lawspec 0.11.0 → 0.13.0

package/API-MIGRATION.md

@@ -278,3 +278,19 @@ Existing factory files remain untouched. Factory signature changes
 use the existing `adapterUpdates` reporting channel. See `NATIVE-BINDINGS.md`
 for grouping, module collision checks, and layout
 migration behavior.
+
+## Evidence in check results (0.12)
+
+Check, expand and generation responses include an additive `evidence` array.
+Each item names the owning unit, the contract `declaration`, the `stage`
+(`precondition` or `postcondition`), a `status` of `proved` or
+`runtime-checked`, a `reason`, and the `claim` as a typed expression. Schemas 3
+and 4 are otherwise unchanged; clients that ignore unknown fields need no
+changes. Generated definition code no longer re-checks proved postconditions.
+
+## Construction evidence (0.13)
+
+`evidence` items may have stage `construction`: a constructor field constraint,
+including a `wrapper` constraint, checked whenever a value is constructed or
+decoded. Its `declaration` is the constructor identity and its `status` is
+`runtime-checked`. The TypeScript API names these records `ObligationEvidence`.

package/LANGUAGE.md

@@ -1,4 +1,4 @@
-# LawSpec language and compiler boundary (0.11)
+# LawSpec language and compiler boundary (0.13)
 
 LawSpec describes portable laws, concrete examples, and adapter contracts. The
 compiler is written in Haskell. Rust is an output backend alongside Java, Python,
@@ -182,6 +182,85 @@ shrinking stays within the index on every target. The same planning applies to
 any user-written measure over declared data whose branches are a constant plus
 the same measure of that branch's fields.
 
+### Proved indices and evidence
+
+Checked definitions may return indexed families. The compiler proves their
+result indices statically, so they need no runtime postcondition:
+
+```lawspec
+definition concatV (xs :: Vec n Int8) (ys :: Vec m Int8) :: Vec (n + m) Int8 is
+  match xs with
+  | VNil -> ys
+  | VCons h t -> VCons h (concatV t ys)
+  end
+end
+```
+
+The proof uses exact linear arithmetic over the measures. A measure applied to a
+known constructor unfolds to that constructor's equation, so `nOfVec (VCons h t)`
+is `nOfVec t + 1`. Within a match branch, the scrutinee's constructor is known.
+Calls of checked definitions are pure, so equal calls have equal results. A
+recursive call contributes its own signature as the induction hypothesis, and
+natural measures are non-negative. A definition whose result index does not
+follow fails with `definition result refinement could not be proved`.
+
+Every contract obligation is recorded with how it is discharged. Definition
+postconditions are `proved`, and generated code omits their runtime checks.
+Definition preconditions guard native callers, and adapter contracts cover
+native code that LawSpec cannot inspect, so both are `runtime-checked`.
+`lawspec check` summarizes the evidence, and the API reports each obligation in
+the `evidence` field. A proved definition is a natural reference model for a
+native adapter, as in `append xs ys = concatV xs ys` in the
+[indexed example](examples/specs/indexed_families.lawspec).
+
+## Domain modeling
+
+### Wrappers and constrained primitives
+
+A `wrapper` gives a primitive or container a domain meaning. It declares a
+distinct nominal type with one field, `value`, and an optional constraint:
+
+```lawspec
+wrapper UnitQuantity is Int32 where value >= 1 && value <= 1000 end
+wrapper OrderId is Text where prelude.length value > 0 end
+wrapper NonEmptyList (a :: Type) is List a where prelude.length value > 0 end
+```
+
+`UnitQuantity` is not interchangeable with `Int32` or with another wrapper over
+`Int32`. Its constructor, `UnitQuantity 5`, checks the constraint, so an invalid
+value cannot be constructed in an example, produced by a generator, or decoded
+from native code. `valueOfUnitQuantity` unwraps it. A wrapper elaborates to a
+single-constructor product with a refined field and a checked definition, and
+its native representation is that product on every target. The constraint is
+reported as a `construction` obligation in the evidence.
+
+### Workflows and state distinctions
+
+A workflow names a pipeline of adapter steps between distinct state types:
+
+```lawspec
+type UnvalidatedOrder is UnvalidatedOrder id :: Text quantity :: Int32 end
+type ValidatedOrder is ValidatedOrder id :: OrderId quantity :: UnitQuantity end
+type PricedOrder is PricedOrder id :: OrderId quantity :: UnitQuantity total :: Int64 end
+
+workflow placeOrder :: UnvalidatedOrder -> Either OrderError PricedOrder is
+  validateOrder :: UnvalidatedOrder -> Either OrderError ValidatedOrder
+  priceOrder :: ValidatedOrder -> Either OrderError PricedOrder
+end
+```
+
+Each step is an ordinary adapter declaration with one input. The compiler checks
+that every step accepts the state the previous step produces, that fallible steps
+(those returning `Either E T`) share one error type, and that the workflow's
+declared result matches: `Either E T` if any step can fail, otherwise `T`. It then
+adds the law `placeOrder composes its steps`: the native workflow must equal the
+railway composition of the native steps, where the first `Left` is the result. A
+step declared again with the same type is shared between workflows.
+
+Because each state is its own type, a `ValidatedOrder` can only hold checked
+values, and a step that needs one cannot be given raw input. See the
+[domain modeling example](examples/specs/domain_modeling.lawspec).
+
 ## Total definitions
 
 A unit can supply an implementation as a checked total definition:
@@ -385,20 +464,58 @@ API schema v3 uses separately defined wire views, with lossless tagged scalar
 values. It does not serialize internal AST constructors. See the
 [API migration guide](API-MIGRATION.md).
 
