lawspec 0.10.0 → 0.12.0

package/API-MIGRATION.md

@@ -278,3 +278,12 @@ Existing factory files remain untouched. Factory signature changes
 use the existing `adapterUpdates` reporting channel. See `NATIVE-BINDINGS.md`
 for grouping, module collision checks, and layout
 migration behavior.
+
+## Evidence in check results (0.12)
+
+Check, expand and generation responses include an additive `evidence` array.
+Each item names the owning unit, the contract `declaration`, the `stage`
+(`precondition` or `postcondition`), a `status` of `proved` or
+`runtime-checked`, a `reason`, and the `claim` as a typed expression. Schemas 3
+and 4 are otherwise unchanged; clients that ignore unknown fields need no
+changes. Generated definition code no longer re-checks proved postconditions.

package/HASKELL.md

@@ -41,6 +41,7 @@ have no constructors. They can appear in inhabited containers such as
 | `Nullable a` | `LS.Nullable a`, with `NullValue` and `NullableValue` |
 | `Optional a` | `LS.Optional a`, with `UndefinedValue` and `OptionalValue` |
 | `BigInt`, `BigUInt`, `Integer` | `Integer`, with domain checks |
+| `Integer` adapter result | `LS.IntegerValue`, built from any `Integral` with `LS.integerValue` |
 | `Decimal` | `LS.Decimal`, wrapping an exact finite base-ten `Rational` |
 | `Rational` | `Rational` |
 | `Complex64`, `Complex128` | `Complex Float`, `Complex Double` |

package/KOTLIN.md

@@ -61,6 +61,11 @@ arbitrary integers, and machine-profile integers use `BigInteger` with explicit
 domain checks. These portable machine-profile representations do not bind a
 host machine-sized primitive.
 
+An adapter whose result is the abstract `Integer` returns Kotlin `Number`.
+`Integer` is the top of the integral tower, so an implementation may return
+`Int`, `Long` or `BigInteger`; the result bridge rejects non-integral values
+such as `Double` and checks the logical domain. Arguments remain `BigInteger`.
+
 Decimal uses exact `BigDecimal`; Rational uses the normalized
 `LawSpecRuntime.Ratio`. Complex components use `LawSpecRuntime.Complex`, with
 Float32 precision validated for Complex64. Raw code-point text uses `IntArray`,

package/LANGUAGE.md

@@ -1,4 +1,4 @@
-# LawSpec language and compiler boundary (0.10)
+# LawSpec language and compiler boundary (0.12)
 
 LawSpec describes portable laws, concrete examples, and adapter contracts. The
 compiler is written in Haskell. Rust is an output backend alongside Java, Python,
@@ -102,7 +102,8 @@ scrutinee once; each branch binds that constructor's fields in the same order.
 Bindings are scoped to the branch. Matching must be exhaustive and cannot repeat
 a constructor. Lists match with `Nil` and `Cons head tail`; Maybe and Either use
 their constructors above. Recursive declarations must be strictly positive.
-General indexed constructors and GADT result signatures are not supported.
+Constructors may refine natural indices; see [indexed families](#natural-indexed-families).
+GADT result signatures that refine type arguments are not supported.
 
 Equality is structural and type-directed, including named fields and nested
 containers. Native public declarations retain their names and type parameters;
@@ -129,6 +130,89 @@ of recursive and nonrecursive named type constructors are supported; see
 constructor fields use checked constructor contracts. Recursive payload predicates
 follow stored type arguments and preserve outer dependent inputs.
 
+## Natural-indexed families
+
+A data declaration may take `Natural` parameters. Each constructor states how it
+determines them with `where <index> = <expression>`:
+
+```lawspec
+type Vec (n :: Natural) (a :: Type) is
+  | VNil where n = 0
+  | VCons head :: a tail :: Vec m a where n = m + 1
+end
+
+type Tree (n :: Natural) (a :: Type) is
+  | Tip where n = 0
+  | Bin left :: Tree l a value :: a right :: Tree r a where n = l + r + 1
+end
+
+append :: (xs :: Vec n Int8) -> (ys :: Vec m Int8) -> (r :: Vec (n + m) Int8)
+zip :: (xs :: Vec n Int8) -> (ys :: Vec n Bool) -> (r :: Vec n Bool)
+```
+
+Index expressions are sums of natural literals and index variables. A variable
+such as `m` is bound by the field whose type mentions it, and every index needs
+exactly one equation in every constructor. `Natural` is also an ordinary value
+type: an unbounded integer that is at least zero.
+
+Indices are evidence, not a second type system. The compiler elaborates a family
+before inference into three ordinary declarations:
+
+- erased data `Vec a` with the same constructors, which is the native
+  representation on every target;
+- a checked structural measure for each index, named `<index>Of<Type>` (here
+  `nOfVec` and `nOfTree`), recomputed from the constructor equations;
+- a refinement, so `Vec e a` in any signature or quantifier means
+  `(v :: Vec a where nOfVec v == e)`.
+
+`append` above is therefore an adapter contract: its result must have length
+`nOfVec xs + nOfVec ys`, and a native implementation that drops an element
+fails with the postcondition. An index variable that is otherwise unbound, like
+`n` and `m` in `append`, is implicit. It is determined by the first binder whose
+family type mentions it alone, and later occurrences read that binder's measure.
+Implicit indices must not first appear inside an expression, and a result cannot
+introduce one.
+
+Generation follows the index. For a free index, as in `append`, values come from
+the erased type and the index is their measure. For a fixed index (`Vec 3 Int8`)
+or a shared one (`zip`'s `ys`), the target is solved backwards through the
+constructor equations: `VCons` for `n = 3` needs a tail with index 2, and `Bin`
+splits `n - 1` between its subtrees. Samples are constructed, not filtered, and
+shrinking stays within the index on every target. The same planning applies to
+any user-written measure over declared data whose branches are a constant plus
+the same measure of that branch's fields.
+
+### Proved indices and evidence
+
+Checked definitions may return indexed families. The compiler proves their
+result indices statically, so they need no runtime postcondition:
+
+```lawspec
+definition concatV (xs :: Vec n Int8) (ys :: Vec m Int8) :: Vec (n + m) Int8 is
+  match xs with
+  | VNil -> ys
+  | VCons h t -> VCons h (concatV t ys)
+  end
+end
+```
+
+The proof uses exact linear arithmetic over the measures. A measure applied to a
+known constructor unfolds to that constructor's equation, so `nOfVec (VCons h t)`
+is `nOfVec t + 1`. Within a match branch, the scrutinee's constructor is known.
+Calls of checked definitions are pure, so equal calls have equal results. A
+recursive call contributes its own signature as the induction hypothesis, and
+natural measures are non-negative. A definition whose result index does not
+follow fails with `definition result refinement could not be proved`.
+
+Every contract obligation is recorded with how it is discharged. Definition
+postconditions are `proved`, and generated code omits their runtime checks.
+Definition preconditions guard native callers, and adapter contracts cover
+native code that LawSpec cannot inspect, so both are `runtime-checked`.
+`lawspec check` summarizes the evidence, and the API reports each obligation in
+the `evidence` field. A proved definition is a natural reference model for a
+native adapter, as in `append xs ys = concatV xs ys` in the
+[indexed example](examples/specs/indexed_families.lawspec).
+
 ## Total definitions
 
 A unit can supply an implementation as a checked total definition:
@@ -332,17 +416,56 @@ API schema v3 uses separately defined wire views, with lossless tagged scalar
 values. It does not serialize internal AST constructors. See the
 [API migration guide](API-MIGRATION.md).
 
