params: [], inputs: [], state: {}, step: {} });
+                checked++;
+                if (!ok)
+                    return { checked, failure: `${f.name}: law ${law.name} fails for ${JSON.stringify(tr)} with params ${JSON.stringify(params)}` };
+            }
+        }
+        return { checked };
+    }
+}
+export const fold = (name) => new FoldRule({ name, params: [], inputs: [], pre: [], assume: [] });
+export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, laws));

package/dist/lean-kernel/emit.d.ts

@@ -135,6 +135,10 @@ export type LeanItem = {
     loop: Loop;
     rank: E | E[];
     laws?: Law[];
+} | {
+    id: string;
+    fold: Fold;
+    laws: Law[];
 } | {
     id: string;
     goal: Goal;

package/dist/lean-kernel/emit.js

@@ -1055,6 +1055,10 @@ export function toLean(items, opts = {}) {
             parts.push(`-- ${item.id}\n${loopToLean(id, item.loop, item.laws ?? [], item.rank)}`);
             theorems.push(`${id}_halts`);
         }
+        else if ('fold' in item) {
+            parts.push(`-- ${item.id}\n${foldToLean(id, item.fold, item.laws)}`);
+            theorems.push(`${id}_laws`);
+        }
         else {
             // goalToLean names its theorem t<i>; here it is the item's id.
             const n = goals++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdp-wired",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "An automatic prover for stateful rules (budgets, caps, windows, workflows, policies): laws proven with no proof to write, checked again in Lean, counterexamples found on the GPU, the rule shipped as code",
   "keywords": [
     "verification",
@@ -89,7 +89,7 @@
     "build": "bun scripts/build.ts",
     "prepublishOnly": "bun scripts/build.ts",
     "smoke": "sh scripts/smoke.sh",
-    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
+    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts invoices.test.ts folds.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
   },
   "devDependencies": {
     "@gdp-ts/core": "0.1.0",