-## Beyond 0.11
-
-Natural-indexed families are implemented in 0.11 by elaboration to erased data,
-measures and refinements. GADTs that refine type arguments, non-linear or
-non-natural indices, index equalities between sibling fields (such as perfect
-trees whose subtrees share one index), and general dependent types remain future
-work. The Core type model distinguishes type arguments from index arguments, but
-that representation is not a claim that arbitrary dependent programs are
-accepted.
-External type bindings and custom generator bindings are implemented in the
-0.10 release; see [the binding reference](NATIVE-BINDINGS.md) for their
-interface and acceptance status. They configure native representations alongside
-the typed testing plan and do not change source-language typing or equality.
-Cross-unit packages remain future work.
+## Roadmap
+
+0.11 elaborates natural-indexed families to erased data, measures and
+refinements. The Core type model distinguishes type arguments from index
+arguments, but that representation is not a claim that arbitrary dependent
+programs are accepted. External type bindings and custom generator bindings
+(0.10) configure native representations alongside the typed testing plan and do
+not change source-language typing or equality; see
+[the binding reference](NATIVE-BINDINGS.md).
+
+### 0.12 Proof-producing dependent layer (released)
+
+- Index equalities in checked definitions are discharged statically. Adapter
+  results remain runtime-checked.
+- Linear `Natural` arithmetic over measures is solved exactly, with unfolding
+  on known constructors and induction through recursive calls.
+- Evidence is recorded for every contract obligation as `proved` or
+  `runtime-checked`, and reported by `lawspec check` and the API.
+- Proved definition postconditions produce no runtime checks.
+- Checked definitions may return indexed families. See
+  [proved indices](#proved-indices-and-evidence).
+
+Still open, for evaluation in later releases: index equalities between sibling
+fields (perfect trees whose subtrees share one index), non-linear indices, and
+GADTs that refine type arguments.
+
+### 0.13 Wlaschin-style domain modeling primitives (released)
+
+- Semantic wrappers and constrained primitives: `wrapper` declarations with
+  checked constructors.
+- Illegal states are unrepresentable: wrapper and field constraints are checked
+  on construction, generation and native decoding, and reported as evidence.
+- Explicit domain workflows and state distinctions: `workflow` declarations with
+  checked step types and a generated railway composition law.
+- See [domain modeling](#domain-modeling).
+
+### 0.14 Cross-unit imports and packages
+
+- Reusable law, type and refinement libraries.
+- Versioning and namespacing, including constructor names scoped to their unit.
+  Today every unit compiled together needs distinct constructor names.
+- Publishable behavioral contracts.
+
+### 0.15 Evidence/discharge model
+
+Each obligation reports how it was discharged:
+
+- `PROVED`: discharged statically, by 0.12 evidence or definition proofs.
+- `EXHAUSTIVELY CHECKED`: every value of a finite domain was checked.
+- `PROPERTY TESTED`: generated cases, examples and boundaries.
+- `RUNTIME CHECKED`: adapter contracts and checked codecs at native boundaries.
+- `ASSUMED / EXTERNAL`: native adapters and bindings taken on trust.
 
 ## Generated project formatting
 

package/NATIVE-BINDINGS.md

@@ -1045,5 +1045,7 @@ after the empty-parameter changes.
   regeneration protection and packaged installation remain tested.
 - Python follows PEP 8; Rust remains a first-class acceptance target throughout.
 
-GADTs, dependent indices and cross-unit package resolution are subsequent work.
-They are not prerequisites for binding ordinary 0.9 products and sums.
+Dependent indices shipped as natural-indexed families in 0.11. Proof-producing
+indices and cross-unit packages are 0.12 and 0.14 on the
+[roadmap](LANGUAGE.md#roadmap). They are not prerequisites for binding ordinary
+0.9 products and sums.

package/PRIMITIVES.md

@@ -1,4 +1,4 @@
-# LawSpec scalar reference (0.11.0)
+# LawSpec scalar reference (0.13.0)
 
 A scalar has a declared domain, checked literals, equality, property inputs, and
 boundary fixtures. General collections, objects, pointers, and type-only constructs

package/README.md

@@ -2,7 +2,7 @@
 
 **State the law once. Check it everywhere.**
 
-LawSpec 0.11 compiles reusable laws into native property tests, executable examples,
+LawSpec 0.13 compiles reusable laws into native property tests, executable examples,
 and implementation adapters. The compiler is Haskell, distributed as prebuilt
 WebAssembly with a Node CLI and an asynchronous, typed JavaScript API.
 
@@ -60,6 +60,28 @@ index instead of filtering for it. See the
 [indexed example](examples/specs/indexed_families.lawspec), and the
 [release notes](RELEASE-0.11.md).
 