-## Beyond 0.10
-
-GADTs, indexed families, and general dependent types are planned after 0.10.
-The Core type model distinguishes type arguments from index arguments, but that
-representation is not a claim that arbitrary dependent programs are accepted.
-User-defined products and sums have ordinary uniform type parameters.
-External type bindings and custom generator bindings are implemented in the
-0.10 release; see [the binding reference](NATIVE-BINDINGS.md) for their
-interface and acceptance status. They configure native representations alongside
-the typed testing plan and do not change source-language typing or equality.
-Cross-unit packages remain future work.
+## Roadmap
+
+0.11 elaborates natural-indexed families to erased data, measures and
+refinements. The Core type model distinguishes type arguments from index
+arguments, but that representation is not a claim that arbitrary dependent
+programs are accepted. External type bindings and custom generator bindings
+(0.10) configure native representations alongside the typed testing plan and do
+not change source-language typing or equality; see
+[the binding reference](NATIVE-BINDINGS.md).
+
+### 0.12 Proof-producing dependent layer (released)
+
+- Index equalities in checked definitions are discharged statically. Adapter
+  results remain runtime-checked.
+- Linear `Natural` arithmetic over measures is solved exactly, with unfolding
+  on known constructors and induction through recursive calls.
+- Evidence is recorded for every contract obligation as `proved` or
+  `runtime-checked`, and reported by `lawspec check` and the API.
+- Proved definition postconditions produce no runtime checks.
+- Checked definitions may return indexed families. See
+  [proved indices](#proved-indices-and-evidence).
+
+Still open, for evaluation in later releases: index equalities between sibling
+fields (perfect trees whose subtrees share one index), non-linear indices, and
+GADTs that refine type arguments.
+
+### 0.13 Wlaschin-style domain modeling primitives
+
+- Semantic wrappers and constrained primitives.
+- Make illegal states unrepresentable.
+- Explicit domain workflows and state distinctions.
+
+These build on 0.10 native bindings and 0.11 refinements.
+
+### 0.14 Cross-unit imports and packages
+
+- Reusable law, type and refinement libraries.
+- Versioning and namespacing, including constructor names scoped to their unit.
+  Today every unit compiled together needs distinct constructor names.
+- Publishable behavioral contracts.
+
+### 0.15 Evidence/discharge model
+
+Each obligation reports how it was discharged:
+
+- `PROVED`: discharged statically, by 0.12 evidence or definition proofs.
+- `EXHAUSTIVELY CHECKED`: every value of a finite domain was checked.
+- `PROPERTY TESTED`: generated cases, examples and boundaries.
+- `RUNTIME CHECKED`: adapter contracts and checked codecs at native boundaries.
+- `ASSUMED / EXTERNAL`: native adapters and bindings taken on trust.
 
 ## Generated project formatting
 

package/NATIVE-BINDINGS.md

@@ -973,7 +973,10 @@ Gradle's coordination socket. The saved logs confirm successful native tests,
 seven expected failures among 45 tests for the deliberately incorrect fee, and
 zero planned regeneration changes in both configurations. This verifies the
 installed CLI/Gradle path as well as the separate compilation/runtime harness.
-The CI additions have not yet run remotely.
+The remote run of these CI additions exposed failures in the Kotlin and Haskell
+target jobs. They came from the 0.9 narrowing of abstract `Integer` adapter
+results, not from bindings, and are fixed in 0.11
+([release notes](RELEASE-0.11.md#tower-polymorphic-integer-results-restored)).
 
 The runnable assets live in `examples/native-payments/` and are copied into the
 npm package by `tools/wasm.sh`. The original `lawspec examples` command retains its
@@ -996,8 +999,8 @@ The full npm regression suite passes 77 tests, and the package smoke test passes
 installed API generation on all eight targets plus executable Rust scaffold,
 doctor, adapter and regeneration checks. The package contains the binding guide,
 migration notes, release notes and all eight application example configurations.
-These checks do not replace the pending remote CI gate described above. Release
-status remains incomplete until that result has been reviewed.
+The remote CI gate for these checks was reviewed during the 0.11 release, which
+re-ran every target job, including both installed native-binding profiles.
 
 The empty-parameter audit must distinguish an empty type from an inhabited type
 that mentions it. A native factory for `Phantom Empty` may ignore its child
@@ -1042,5 +1045,7 @@ after the empty-parameter changes.
   regeneration protection and packaged installation remain tested.
 - Python follows PEP 8; Rust remains a first-class acceptance target throughout.
 
-GADTs, dependent indices and cross-unit package resolution are subsequent work.
-They are not prerequisites for binding ordinary 0.9 products and sums.
+Dependent indices shipped as natural-indexed families in 0.11. Proof-producing
+indices and cross-unit packages are 0.12 and 0.14 on the
+[roadmap](LANGUAGE.md#roadmap). They are not prerequisites for binding ordinary
+0.9 products and sums.

package/PRIMITIVES.md

@@ -1,4 +1,4 @@
-# LawSpec scalar reference (0.10.0)
+# LawSpec scalar reference (0.12.0)
 
 A scalar has a declared domain, checked literals, equality, property inputs, and
 boundary fixtures. General collections, objects, pointers, and type-only constructs

package/README.md

@@ -2,7 +2,7 @@
 
 **State the law once. Check it everywhere.**
 
-LawSpec 0.10 compiles reusable laws into native property tests, executable examples,
+LawSpec 0.12 compiles reusable laws into native property tests, executable examples,
 and implementation adapters. The compiler is Haskell, distributed as prebuilt
 WebAssembly with a Node CLI and an asynchronous, typed JavaScript API.
 
@@ -47,6 +47,31 @@ the [release notes](RELEASE-0.10.md), and
 [schema 4 migration notes](API-MIGRATION.md#schema-4-native-bindings).
 Existing specifications without bindings retain their behavior.
 
+## Natural-indexed families in 0.11
+
+LawSpec 0.11 adds data indexed by natural numbers, such as length-indexed
+vectors and size-indexed trees. Each constructor states its index equation;
+the compiler elaborates the family to ordinary native data, a checked measure,
+and a refinement. Dependent signatures like
+`append :: (xs :: Vec n a) -> (ys :: Vec m a) -> (r :: Vec (n + m) a)` become
+checked adapter contracts, and generators construct values with a required
+index instead of filtering for it. See the
+[language reference](LANGUAGE.md#natural-indexed-families), the
+[indexed example](examples/specs/indexed_families.lawspec), and the
+[release notes](RELEASE-0.11.md).
+
+## Proved indices and evidence in 0.12
+
+LawSpec 0.12 proves the result indices of checked definitions statically, so a
+definition such as `concatV :: Vec n Int8 -> Vec m Int8 -> Vec (n + m) Int8`
+needs no runtime postcondition. Every contract obligation is reported as
+`proved` or `runtime-checked` by `lawspec check` and the API. See
+[proved indices](LANGUAGE.md#proved-indices-and-evidence) and the
+[release notes](RELEASE-0.12.md).
+
+Planned: 0.13 domain modeling primitives, 0.14 cross-unit packages, and 0.15
+evidence reporting. See the [roadmap](LANGUAGE.md#roadmap).
+
 ## Install and try it
 