+## Proved indices and evidence in 0.12
+
+LawSpec 0.12 proves the result indices of checked definitions statically, so a
+definition such as `concatV :: Vec n Int8 -> Vec m Int8 -> Vec (n + m) Int8`
+needs no runtime postcondition. Every contract obligation is reported as
+`proved` or `runtime-checked` by `lawspec check` and the API. See
+[proved indices](LANGUAGE.md#proved-indices-and-evidence) and the
+[release notes](RELEASE-0.12.md).
+
+## Domain modeling in 0.13
+
+LawSpec 0.13 adds `wrapper` declarations for constrained primitives, such as a
+`UnitQuantity` that cannot hold 0, and `workflow` declarations for typed
+pipelines between domain states, with a generated law that the workflow is the
+railway composition of its steps. See
+[domain modeling](LANGUAGE.md#domain-modeling), the
+[example](examples/specs/domain_modeling.lawspec) and the
+[release notes](RELEASE-0.13.md).
+
+Planned: 0.14 cross-unit packages and 0.15 evidence reporting. See the
+[roadmap](LANGUAGE.md#roadmap).
+
 ## Install and try it
 
 LawSpec has its own [syntax-highlighting grammar and VS Code extension](editors/vscode/README.md)
@@ -69,7 +91,7 @@ support to use it; GitHub currently uses the Haskell fallback.
 Install [LawSpec from npm](https://www.npmjs.com/package/lawspec):
 
 ```sh
-npm install --save-dev lawspec@0.11.0
+npm install --save-dev lawspec@0.13.0
 npx lawspec --version
 ```
 
@@ -83,8 +105,8 @@ local dependencies so LawSpec can create its `package.json` and test script:
 ```sh
 mkdir lawspec-example
 cd lawspec-example
-npm exec --package=lawspec@0.11.0 -- lawspec init --target javascript
-npm install --save-dev lawspec@0.11.0
+npm exec --package=lawspec@0.13.0 -- lawspec init --target javascript
+npm install --save-dev lawspec@0.13.0
 npx lawspec check
 npx lawspec explain 'example.atoi_codec::itoa and then atoi yields a'
 npx lawspec doctor
@@ -294,7 +316,7 @@ reusable laws accept these curried functions, their partial applications, and
 scalar parameters. Quantified test inputs remain scalar.
 
 The prelude defines the following laws. Every row has an executable example in
-[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/algebra.lawspec), including both sides of every
+[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/algebra.lawspec), including both sides of every
 combined law. `f` and `g` are binary operations, `inverse` is unary, and `e` and
 `zero` are scalar parameters. All these laws require equality of the element type.
 
@@ -362,7 +384,7 @@ their entire consequence. Every conjunct is type-checked and emitted. As with
 existing assertions, the first failure stops that individual test. `and` is now
 a reserved word.
 
-[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/currying.lawspec) demonstrate a four-argument
+[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/currying.lawspec) demonstrate a four-argument
 function partially applied twice, a formatter with four heterogeneous arguments,
 and composition after partial application. Each example states its exact outputs.
 Run `node npm/bin/lawspec.mjs examples` after rebuilding to inspect all nine units
@@ -414,7 +436,7 @@ law `valid ports round trip` is
 end
 ```
 
-The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/parse_port.lawspec)
+The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/parse_port.lawspec)
 defines valid ports as 1–65535, and covers both endpoints, ordinary ports, zero,
 negative values, and 65536. All explicit `expect` assertions run regardless of
 the law's condition. A false condition skips only the consequence: invalid ports
@@ -432,7 +454,7 @@ The prelude includes `satisfies predicate` (the predicate holds for every input)
 and `left inverse when predicate parse render` (the guarded round trip above).
 These reusable laws preserve the condition and its lexical bindings when expanded.
 `equivalent` can also compare two predicates, since `Bool` supports equality.
-The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/boolean_flags.lawspec)
+The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/boolean_flags.lawspec)
 checks that flipping twice restores both `false` and `true`; all targets generate
 Boolean property inputs and explicit tests for both Boolean boundary values. Java caps Boolean-only JetCheck runs at the number of
 possible input combinations (up to 100), avoiding generator exhaustion.
@@ -511,7 +533,7 @@ This expands to `for all (x :: Int32) . render (x) = referenceRender (x)`.
 The example inherits the input name `x` from the prelude. Both functions are
 user-owned adapter functions; either may delegate to your existing code.
 