 LawSpec has its own [syntax-highlighting grammar and VS Code extension](editors/vscode/README.md)
@@ -56,7 +81,7 @@ support to use it; GitHub currently uses the Haskell fallback.
 Install [LawSpec from npm](https://www.npmjs.com/package/lawspec):
 
 ```sh
-npm install --save-dev lawspec@0.10.0
+npm install --save-dev lawspec@0.12.0
 npx lawspec --version
 ```
 
@@ -70,8 +95,8 @@ local dependencies so LawSpec can create its `package.json` and test script:
 ```sh
 mkdir lawspec-example
 cd lawspec-example
-npm exec --package=lawspec@0.10.0 -- lawspec init --target javascript
-npm install --save-dev lawspec@0.10.0
+npm exec --package=lawspec@0.12.0 -- lawspec init --target javascript
+npm install --save-dev lawspec@0.12.0
 npx lawspec check
 npx lawspec explain 'example.atoi_codec::itoa and then atoi yields a'
 npx lawspec doctor
@@ -281,7 +306,7 @@ reusable laws accept these curried functions, their partial applications, and
 scalar parameters. Quantified test inputs remain scalar.
 
 The prelude defines the following laws. Every row has an executable example in
-[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/algebra.lawspec), including both sides of every
+[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/algebra.lawspec), including both sides of every
 combined law. `f` and `g` are binary operations, `inverse` is unary, and `e` and
 `zero` are scalar parameters. All these laws require equality of the element type.
 
@@ -349,7 +374,7 @@ their entire consequence. Every conjunct is type-checked and emitted. As with
 existing assertions, the first failure stops that individual test. `and` is now
 a reserved word.
 
-[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/currying.lawspec) demonstrate a four-argument
+[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/currying.lawspec) demonstrate a four-argument
 function partially applied twice, a formatter with four heterogeneous arguments,
 and composition after partial application. Each example states its exact outputs.
 Run `node npm/bin/lawspec.mjs examples` after rebuilding to inspect all nine units
@@ -401,7 +426,7 @@ law `valid ports round trip` is
 end
 ```
 
-The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/parse_port.lawspec)
+The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/parse_port.lawspec)
 defines valid ports as 1–65535, and covers both endpoints, ordinary ports, zero,
 negative values, and 65536. All explicit `expect` assertions run regardless of
 the law's condition. A false condition skips only the consequence: invalid ports
@@ -419,7 +444,7 @@ The prelude includes `satisfies predicate` (the predicate holds for every input)
 and `left inverse when predicate parse render` (the guarded round trip above).
 These reusable laws preserve the condition and its lexical bindings when expanded.
 `equivalent` can also compare two predicates, since `Bool` supports equality.
-The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/boolean_flags.lawspec)
+The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/boolean_flags.lawspec)
 checks that flipping twice restores both `false` and `true`; all targets generate
 Boolean property inputs and explicit tests for both Boolean boundary values. Java caps Boolean-only JetCheck runs at the number of
 possible input combinations (up to 100), avoiding generator exhaustion.
@@ -498,7 +523,7 @@ This expands to `for all (x :: Int32) . render (x) = referenceRender (x)`.
 The example inherits the input name `x` from the prelude. Both functions are
 user-owned adapter functions; either may delegate to your existing code.
 
-[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/equivalent.lawspec) compares decimal
+[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/equivalent.lawspec) compares decimal
 renderers and two implementations that clamp negative integers to zero. For
 JavaScript, their adapters can be:
 
@@ -535,7 +560,7 @@ law `normalizers agree` is
 end
 ```
 
-The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/slug.lawspec)
+The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/slug.lawspec)
 compares two implementations of ASCII-space replacement. It includes empty,
 Unicode and escaped text. Each target uses its native string generator:
 JetCheck `Generator.stringsOf(Generator.asciiPrintableChars())`, Hypothesis `st.text()`, fast-check `fc.string()`,
@@ -562,7 +587,7 @@ law `canonicalization reaches a fixed point` is
 end
 ```
 
-The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/canonical_url.lawspec)
+The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/canonical_url.lawspec)
 uses removal of **all trailing slashes** as a small fixed-point demonstration,
 not a complete URL canonicalization algorithm. For JavaScript:
 
@@ -571,7 +596,7 @@ export const canonicalize = value => value.replace(/\/+$/, "");
 ```
 
 Removing just one trailing slash fails the supplied repeated-slash example.
-The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.10.0/examples/specs/mixed_inputs.lawspec)
+The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.12.0/examples/specs/mixed_inputs.lawspec)
 shows `Text` and `Int32` in the same quantified property and executable example.
 The JavaScript API represents example bindings as typed records whose values use
 `DataValue`: lossless tagged scalar payloads or structural constructors. Expected results are
@@ -654,7 +679,7 @@ by the JS shim.
 ## Build and verify
 
 For contributors working from a repository checkout, build a local archive with
-`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.10.0.tgz`.
+`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.12.0.tgz`.
 The package payload lives in `npm/`.
 
 ```sh

package/REFINEMENTS.md

@@ -1,4 +1,4 @@
-# Refinements and abstract integers (0.10.0)
+# Refinements and abstract integers (0.12.0)
 
 A refinement restricts a scalar domain with a pure Boolean expression. LawSpec
 checks concrete examples, generates satisfying input tuples, and checks adapter
@@ -154,6 +154,11 @@ seeds direct comparison values and boundaries, and checks the complete predicate
 Predicates outside that analysis use bounded sampling. Small finite base-domain
 products are enumerated exhaustively, retaining only satisfying tuples.
 
+A refinement `m x == e` over declared data, where `m` is a linear structural
+measure (each branch is a constant plus `m` of that branch's fields), is solved
+rather than sampled: values are constructed with measure exactly `e`. Indexed
+families rely on this; see [natural-indexed families](LANGUAGE.md#natural-indexed-families).
+
 Shrinking checks refinements again and repairs dependent later inputs when an
 earlier value changes. An overflowing counterexample can shrink to `(1, 127)`;
 it cannot shrink to `(0, 127)` because that pair is outside the domain.