-[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/equivalent.lawspec) compares decimal
+[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/equivalent.lawspec) compares decimal
 renderers and two implementations that clamp negative integers to zero. For
 JavaScript, their adapters can be:
 
@@ -548,7 +570,7 @@ law `normalizers agree` is
 end
 ```
 
-The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/slug.lawspec)
+The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/slug.lawspec)
 compares two implementations of ASCII-space replacement. It includes empty,
 Unicode and escaped text. Each target uses its native string generator:
 JetCheck `Generator.stringsOf(Generator.asciiPrintableChars())`, Hypothesis `st.text()`, fast-check `fc.string()`,
@@ -575,7 +597,7 @@ law `canonicalization reaches a fixed point` is
 end
 ```
 
-The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/canonical_url.lawspec)
+The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/canonical_url.lawspec)
 uses removal of **all trailing slashes** as a small fixed-point demonstration,
 not a complete URL canonicalization algorithm. For JavaScript:
 
@@ -584,7 +606,7 @@ export const canonicalize = value => value.replace(/\/+$/, "");
 ```
 
 Removing just one trailing slash fails the supplied repeated-slash example.
-The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.11.0/examples/specs/mixed_inputs.lawspec)
+The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.13.0/examples/specs/mixed_inputs.lawspec)
 shows `Text` and `Int32` in the same quantified property and executable example.
 The JavaScript API represents example bindings as typed records whose values use
 `DataValue`: lossless tagged scalar payloads or structural constructors. Expected results are
@@ -667,7 +689,7 @@ by the JS shim.
 ## Build and verify
 
 For contributors working from a repository checkout, build a local archive with
-`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.11.0.tgz`.
+`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.13.0.tgz`.
 The package payload lives in `npm/`.
 
 ```sh

package/REFINEMENTS.md

@@ -1,4 +1,4 @@
-# Refinements and abstract integers (0.11.0)
+# Refinements and abstract integers (0.13.0)
 
 A refinement restricts a scalar domain with a pure Boolean expression. LawSpec
 checks concrete examples, generates satisfying input tuples, and checks adapter

package/RELEASE-0.12.md

@@ -0,0 +1,47 @@
+# LawSpec 0.12.0
+
+## Proved indices
+
+Checked definitions may return natural-indexed families, and the compiler
+proves their result indices statically:
+
+```lawspec
+definition concatV (xs :: Vec n Int8) (ys :: Vec m Int8) :: Vec (n + m) Int8 is
+  match xs with
+  | VNil -> ys
+  | VCons h t -> VCons h (concatV t ys)
+  end
+end
+```
+
+The totality prover now treats calls of checked definitions as pure linear
+atoms, so equal calls have equal results. A single-argument definition that
+matches on its argument unfolds on a known constructor, so `nOfVec (VCons h t)`
+is `nOfVec t + 1`. Natural measures are non-negative. Together with the existing
+match facts and the induction hypothesis from recursive calls, this proves
+definitions such as `concatV`, and tree flattening through nested calls. It
+rejects definitions whose result indices do not follow, including an unchanged
+length, a dropped element, an extra element and a wrong recursive argument.
+
+## Evidence
+
+Every contract obligation is recorded as `proved` or `runtime-checked`.
+Definition postconditions are proved, and generated code on all eight targets no
+longer re-checks them at runtime. Definition preconditions, which guard native
+callers, and adapter contracts remain runtime-checked. `lawspec check` prints a
+summary, and API responses include an additive `evidence` array; see
+[API migration](API-MIGRATION.md#evidence-in-check-results-012).
+
+The indexed example now includes proved definitions `concatV` and `flattenV`,
+used as reference models for the native `append` and `flatten` adapters. The
+eight-target acceptance runner executes them in both machine profiles and still
+rejects every index-breaking adapter mutant.
+
+## Compatibility
+
+Specifications that compiled with 0.11 compile unchanged. Generated definition
+code omits postcondition checks that are now proved, which changes generated
+output but not behavior. API schemas 3 and 4 are unchanged apart from the
+additive `evidence` field. Index equalities between sibling fields, non-linear
+indices and type-refining GADTs remain open; see the
+[roadmap](LANGUAGE.md#roadmap).

package/RELEASE-0.13.md

@@ -0,0 +1,55 @@
+# LawSpec 0.13.0
+
+## Wrappers and constrained primitives
+
+```lawspec
+wrapper UnitQuantity is Int32 where value >= 1 && value <= 1000 end
+wrapper NonEmptyList (a :: Type) is List a where prelude.length value > 0 end
+```
+
+A wrapper declares a distinct nominal type with one field, `value`, and an
+optional constraint. Its constructor checks the constraint, so an invalid value
+cannot be constructed in an example (the compiler rejects `UnitQuantity 0`),
+produced by a generator, or decoded from native code. `valueOf<Name>` unwraps a
+value. Wrappers may take type parameters. They elaborate to a single-constructor
+product with a refined field, so all eight targets represent them natively with
+no new runtime machinery.
+
+## Workflows and state distinctions
+
+```lawspec
+workflow placeOrder :: UnvalidatedOrder -> Either OrderError PricedOrder is
+  validateOrder :: UnvalidatedOrder -> Either OrderError ValidatedOrder
+  priceOrder :: ValidatedOrder -> Either OrderError PricedOrder
+end
+```
+
+A workflow declares its steps as adapters and checks the pipeline: each step
+must accept the previous step's state, and fallible steps must share an error
+type. The workflow's result must match `Either E T` when any step can fail, or
+`T` otherwise. The compiler adds the law `placeOrder composes its steps`: the
+native workflow must equal the railway composition of the native steps.
+Diagnostics name the step and the mismatched types, with the workflow's source
+location.
+
+## Evidence
+
+Constructor field constraints, including wrapper constraints, appear in the
+evidence as `construction` obligations with status `runtime-checked`, next to
+the contract obligations introduced in 0.12. The TypeScript API declares these
+records as `ObligationEvidence`; the 0.12 typing was not published.
+
+## Examples and acceptance
+
+`examples/specs/domain_modeling.lawspec` combines wrappers, a parameterized
+`NonEmptyList`, order states and the workflow. `tools/domain-integration.mjs`
+runs it on all eight targets in both machine profiles. Correct adapters pass;
+mutants that break a wrapper invariant, the railway composition, or a non-empty
+list operation fail. The example runners now share
+`tools/example-acceptance.mjs`.
+
+## Compatibility
+
+`wrapper` and `workflow` begin new declarations. Specifications that do not use
+them compile as in 0.12. API schemas 3 and 4 are unchanged, apart from the
+additive `construction` stage in `evidence`.