package/RELEASE-0.11.md

@@ -0,0 +1,62 @@
+# LawSpec 0.11.0
+
+## Natural-indexed families
+
+Data declarations may take `Natural` parameters, and each constructor states
+its index equation:
+
+```lawspec
+type Vec (n :: Natural) (a :: Type) is
+  | VNil where n = 0
+  | VCons head :: a tail :: Vec m a where n = m + 1
+end
+
+append :: (xs :: Vec n Int8) -> (ys :: Vec m Int8) -> (r :: Vec (n + m) Int8)
+```
+
+A family elaborates before inference into ordinary erased data, a checked
+structural measure per index (`nOfVec`), and a refinement relating the measure
+to the index. Core and all eight emitters are unchanged. Native code works with
+the erased type, and every index claim is evidence checked at test time: a
+dependent result such as `Vec (n + m) Int8` is an adapter postcondition.
+
+An index variable that is otherwise unbound is implicit. The first binder whose
+family type mentions it determines it, and later occurrences read that binder's
+measure. Index expressions are sums of natural literals and index variables.
+`Natural` is also available as a value type. Diagnostics use the `indexed` code.
+
+## Index-directed generation
+
+A quantifier constrained by a linear structural measure, including a fixed index
+(`Vec 3 Int8`) or a shared one (`zip`'s second argument), is generated by solving
+the constructor equations backwards instead of filtering. Multi-field equations
+such as `Bin … where n = l + r + 1` split the remaining index across fields.
+Python, JavaScript, TypeScript, Java, Kotlin, Go, Haskell and Rust construct these
+values natively, and framework shrinking stays within the index. The same
+planning applies to user-written linear measures over declared data.
+
+`examples/specs/indexed_families.lawspec` runs on all eight targets through
+`tools/indexed-integration.mjs`. Correct adapters pass free, fixed and shared
+index laws; mutants that add, drop or lose elements fail their dependent
+contracts.
+
+## Tower-polymorphic Integer results restored
+
+0.9 had narrowed Kotlin and Haskell adapters whose result is the abstract
+`Integer` to `BigInteger` and `Integer`. They again return `Number` (Kotlin) and
+`LS.IntegerValue` (Haskell), as in 0.8 and as Java always did. `Integer` is the top
+of the integral tower: an implementation may return any integral native value,
+and the result bridge rejects non-integral values and checks the logical domain.
+Adapters written against 0.9 or 0.10 stubs that return `BigInteger` or `Integer`
+still compile, because both are integral.
+
+This regression had kept the Kotlin and Haskell CI target jobs failing since
+0.9. Those jobs, and the scalar mutation fixtures, now pass with the documented
+typed Symbol, Decimal, Utf16Text and Optional representations.
+
+## Compatibility
+
+Specifications without indexed families generate the same code as 0.10, apart
+from the Integer result signatures above. API schemas 3 and 4 are unchanged.
+GADTs that refine type arguments, non-linear indices and index equalities between
+sibling fields remain future work.

package/RELEASE-0.12.md

@@ -0,0 +1,47 @@
+# LawSpec 0.12.0
+
+## Proved indices
+
+Checked definitions may return natural-indexed families, and the compiler
+proves their result indices statically:
+
+```lawspec
+definition concatV (xs :: Vec n Int8) (ys :: Vec m Int8) :: Vec (n + m) Int8 is
+  match xs with
+  | VNil -> ys
+  | VCons h t -> VCons h (concatV t ys)
+  end
+end
+```
+
+The totality prover now treats calls of checked definitions as pure linear
+atoms, so equal calls have equal results. A single-argument definition that
+matches on its argument unfolds on a known constructor, so `nOfVec (VCons h t)`
+is `nOfVec t + 1`. Natural measures are non-negative. Together with the existing
+match facts and the induction hypothesis from recursive calls, this proves
+definitions such as `concatV`, and tree flattening through nested calls. It
+rejects definitions whose result indices do not follow, including an unchanged
+length, a dropped element, an extra element and a wrong recursive argument.
+
+## Evidence
+
+Every contract obligation is recorded as `proved` or `runtime-checked`.
+Definition postconditions are proved, and generated code on all eight targets no
+longer re-checks them at runtime. Definition preconditions, which guard native
+callers, and adapter contracts remain runtime-checked. `lawspec check` prints a
+summary, and API responses include an additive `evidence` array; see
+[API migration](API-MIGRATION.md#evidence-in-check-results-012).
+
+The indexed example now includes proved definitions `concatV` and `flattenV`,
+used as reference models for the native `append` and `flatten` adapters. The
+eight-target acceptance runner executes them in both machine profiles and still
+rejects every index-breaking adapter mutant.
+
+## Compatibility
+
+Specifications that compiled with 0.11 compile unchanged. Generated definition
+code omits postcondition checks that are now proved, which changes generated
+output but not behavior. API schemas 3 and 4 are unchanged apart from the
+additive `evidence` field. Index equalities between sibling fields, non-linear
+indices and type-refining GADTs remain open; see the
+[roadmap](LANGUAGE.md#roadmap).

package/bin/lawspec.mjs

@@ -173,13 +173,13 @@ async function main() {
   }
   if (!verb || ["help", "--help", "-h"].includes(verb)) {
     output(
-      "LawSpec 0.10.0\nUsage: lawspec init --target <language> [--project <directory>] [--minify]\n       lawspec check | doctor | explain <unit>::<law> | generate\n       lawspec examples [--example payments] [--target <language>] [--output <directory>]\nOptions: --config <path>, --target <language>, --machine-bits <32|64>, --json\nGeneration: --dry-run, --check, --minify\nTargets: " +
+      "LawSpec 0.12.0\nUsage: lawspec init --target <language> [--project <directory>] [--minify]\n       lawspec check | doctor | explain <unit>::<law> | generate\n       lawspec examples [--example payments] [--target <language>] [--output <directory>]\nOptions: --config <path>, --target <language>, --machine-bits <32|64>, --json\nGeneration: --dry-run, --check, --minify\nTargets: " +
         targets.join(", "),
     );
     return;
   }
   if (verb === "--version") {
-    output("0.10.0");
+    output("0.12.0");
     return;
   }
   if (positional.length > (verb === "explain" ? 1 : 0))
@@ -257,6 +257,12 @@ async function main() {
   if (config.machineBits !== undefined && ![32, 64].includes(config.machineBits)) throw new Error("machineBits must be 32 or 64");
   const input = { sources: await sources(config), generation: config.generation, machineBits: options.machineBits ?? config.machineBits ?? 64 };
   const compiler = await createCompiler();
+  // Proved obligations need no runtime check; the rest are enforced at runtime.
+  const evidenceSummary = (evidence) => {
+    if (!evidence.length) return "";
+    const count = (status) => evidence.filter((item) => item.status === status).length;
+    return ` Evidence: ${count("proved")} proved, ${count("runtime-checked")} runtime-checked obligation(s).`;
+  };
   if (verb === "check") {
     const result = diagnostics(await compiler.check(input));
     for (const target of selected) {
@@ -266,7 +272,7 @@ async function main() {
     output(
       options.json
         ? result
-        : `Checked ${result.laws.length} law(s).`,
+        : `Checked ${result.laws.length} law(s).` + evidenceSummary(result.evidence ?? []),
     );
     return;
   }

package/build.json

@@ -39,6 +39,7 @@
     "src/LawSpec/Core/DefinitionContracts.hs",
     "src/LawSpec/Core/Definitions.hs",
     "src/LawSpec/Core/Eval.hs",
+    "src/LawSpec/Core/Evidence.hs",
     "src/LawSpec/Core/Expression.hs",
     "src/LawSpec/Core/Payload.hs",
     "src/LawSpec/Core/PayloadPlan.hs",
@@ -75,6 +76,7 @@
     "src/LawSpec/HaskellProperties.hs",
     "src/LawSpec/HaskellTestHelpers.hs",
     "src/LawSpec/HaskellTypeRefs.hs",
+    "src/LawSpec/Indexed.hs",
     "src/LawSpec/Inference.hs",
     "src/LawSpec/JavaData.hs",
     "src/LawSpec/JavaDefinitions.hs",
@@ -126,23 +128,23 @@
     "wasm/lawspec-wasm.cabal"
   ],
   "digests": {
-    "lawspec.cabal": "b38f73ab83f833725b64ae4d0df07783efbdeacf367e99e378c18dddbb864f9d",
-    "package.yaml": "c682a129e7fdec4ae5d60d229c622ad05714fd52c6d83a3c44815b232fb4459d",
+    "lawspec.cabal": "dee4969ade96a065c1a527c557575d4041eedd3ae664eb01ec6b568130c5a1fd",
+    "package.yaml": "e92c582f87b1704f80d5e31af7fb6dbe4f56190b8660b55cdb8728ca77efec67",
     "runtime/LawSpecCodecs.hs": "90cb1ed15d7ab664a17a054580c849408d77cfd2b2adcb4a3228b05132caeaca",
-    "runtime/LawSpecDataStrategies.hs": "0b6639d200101bfc3c850278133a7f686bfc3423c81ccc7d82f161847700c914",
-    "runtime/LawSpecDataStrategies.java": "ade2e132f116d261c6e8c198c6f87515193ceda8ab83b1006627eebb72321ed1",
+    "runtime/LawSpecDataStrategies.hs": "cbe9f1946228db1076c19cd3158e8798fe32766cfdbea3f66b63d22d3d217508",
+    "runtime/LawSpecDataStrategies.java": "e3416efe8a0d7b1276cb4d1a8105fd01b1f5f3f02a803bf55d955d9e3ec39095",
     "runtime/LawSpecKotlin.kt": "0cf3b7de0406155225ccca33ee3dfdf8f0456c47d577f6be8f1265c13df838cb",
     "runtime/LawSpecKotlinCodecs.kt": "6210f77dbbe24ba2088db48dae5415abf0993fe552fb3a57d29430807efbc297",
-    "runtime/LawSpecKotlinStrategies.kt": "73deed2d5d13529220147b530743a5f9bee72467e940bb357b2c3152ee6ec4ee",
+    "runtime/LawSpecKotlinStrategies.kt": "c07ef4da5ccdab9045f50f08dbfcc4a7349a505af76bd5d3ddc8c00e879437f3",
     "runtime/LawSpecRuntime.hs": "5ced6a6a86a892ae63a544d4c4a4429bf756a730ea786478d820c8070cc96402",
     "runtime/LawSpecRuntime.java": "c7b7cfc9b7c22b082edee14a52d95ef80ebe01ee56988c22702f629ea24b8a4f",
     "runtime/LawSpecSchema.hs": "9912d9f525426a598f9c03c29cfc7bacf80218f73c9d537d8c1257bae245aa33",
     "runtime/LawSpecSchema.java": "885f5f17a9ea1bdb86915dc184aea25b72c3062d6ddb9605530310540b1cc166",
     "runtime/LawSpecStrategies.kt": "569f7775c0ac44765d05567cbf62d026558ac193c080ca71681ec6ee49c21794",
     "runtime/lawspec_codecs.go": "b3024fe60b3b66df9ebffe995ab5bb0294a609a82c611d54957e092eac29f2f5",
-    "runtime/lawspec_data_strategies.go": "cbddf44fbd222ad39bda3278dd433c6592a90c1808a5c157e02d8be931244c9a",
-    "runtime/lawspec_data_strategies.mjs": "f2e04a8d1b418afa6b8b6a993e222bdd5d84fca800e7f5071157b7888af0907c",
-    "runtime/lawspec_data_strategies.py": "685212fa4ecdde0139336d9fb9a6b8aca15ed5d3eab02c33b4cca4b39ad21eb5",
+    "runtime/lawspec_data_strategies.go": "ec151dbdd1af89f57ce11c10d057d4bbc44691b0472035e0756ced1e0769a640",
+    "runtime/lawspec_data_strategies.mjs": "e74a508bf2cd382ad1ca6bc90b6be19b10170e6261dbb902f58522fa2880c2fc",
+    "runtime/lawspec_data_strategies.py": "3469bab1af47b5fb9583569d0a07f3c2a0485303d79347afe509cf34b6a21296",
     "runtime/lawspec_runtime.go": "af6ef660387b625b3bb5fcd57f06260c821d4f65eda158db44ad12d66e1d70f8",
     "runtime/lawspec_runtime.mjs": "3b7877c1ee523afba30ed24cd452e2a6126d9e741c7675600e867600d7a73f46",
     "runtime/lawspec_runtime.py": "2f780bc92762eb1115f734a36cc224ae34504929b4ff0ec506735cfa9e3ab02b",
@@ -150,9 +152,9 @@
     "runtime/lawspec_schema.go": "bdfb6f2552bfccf56073d52f7cdbe1d784cba2d956c29762d77df7ad6bba8d67",
     "runtime/lawspec_schema.mjs": "60eb4204461eaa2c207fc7c3394014e2a814e4383b7045c065b4dae7c7a202c2",
     "runtime/lawspec_schema.py": "b6967ef1a33fe6a1a180d5573ec37cd8bb2079c06e961ac2eeb05f23cffcdd07",
-    "runtime/lawspec_strategies.rs": "ee2d42c4bc86bf1ccfcd3a8efc5628475829ea2551c4321e217485fca63433fa",
-    "runtime/rust/Cargo.lock": "03b17464317ee1e91281576aab67007cd8956e58a9d22665bc29045acdbbfa4e",
-    "runtime/rust/Cargo.toml": "615f3f40d2901e36b8ca5f2c105863264c93327c939a04f61469c658d352255f",
+    "runtime/lawspec_strategies.rs": "cac9ca301d4614fff9acfe61e7cc5678fabc044edadfa89ec11599b6780dc5f3",
+    "runtime/rust/Cargo.lock": "614c41fad8f762414ea0e6b1de325e0e919f2f7c6a88d85eaa00ae238dc692d5",
+    "runtime/rust/Cargo.toml": "5789d98b6ed2022abf63a4a39aa155981b7819df8d41d86e354ffa7b015bb00b",
     "src/LawSpec/Api.hs": "392f6e8c1a9ae81a95e219ac071e5b4bea03ee330d63b829036f8f54b2eda8a7",
     "src/LawSpec/Backend.hs": "03c3b0cd62467ca677c88d29d7b12b2ab505cc0076d93d1f48fbddb0e9bcf133",
     "src/LawSpec/Capabilities.hs": "e43d4fc3a4481fbb8aa3ff1c3f41f7e7fca5db01bfe256a30162a45d75a00c1c",
@@ -164,6 +166,7 @@
     "src/LawSpec/Core/DefinitionContracts.hs": "b7f60f038b231187ecf898e585ae1a8fb1fc113bb55bad6d1bb2660350fd969e",
     "src/LawSpec/Core/Definitions.hs": "52f024fca59661142f70f9aa7dd2cbdb4892e5d3b1ca8079c878c5a1ba667112",
     "src/LawSpec/Core/Eval.hs": "e1ad8af5b240dd99c3b1126408d2be5f9b42b86ca6189ecd3868680a5119d931",
+    "src/LawSpec/Core/Evidence.hs": "de5b2fe0df0d681a2d6430a8c535293d7e084fe287ab47522dc57d2be857c6bf",
     "src/LawSpec/Core/Expression.hs": "84985f4f685126253d3af7b6b605d80d28fc9aa115bd5e2946f989eeb1355224",
     "src/LawSpec/Core/Payload.hs": "df6a2b250c27c12bb6ac16b84847c52546081d066a3dca7575ed0d743cc13d50",