package/bin/lawspec.mjs

@@ -173,13 +173,13 @@ async function main() {
   }
   if (!verb || ["help", "--help", "-h"].includes(verb)) {
     output(
-      "LawSpec 0.11.0\nUsage: lawspec init --target <language> [--project <directory>] [--minify]\n       lawspec check | doctor | explain <unit>::<law> | generate\n       lawspec examples [--example payments] [--target <language>] [--output <directory>]\nOptions: --config <path>, --target <language>, --machine-bits <32|64>, --json\nGeneration: --dry-run, --check, --minify\nTargets: " +
+      "LawSpec 0.13.0\nUsage: lawspec init --target <language> [--project <directory>] [--minify]\n       lawspec check | doctor | explain <unit>::<law> | generate\n       lawspec examples [--example payments] [--target <language>] [--output <directory>]\nOptions: --config <path>, --target <language>, --machine-bits <32|64>, --json\nGeneration: --dry-run, --check, --minify\nTargets: " +
         targets.join(", "),
     );
     return;
   }
   if (verb === "--version") {
-    output("0.11.0");
+    output("0.13.0");
     return;
   }
   if (positional.length > (verb === "explain" ? 1 : 0))
@@ -257,6 +257,12 @@ async function main() {
   if (config.machineBits !== undefined && ![32, 64].includes(config.machineBits)) throw new Error("machineBits must be 32 or 64");
   const input = { sources: await sources(config), generation: config.generation, machineBits: options.machineBits ?? config.machineBits ?? 64 };
   const compiler = await createCompiler();
+  // Proved obligations need no runtime check; the rest are enforced at runtime.
+  const evidenceSummary = (evidence) => {
+    if (!evidence.length) return "";
+    const count = (status) => evidence.filter((item) => item.status === status).length;
+    return ` Evidence: ${count("proved")} proved, ${count("runtime-checked")} runtime-checked obligation(s).`;
+  };
   if (verb === "check") {
     const result = diagnostics(await compiler.check(input));
     for (const target of selected) {
@@ -266,7 +272,7 @@ async function main() {
     output(
       options.json
         ? result
-        : `Checked ${result.laws.length} law(s).`,
+        : `Checked ${result.laws.length} law(s).` + evidenceSummary(result.evidence ?? []),
     );
     return;
   }