     "src/LawSpec/Core/PayloadPlan.hs": "f2a7d2dc58c6a0f79707bdc24773bd3aad3a3b8eea2735a8284b2a9f3a4af4a8",
@@ -171,13 +174,13 @@
     "src/LawSpec/Core/Schema.hs": "9a4ec3967803913e6ff43d33e00a1b4b3b8ec0c79dbdbd80ae98101c85bf430f",
     "src/LawSpec/Core/Semantics.hs": "a9d019433e3b9731f8cd0f65ec0ccc53179824bea58247b72df26760b878c2b6",
     "src/LawSpec/Core/Total.hs": "95d2b19ba7fbfd033295504d31f786815384003b3b4d370776860b423cf079dd",
-    "src/LawSpec/Core/Totality.hs": "8f5b5d69f4baaba45301899ef568cbe90133943c3771ba78d492424e9725e7a7",
+    "src/LawSpec/Core/Totality.hs": "a96fc3b9e8be5d18997065b9d09c0f8a2ede4d6ed2974b3bf355967986b0e459",
     "src/LawSpec/Core/Types.hs": "48ed1d197ce7089737895b7279f93437301fcfacff8b3a8dd98ecd7f1cb32b37",
     "src/LawSpec/Core/Validate.hs": "0f045241215e068081d6cd7cf451f0166671bae5fffafda71a2e2320e8014c27",
     "src/LawSpec/Core/Value.hs": "f2b2e4d82491e184d60b1217922b25c57a06cbbaecb2cb6f31174af50268fbc9",
     "src/LawSpec/CoreEmit.hs": "075f06ef1be2437542967b171c535686f33ed4645f6525a93c1024a9fbf68582",
-    "src/LawSpec/CoreNativeScalarEmit.hs": "6caf801922e8969eac7926bef641d950aebf5cd32b2e4b7ce3f6f32f91f41d99",
-    "src/LawSpec/CoreScalarEmit.hs": "ea87bcf97a7be02cb4e83728b9dd4f5fa5a0c461e3f31f89e4d28242c148b43c",
+    "src/LawSpec/CoreNativeScalarEmit.hs": "4082661ba5f8b1b09b4811f62ba767fa1ea401a38dd10011aea442c5a27892af",
+    "src/LawSpec/CoreScalarEmit.hs": "d1a51f7fe9b23817eeac7b50dac70ec02219df66d4b0218c5c9ae5237da244fd",
     "src/LawSpec/Data.hs": "9dbeafa120276b114dad790ec69e617f7ad0c632e3c718962f2f7faf8ca327f4",
     "src/LawSpec/DefinitionTotality.hs": "7671b7efb0cac5d796b074d48b2c10940e5bd0b5df082b926aee694903285efa",
     "src/LawSpec/Domain.hs": "222d15f0012ae630802238a6d7e1ee78d1e718b599f5ebb5a1ddc4e8d29d68c3",
@@ -187,60 +190,61 @@
     "src/LawSpec/Frontend.hs": "fbf091b9c96f5b5361dbf4f65819634c0f8526ff98550d97c434c0d47af7839e",
     "src/LawSpec/Gen.hs": "c76d00fb1f7e9ed2eed7d387f1cd86cf4d12cc57f007abb0e479043b0ed377e6",
     "src/LawSpec/GoData.hs": "35efbfdc1079e777d4760069fa2405a9700bbabab7dc7e3c2c5e0757312ea201",
-    "src/LawSpec/GoDefinitions.hs": "09e9e4b60cfea893d35589cd18bc8a6099789d81e0f57ae5cb018bd95bd4838b",
+    "src/LawSpec/GoDefinitions.hs": "3cb55c22f28443fff73e73c59780bf1977ab9260b8d66c7f19d1b94b40d1397e",
     "src/LawSpec/GoExpr.hs": "da3a7cc0e3d2906886dc44f6b990e72098bb351558bbb31ee335da7382fac58a",
     "src/LawSpec/GoNativeBinding.hs": "1ad8ea4cec6187c7e6005651c0edeec69e196eb329fb958c833da7751225aa1b",
-    "src/LawSpec/GoProperties.hs": "b0b92af071b70058802627bfb971e1b64e05847f27ef0645b2d7325a3867fe1d",
+    "src/LawSpec/GoProperties.hs": "1eee75d852b0a1f8b6fe2cfb1cd3ed7dc57f44ca0ee137697729e8e1583d85fe",
     "src/LawSpec/GoTestHelpers.hs": "dee55ee8505370e932773b8c685f4a1f380129e6f43f8806bf1e82efb99451b1",
     "src/LawSpec/GoTypeRefs.hs": "7f239f5ac3ac8bd21c8f76c328049f7715d8562ee1382befa0a58abd4f15f726",
     "src/LawSpec/HaskellData.hs": "51374f35de2b1d6c78d15597e41e6f0695fe5fdb040cbb35a7d03d23fa3a3179",
-    "src/LawSpec/HaskellDefinitions.hs": "535a8d644d5ddb98c22fa6bdf34cf2baa787aa1f5b900815c621d0d65ede0f0f",
+    "src/LawSpec/HaskellDefinitions.hs": "bc3664771247547900fc65f62147048238c3aa477154ac69d7a6e7568b05b2dd",
     "src/LawSpec/HaskellExpr.hs": "f4144cf2022ef0a3bec6d796ebe7d2f42563e9d25758b9f362cd5545b47e802b",
     "src/LawSpec/HaskellNativeBinding.hs": "9f98aa0c8659b572bd6486a0e29c4692bc6432db8639fa74a09bbf1b771bbfa6",
-    "src/LawSpec/HaskellProperties.hs": "4a7c2aafbb3418e7e926d420d59e810a70e80b8e61a5efaad73d3282038c9d3c",
+    "src/LawSpec/HaskellProperties.hs": "5d64d5f45b86b5bb148383588d69ad717b0e158926b76938cc5cef54ed3adecc",
     "src/LawSpec/HaskellTestHelpers.hs": "51e59b2abc9e85455e3c8e2c6baadb27e5d319081cb730d2ce56be5dc8053897",
     "src/LawSpec/HaskellTypeRefs.hs": "2225b2a5e2ab3662e7202d23b24f4d6db48353b35ae28df8acd2b92fd2b97574",
+    "src/LawSpec/Indexed.hs": "bfb24a4023517acf9f34e6f3327c5623f0e18b1576e5453a43d7a6cd9e691e00",
     "src/LawSpec/Inference.hs": "78285145897f03c3c4adc37acf0f490ea779bab3975fb2830628dae3a152fe38",
     "src/LawSpec/JavaData.hs": "177713377f7a38d69fbfd7891899357fc55782cf1d361f2e9dd5baf8725d4067",
-    "src/LawSpec/JavaDefinitions.hs": "9c0fe11bd4849af09bbe3d941d89ba609a2dabecdc1c8b09b6ddbf69671c8f92",
+    "src/LawSpec/JavaDefinitions.hs": "fc2666e4f9f68b747aa596c0caf0483b9f0a47ec4957bbcd399234e77909588d",
     "src/LawSpec/JavaExpr.hs": "6f237b0fc1eabe2d53c160f4cb781f8b77b478383f1a77ca4ccc8f08ac0dbcd0",
     "src/LawSpec/JavaNativeBinding.hs": "8abbae78959a5cb61b7c6ae1c9071e43d10e26c2f421766d431fa18031f87173",
-    "src/LawSpec/JavaProperties.hs": "ecc1c94bb212d214f1eb8b2897204b65390aad7be858afd8e118e71e28d46bf2",
+    "src/LawSpec/JavaProperties.hs": "d953771df667aa193b110dbc898b0936b9ff5a32f6ebc9d2ff25d44a6cd4dfec",
     "src/LawSpec/JavaTestHelpers.hs": "e6f4b9bbb7e5f07ece6ab1845e12aa661e62e8b926680b11454223fc3ec1523d",
     "src/LawSpec/KotlinData.hs": "7785fc0c091e50010bce3002355f01c1d237fce05bca6a7ce6de6d207737e228",
     "src/LawSpec/KotlinDefinitions.hs": "97d7d407d4bbdb4ce16035d607dbbcb8e3d6f5db513f2123a2c269e3dc6d2b38",
     "src/LawSpec/KotlinExpr.hs": "20312f0774f1d0832a21a19b93c8103e2791ecd32a827d8e9c4f2b4830a996a0",
     "src/LawSpec/KotlinNativeBinding.hs": "1aec7854758f07a4d2288de13931fbb88ef32220f85d3c84fe8233ad67b6d095",
-    "src/LawSpec/KotlinProperties.hs": "9d71af0bd05db95ab4cbd80210730c126f235d5b16dc07ca76c6230119b788c6",