package/build.json

@@ -39,6 +39,7 @@
     "src/LawSpec/Core/DefinitionContracts.hs",
     "src/LawSpec/Core/Definitions.hs",
     "src/LawSpec/Core/Eval.hs",
+    "src/LawSpec/Core/Evidence.hs",
     "src/LawSpec/Core/Expression.hs",
     "src/LawSpec/Core/Payload.hs",
     "src/LawSpec/Core/PayloadPlan.hs",
@@ -56,6 +57,7 @@
     "src/LawSpec/Data.hs",
     "src/LawSpec/DefinitionTotality.hs",
     "src/LawSpec/Domain.hs",
+    "src/LawSpec/DomainModel.hs",
     "src/LawSpec/Elaboration.hs",
     "src/LawSpec/Emit.hs",
     "src/LawSpec/Eval.hs",
@@ -127,8 +129,8 @@
     "wasm/lawspec-wasm.cabal"
   ],
   "digests": {
-    "lawspec.cabal": "e250011f2652a4a00c937de6a46763c51e674859db1bd45228d6c560454fc8ec",
-    "package.yaml": "012f2333a714b4a4c542245250cdc1a1da3620215dcb5379eda9f3ffc3067fea",
+    "lawspec.cabal": "2aab726a6d4e9c64e218c0563d52fab738b0753f9597683b9d650dde1baa948c",
+    "package.yaml": "95807129285b33f8ac2bf7452aae1ee049f8f7711f0dc9f962fdf9586b58fcc8",
     "runtime/LawSpecCodecs.hs": "90cb1ed15d7ab664a17a054580c849408d77cfd2b2adcb4a3228b05132caeaca",
     "runtime/LawSpecDataStrategies.hs": "cbe9f1946228db1076c19cd3158e8798fe32766cfdbea3f66b63d22d3d217508",
     "runtime/LawSpecDataStrategies.java": "e3416efe8a0d7b1276cb4d1a8105fd01b1f5f3f02a803bf55d955d9e3ec39095",
@@ -152,8 +154,8 @@
     "runtime/lawspec_schema.mjs": "60eb4204461eaa2c207fc7c3394014e2a814e4383b7045c065b4dae7c7a202c2",
     "runtime/lawspec_schema.py": "b6967ef1a33fe6a1a180d5573ec37cd8bb2079c06e961ac2eeb05f23cffcdd07",
     "runtime/lawspec_strategies.rs": "cac9ca301d4614fff9acfe61e7cc5678fabc044edadfa89ec11599b6780dc5f3",
-    "runtime/rust/Cargo.lock": "a541c57b690f3ece7c0aecb3aef3f1a991a760d3aa04018a8bec9d4567978170",
-    "runtime/rust/Cargo.toml": "6929f520456dcb6a702bcf40df08c8caeaee41b304b06deb07f86221d378e940",
+    "runtime/rust/Cargo.lock": "deb6b268124278aa237f64c8e821caf2388ccda3df92c2e814a5863331ae8c92",
+    "runtime/rust/Cargo.toml": "ed36668f25943b9c8a3ea9eb5a805f2953540aabb763919029947d342cc23978",
     "src/LawSpec/Api.hs": "392f6e8c1a9ae81a95e219ac071e5b4bea03ee330d63b829036f8f54b2eda8a7",
     "src/LawSpec/Backend.hs": "03c3b0cd62467ca677c88d29d7b12b2ab505cc0076d93d1f48fbddb0e9bcf133",
     "src/LawSpec/Capabilities.hs": "e43d4fc3a4481fbb8aa3ff1c3f41f7e7fca5db01bfe256a30162a45d75a00c1c",
@@ -165,6 +167,7 @@
     "src/LawSpec/Core/DefinitionContracts.hs": "b7f60f038b231187ecf898e585ae1a8fb1fc113bb55bad6d1bb2660350fd969e",
     "src/LawSpec/Core/Definitions.hs": "52f024fca59661142f70f9aa7dd2cbdb4892e5d3b1ca8079c878c5a1ba667112",
     "src/LawSpec/Core/Eval.hs": "e1ad8af5b240dd99c3b1126408d2be5f9b42b86ca6189ecd3868680a5119d931",
+    "src/LawSpec/Core/Evidence.hs": "460af282299258c87ddba58b55ad09290d7d89e6e7d43a02f5470fbd5b7974a3",
     "src/LawSpec/Core/Expression.hs": "84985f4f685126253d3af7b6b605d80d28fc9aa115bd5e2946f989eeb1355224",
     "src/LawSpec/Core/Payload.hs": "df6a2b250c27c12bb6ac16b84847c52546081d066a3dca7575ed0d743cc13d50",
     "src/LawSpec/Core/PayloadPlan.hs": "f2a7d2dc58c6a0f79707bdc24773bd3aad3a3b8eea2735a8284b2a9f3a4af4a8",
@@ -172,7 +175,7 @@
     "src/LawSpec/Core/Schema.hs": "9a4ec3967803913e6ff43d33e00a1b4b3b8ec0c79dbdbd80ae98101c85bf430f",
     "src/LawSpec/Core/Semantics.hs": "a9d019433e3b9731f8cd0f65ec0ccc53179824bea58247b72df26760b878c2b6",
     "src/LawSpec/Core/Total.hs": "95d2b19ba7fbfd033295504d31f786815384003b3b4d370776860b423cf079dd",
-    "src/LawSpec/Core/Totality.hs": "8f5b5d69f4baaba45301899ef568cbe90133943c3771ba78d492424e9725e7a7",
+    "src/LawSpec/Core/Totality.hs": "a96fc3b9e8be5d18997065b9d09c0f8a2ede4d6ed2974b3bf355967986b0e459",
     "src/LawSpec/Core/Types.hs": "48ed1d197ce7089737895b7279f93437301fcfacff8b3a8dd98ecd7f1cb32b37",
     "src/LawSpec/Core/Validate.hs": "0f045241215e068081d6cd7cf451f0166671bae5fffafda71a2e2320e8014c27",
     "src/LawSpec/Core/Value.hs": "f2b2e4d82491e184d60b1217922b25c57a06cbbaecb2cb6f31174af50268fbc9",
@@ -182,20 +185,21 @@
     "src/LawSpec/Data.hs": "9dbeafa120276b114dad790ec69e617f7ad0c632e3c718962f2f7faf8ca327f4",
     "src/LawSpec/DefinitionTotality.hs": "7671b7efb0cac5d796b074d48b2c10940e5bd0b5df082b926aee694903285efa",
     "src/LawSpec/Domain.hs": "222d15f0012ae630802238a6d7e1ee78d1e718b599f5ebb5a1ddc4e8d29d68c3",
+    "src/LawSpec/DomainModel.hs": "3be67117c44e66a39d42d7ce094c2940c48ea1541017b64027afa6ea4b77092f",
     "src/LawSpec/Elaboration.hs": "86e3ef77a977cb1b55985e2939648135acd0c2c015afe76e34e09615d555f53e",
     "src/LawSpec/Emit.hs": "9f34f5765915a2a12a66a6dca647ddaef9289372956802c6d99cf0cfec447c7a",
     "src/LawSpec/Eval.hs": "b0872ba8a6974463b32776653c2939826a6be87318c15641401f913f6b139de2",
     "src/LawSpec/Frontend.hs": "fbf091b9c96f5b5361dbf4f65819634c0f8526ff98550d97c434c0d47af7839e",
     "src/LawSpec/Gen.hs": "c76d00fb1f7e9ed2eed7d387f1cd86cf4d12cc57f007abb0e479043b0ed377e6",
     "src/LawSpec/GoData.hs": "35efbfdc1079e777d4760069fa2405a9700bbabab7dc7e3c2c5e0757312ea201",
-    "src/LawSpec/GoDefinitions.hs": "09e9e4b60cfea893d35589cd18bc8a6099789d81e0f57ae5cb018bd95bd4838b",
+    "src/LawSpec/GoDefinitions.hs": "3cb55c22f28443fff73e73c59780bf1977ab9260b8d66c7f19d1b94b40d1397e",
     "src/LawSpec/GoExpr.hs": "da3a7cc0e3d2906886dc44f6b990e72098bb351558bbb31ee335da7382fac58a",
     "src/LawSpec/GoNativeBinding.hs": "1ad8ea4cec6187c7e6005651c0edeec69e196eb329fb958c833da7751225aa1b",
     "src/LawSpec/GoProperties.hs": "1eee75d852b0a1f8b6fe2cfb1cd3ed7dc57f44ca0ee137697729e8e1583d85fe",
     "src/LawSpec/GoTestHelpers.hs": "dee55ee8505370e932773b8c685f4a1f380129e6f43f8806bf1e82efb99451b1",
     "src/LawSpec/GoTypeRefs.hs": "7f239f5ac3ac8bd21c8f76c328049f7715d8562ee1382befa0a58abd4f15f726",
     "src/LawSpec/HaskellData.hs": "51374f35de2b1d6c78d15597e41e6f0695fe5fdb040cbb35a7d03d23fa3a3179",
-    "src/LawSpec/HaskellDefinitions.hs": "535a8d644d5ddb98c22fa6bdf34cf2baa787aa1f5b900815c621d0d65ede0f0f",
+    "src/LawSpec/HaskellDefinitions.hs": "bc3664771247547900fc65f62147048238c3aa477154ac69d7a6e7568b05b2dd",
     "src/LawSpec/HaskellExpr.hs": "f4144cf2022ef0a3bec6d796ebe7d2f42563e9d25758b9f362cd5545b47e802b",
     "src/LawSpec/HaskellNativeBinding.hs": "9f98aa0c8659b572bd6486a0e29c4692bc6432db8639fa74a09bbf1b771bbfa6",
     "src/LawSpec/HaskellProperties.hs": "5d64d5f45b86b5bb148383588d69ad717b0e158926b76938cc5cef54ed3adecc",
@@ -204,7 +208,7 @@
     "src/LawSpec/Indexed.hs": "bfb24a4023517acf9f34e6f3327c5623f0e18b1576e5453a43d7a6cd9e691e00",
     "src/LawSpec/Inference.hs": "78285145897f03c3c4adc37acf0f490ea779bab3975fb2830628dae3a152fe38",
     "src/LawSpec/JavaData.hs": "177713377f7a38d69fbfd7891899357fc55782cf1d361f2e9dd5baf8725d4067",
-    "src/LawSpec/JavaDefinitions.hs": "9c0fe11bd4849af09bbe3d941d89ba609a2dabecdc1c8b09b6ddbf69671c8f92",
+    "src/LawSpec/JavaDefinitions.hs": "fc2666e4f9f68b747aa596c0caf0483b9f0a47ec4957bbcd399234e77909588d",
     "src/LawSpec/JavaExpr.hs": "6f237b0fc1eabe2d53c160f4cb781f8b77b478383f1a77ca4ccc8f08ac0dbcd0",
     "src/LawSpec/JavaNativeBinding.hs": "8abbae78959a5cb61b7c6ae1c9071e43d10e26c2f421766d431fa18031f87173",
     "src/LawSpec/JavaProperties.hs": "d953771df667aa193b110dbc898b0936b9ff5a32f6ebc9d2ff25d44a6cd4dfec",
@@ -218,20 +222,20 @@
     "src/LawSpec/Model.hs": "1d7ceb7bd66e3d496eef89eaa86403e6896472317ca9a4be86e0c933a7cce403",
     "src/LawSpec/NativeBinding.hs": "33959b0fd432ad4150f3b685f6438e284b801c2a59d9ef3132486a1cc7c8925a",