+    "src/LawSpec/KotlinProperties.hs": "ee8c68bc5ee10a601a643356edb1e0a0c50d6e72a4520feaccb716c6f02ac99c",
     "src/LawSpec/KotlinTestHelpers.hs": "74810d65faafc6ed4d64b1fb0596cda4186e586b7144a7441641b798795bc324",
     "src/LawSpec/Model.hs": "1d7ceb7bd66e3d496eef89eaa86403e6896472317ca9a4be86e0c933a7cce403",
     "src/LawSpec/NativeBinding.hs": "33959b0fd432ad4150f3b685f6438e284b801c2a59d9ef3132486a1cc7c8925a",
     "src/LawSpec/NativeRequest.hs": "fb2dc88f42424ca520533700eab68c407a5de83807d1b0d8c976e6c4f3d65212",
-    "src/LawSpec/Parser.hs": "ad11e8f06371e98f295fae0245edceac8142320f054d0c3cb5600bc72588e17e",
+    "src/LawSpec/Parser.hs": "7b11b5cbdc89a2f706623929dbdc61df84e003fac2b48b3bbafee1e2cb87a025",
     "src/LawSpec/PortableGenerator.hs": "69d457e39f539c77fc7a4c08205e75352bbecd9dfdff031a283a39bf44b22d49",
     "src/LawSpec/PortableTestHelpers.hs": "8ba4d87183c8c11f6ef1ce21c170127335797154f29fb97ad3429f032a167fd3",
     "src/LawSpec/Prelude.hs": "b1e155c12f58e7c346551a0c65c5d5af76d045b3f1625977ca2a5d1c97cb8c46",
-    "src/LawSpec/Public.hs": "1b5e6031983cdc81559faea8a9a7e9a7bfab835de90fbf8c89f26844c411563a",
+    "src/LawSpec/Public.hs": "5b986149fd3b6169e4393b8b09e67ddf6923607fb3b6af619a1c9dbd20b0280d",
     "src/LawSpec/PythonData.hs": "07e9bb54a1515f3f4744b7b9bb43633cbdbf07b3f9e35efef511753f97e216d5",
-    "src/LawSpec/PythonDefinitions.hs": "bc7b971be97339f2d9e4962ad98100878266176aeccd2a9dfd014e2db9550bd8",
+    "src/LawSpec/PythonDefinitions.hs": "30f3d2d71a378e194d62261e0fd1baade5a49ac8b5eaac97578ca015a48ce8e4",
     "src/LawSpec/PythonExpr.hs": "23d7d24b5fb4efff9cb63d38c02a93d95744ec79b4565daf1412088fc7c4ba59",
-    "src/LawSpec/PythonNativeBinding.hs": "6b7d7f34ce97fb518aef7413d3f72a3a199c2202f0c25a922d860a21c93acc62",
+    "src/LawSpec/PythonNativeBinding.hs": "4e35ff8781062d0f614e45ea45f98038c8d609ab78bd671cb0a239eaa9db1690",
     "src/LawSpec/PythonTypes.hs": "ef928bfeb4324eb6e53c99cae247cc2fa84816075d81de4589d14abaa326656a",
     "src/LawSpec/Refinement.hs": "8058a9f7e433b4b00ef0966a9ea2be3c91ae93b591ed58a1ffcb792d316193d3",
-    "src/LawSpec/RuntimeSources.hs": "27ee0e26827a9f6fe9bdbaf29447980b0fd3289aa8350fda9996d59218718e79",
+    "src/LawSpec/RuntimeSources.hs": "22c9f7e4f977b4f548363f494c9d66edeb4d3247c7a1e7e7cad470b1059019be",
     "src/LawSpec/RustData.hs": "8fda864335ccb5478c39f56cb714d5275edf36fcbdc2d152bbe94960b644ad98",
-    "src/LawSpec/RustDefinitions.hs": "5d0328a8b17e0cb5067f65d23f0f2cd2a96b92e4b1c3d6e22b7cb08255697177",
-    "src/LawSpec/RustEmit.hs": "e01be4504cde6ebfeae0327a1304e149bd49e2ef5ff96ec0cb9cf718c7041888",
+    "src/LawSpec/RustDefinitions.hs": "8c289e2779d7ed623f3578f20974dd9e2016c67734ee1447ed7f4b7c22caedf9",
+    "src/LawSpec/RustEmit.hs": "0687d8589940e7b39daa953c439009d1416eba7da54e9936d2f5595316744d21",
     "src/LawSpec/RustExpr.hs": "04b2ef81417b811c7b98a98acdadab4e588ca8757964a63ba8dc5936c36479e6",
     "src/LawSpec/RustNativeBinding.hs": "9d08348da571ac335e335e48c1ad4a67108f7bca54119f5960480e97a6d1da84",
     "src/LawSpec/RustNativeGenerators.hs": "a3b1484d9ff0008e4f961aa81d0aa51da57ec0cd7909124e80c98d56aacc8ce9",
     "src/LawSpec/Scalar.hs": "52e61fec81a337bb5b35e9e6f501446cf0b18bffa6c6af2ddc5aeac2d6e07131",
     "src/LawSpec/SpecializeDefinitions.hs": "08f2fe674a5e00d1be396d9edab0dd2c948b7beb12fa99f2a6aba00cbdf01e33",
-    "src/LawSpec/Testing.hs": "db1a427ac2197e447faf2a36eccfe965c58eaa0ba07bc494bf1ba24e4af43ad4",
+    "src/LawSpec/Testing.hs": "7b0a2e58bcef24365883b479b6a5af720cc2ac4c217ae23bb771c2621d82aec3",
     "src/LawSpec/WebData.hs": "919af27be12f63f17762e0c052341ab82dcee5d45951a4fd9c66abead98d1ee0",
-    "src/LawSpec/WebDefinitions.hs": "fd985db70c778c8014b780666ac327018e05260be610fa717b8c5477ba9638b4",
+    "src/LawSpec/WebDefinitions.hs": "d654df765e4bafcb1acdd35058f8a510c2cd81920153c0a75ff1e7e1137c96e5",
     "src/LawSpec/WebExpr.hs": "0389dcd5cf7479dd23ef034b1012de6ebd70bf1dc9e3d90981dfb0ba2702596f",
-    "src/LawSpec/WebNativeBinding.hs": "512c224b8fbe979eac3f490bb035f9371097eb13399bd361c016b397f8c2c777",
+    "src/LawSpec/WebNativeBinding.hs": "465251be1a93d24a775aa57955bb9ec612af7364c53c83017da051f44943eda9",
     "src/LawSpec/WebTypes.hs": "f77ffee1e0c7929964a889fb252c1c5d0977afed94664ffcb0f8770c37b98c70",
     "stack.yaml": "20ccf4d599e355e60b7aa4f814a7cd4299fe2048616cc2e6dbdc22a7bd8cec73",
     "stack.yaml.lock": "ae222b9c81af920c56e50fa4596fa57786e7fa5a7b461390362b2b2ff63818c7",
@@ -248,8 +252,8 @@
     "wasm/app/Exports.hs": "4ecbdac8faa2449e6fc61b93c82e6278fa14374154f29b4dacf0eef433f06a47",
     "wasm/cabal.project": "021e560afdc5eb4cb7169e7119ecb8f92c9ee170245af909c94b612941bff5cc",
     "wasm/cabal.project.freeze": "733dbed3d2ecccb26e874fd58f136296dad772184deb1658c196b5d54a0814dc",
-    "wasm/lawspec-wasm.cabal": "3915e30a899fa1aaaa811c225965bd8b39a25bc639299ae6077587cd09020688",
-    "npm/core.wasm": "6424553b1a5df71da4f7bb54acdd09fd15d6335954df76035e0015de18124faf",
+    "wasm/lawspec-wasm.cabal": "1d3eb3b1ab9845896d0207ecd5c2cde6ffdbf1837b79203a5eec49f62d434c34",
+    "npm/core.wasm": "7a8d98c77d07bd16dec5d8fcd2488f27eac64daaa82d4d9e1643fd93ae4130bc",
     "npm/core_jsffi.js": "88d136efe92f7cff5758c8fec8d9b6bbc9707fe37741cebeeb415fe34ce3d72b",
     "npm/api.mjs": "e93251db289ff0609abaff78ad67f0a9af82508c1141c6a999604f67c56b6e7d",
     "npm/index.d.ts": "2674f8830bd20a2b9ef7dfa99e183598125b6bcc17e8d454e8f7cca1bbd2c9fe"

package/examples/specs/indexed_families.lawspec

@@ -0,0 +1,88 @@
+unit example.indexed
+
+-- A list indexed by its length. Each constructor states how it changes the
+-- index; nOfVec is the checked measure that recomputes it from a value.
+type Vec (n :: Natural) (a :: Type) is
+  | VNil where n = 0
+  | VCons head :: a tail :: Vec m a where n = m + 1
+end
+
+-- A binary tree indexed by its number of values.
+type Tree (n :: Natural) (a :: Type) is
+  | Tip where n = 0
+  | Bin left :: Tree l a value :: a right :: Tree r a where n = l + r + 1
+end
+
+-- Result indices are checked contracts over the native implementations.
+replicate :: (n :: Natural where n < 64) -> (x :: Int8) -> (r :: Vec n Int8)
+append :: (xs :: Vec n Int8) -> (ys :: Vec m Int8) -> (r :: Vec (n + m) Int8)
+zip :: (xs :: Vec n Int8) -> (ys :: Vec n Bool) -> (r :: Vec n Bool)
+flatten :: (tree :: Tree n Int8) -> (r :: Vec n Int8)
+
+-- Checked definitions whose result indices are proved statically, by
+-- structural induction over the constructor equations. They need no runtime
+-- postcondition, and serve as reference models for the native adapters.
+definition concatV (xs :: Vec n Int8) (ys :: Vec m Int8) :: Vec (n + m) Int8 is
+  match xs with
+  | VNil -> ys
+  | VCons h t -> VCons h (concatV t ys)
+  end
+end
+
+definition flattenV (tree :: Tree n Int8) :: Vec n Int8 is
+  match tree with
+  | Tip -> VNil
+  | Bin l v r -> concatV (flattenV l) (VCons v (flattenV r))
+  end
+end
+
+law `append agrees with the proved definition` is
+  definition is
+    `for all` (xs :: Vec n Int8) (ys :: Vec m Int8) . append xs ys = concatV xs ys
+  end
+end
+
+law `flatten agrees with the proved definition` is
+  definition is
+    `for all` (tree :: Tree 4 Int8) . flatten tree = flattenV tree
+  end
+end
+
+law `replicate has the requested length` is
+  definition is
+    `for all` (n :: Natural where n < 16) (x :: Int8) . nOfVec (replicate n x) = n
+  end
+  example `three copies` is
+    n = 3
+    x = 7
+    expect nOfVec (replicate n x) = 3
+  end
+end
+
+law `append adds lengths` is
+  definition is
+    `for all` (xs :: Vec n Int8) (ys :: Vec m Int8) .
+      nOfVec (append xs ys) = n + m
+  end
+end
+
+-- A fixed index is generated directly rather than filtered.
+law `vectors of three elements` is
+  definition is
+    `for all` (xs :: Vec 3 Int8) . nOfVec (append xs xs) = 6
+  end
+end
+
+-- A shared index constrains the second input by the first.
+law `zip preserves a shared length` is
+  definition is
+    `for all` (xs :: Vec n Int8) (ys :: Vec n Bool) . nOfVec (zip xs ys) = n
+  end
+end
+
+-- Generation splits the remaining index across both subtrees.
+law `flattening five values` is
+  definition is
+    `for all` (tree :: Tree 5 Int8) . nOfVec (flatten tree) = 5
+  end
+end

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lawspec",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "State the law once. Check it everywhere.",
   "license": "MIT",
   "type": "module",
@@ -8,6 +8,6 @@
   "bin": { "lawspec": "bin/lawspec.mjs" },
   "exports": { ".": { "types": "./index.d.ts", "import": "./api.mjs" } },
   "types": "index.d.ts",
-  "files": ["*.mjs", "*.json", "index.d.ts", "bin", "core.wasm", "core_jsffi.js", "README.md", "NATIVE-BINDINGS.md", "PRIMITIVES.md", "REFINEMENTS.md", "RUST.md", "JAVA.md", "PYTHON.md", "GO.md", "HASKELL.md", "KOTLIN.md", "WEB.md", "LANGUAGE.md", "API-MIGRATION.md", "RELEASE-0.9.md", "RELEASE-0.10.md", "LICENSE", "starter.lawspec", "examples"],
+  "files": ["*.mjs", "*.json", "index.d.ts", "bin", "core.wasm", "core_jsffi.js", "README.md", "NATIVE-BINDINGS.md", "PRIMITIVES.md", "REFINEMENTS.md", "RUST.md", "JAVA.md", "PYTHON.md", "GO.md", "HASKELL.md", "KOTLIN.md", "WEB.md", "LANGUAGE.md", "API-MIGRATION.md", "RELEASE-0.9.md", "RELEASE-0.10.md", "RELEASE-0.11.md", "RELEASE-0.12.md", "LICENSE", "starter.lawspec", "examples"],
   "scripts": { "test": "node --test test/*.test.mjs" }
 }