     "src/LawSpec/NativeRequest.hs": "fb2dc88f42424ca520533700eab68c407a5de83807d1b0d8c976e6c4f3d65212",
-    "src/LawSpec/Parser.hs": "7b11b5cbdc89a2f706623929dbdc61df84e003fac2b48b3bbafee1e2cb87a025",
+    "src/LawSpec/Parser.hs": "94a5603f6831d1dad5634a766bbc02cc58d884d23b5d6606ed4a1537cfe4c813",
     "src/LawSpec/PortableGenerator.hs": "69d457e39f539c77fc7a4c08205e75352bbecd9dfdff031a283a39bf44b22d49",
     "src/LawSpec/PortableTestHelpers.hs": "8ba4d87183c8c11f6ef1ce21c170127335797154f29fb97ad3429f032a167fd3",
     "src/LawSpec/Prelude.hs": "b1e155c12f58e7c346551a0c65c5d5af76d045b3f1625977ca2a5d1c97cb8c46",
-    "src/LawSpec/Public.hs": "1b5e6031983cdc81559faea8a9a7e9a7bfab835de90fbf8c89f26844c411563a",
+    "src/LawSpec/Public.hs": "ca7f3edd3e5d623ecb1aecb2386fdcf4b1e334cf7bd7770b6a14f5690d8f5ed5",
     "src/LawSpec/PythonData.hs": "07e9bb54a1515f3f4744b7b9bb43633cbdbf07b3f9e35efef511753f97e216d5",
-    "src/LawSpec/PythonDefinitions.hs": "bc7b971be97339f2d9e4962ad98100878266176aeccd2a9dfd014e2db9550bd8",
+    "src/LawSpec/PythonDefinitions.hs": "30f3d2d71a378e194d62261e0fd1baade5a49ac8b5eaac97578ca015a48ce8e4",
     "src/LawSpec/PythonExpr.hs": "23d7d24b5fb4efff9cb63d38c02a93d95744ec79b4565daf1412088fc7c4ba59",
     "src/LawSpec/PythonNativeBinding.hs": "4e35ff8781062d0f614e45ea45f98038c8d609ab78bd671cb0a239eaa9db1690",
     "src/LawSpec/PythonTypes.hs": "ef928bfeb4324eb6e53c99cae247cc2fa84816075d81de4589d14abaa326656a",
     "src/LawSpec/Refinement.hs": "8058a9f7e433b4b00ef0966a9ea2be3c91ae93b591ed58a1ffcb792d316193d3",
     "src/LawSpec/RuntimeSources.hs": "22c9f7e4f977b4f548363f494c9d66edeb4d3247c7a1e7e7cad470b1059019be",
     "src/LawSpec/RustData.hs": "8fda864335ccb5478c39f56cb714d5275edf36fcbdc2d152bbe94960b644ad98",
-    "src/LawSpec/RustDefinitions.hs": "5d0328a8b17e0cb5067f65d23f0f2cd2a96b92e4b1c3d6e22b7cb08255697177",
+    "src/LawSpec/RustDefinitions.hs": "8c289e2779d7ed623f3578f20974dd9e2016c67734ee1447ed7f4b7c22caedf9",
     "src/LawSpec/RustEmit.hs": "0687d8589940e7b39daa953c439009d1416eba7da54e9936d2f5595316744d21",
     "src/LawSpec/RustExpr.hs": "04b2ef81417b811c7b98a98acdadab4e588ca8757964a63ba8dc5936c36479e6",
     "src/LawSpec/RustNativeBinding.hs": "9d08348da571ac335e335e48c1ad4a67108f7bca54119f5960480e97a6d1da84",
@@ -240,7 +244,7 @@
     "src/LawSpec/SpecializeDefinitions.hs": "08f2fe674a5e00d1be396d9edab0dd2c948b7beb12fa99f2a6aba00cbdf01e33",
     "src/LawSpec/Testing.hs": "7b0a2e58bcef24365883b479b6a5af720cc2ac4c217ae23bb771c2621d82aec3",
     "src/LawSpec/WebData.hs": "919af27be12f63f17762e0c052341ab82dcee5d45951a4fd9c66abead98d1ee0",
-    "src/LawSpec/WebDefinitions.hs": "fd985db70c778c8014b780666ac327018e05260be610fa717b8c5477ba9638b4",
+    "src/LawSpec/WebDefinitions.hs": "d654df765e4bafcb1acdd35058f8a510c2cd81920153c0a75ff1e7e1137c96e5",
     "src/LawSpec/WebExpr.hs": "0389dcd5cf7479dd23ef034b1012de6ebd70bf1dc9e3d90981dfb0ba2702596f",
     "src/LawSpec/WebNativeBinding.hs": "465251be1a93d24a775aa57955bb9ec612af7364c53c83017da051f44943eda9",
     "src/LawSpec/WebTypes.hs": "f77ffee1e0c7929964a889fb252c1c5d0977afed94664ffcb0f8770c37b98c70",
@@ -250,8 +254,8 @@
     "wasm/app/Exports.hs": "4ecbdac8faa2449e6fc61b93c82e6278fa14374154f29b4dacf0eef433f06a47",
     "wasm/cabal.project": "021e560afdc5eb4cb7169e7119ecb8f92c9ee170245af909c94b612941bff5cc",
     "wasm/cabal.project.freeze": "733dbed3d2ecccb26e874fd58f136296dad772184deb1658c196b5d54a0814dc",
-    "wasm/lawspec-wasm.cabal": "01198a858a300d47ea5a9d766523ab577092add5139d09333dbe6fbbf1834c5b",
-    "npm/core.wasm": "ecf8b4ee304838dd5ea7d9b708dd6e4c2572f76d60e3ac346b3c740b8f0318e7",
+    "wasm/lawspec-wasm.cabal": "ee8235aa57e891fe5b1f0d798694f5db5bc6e83b4d013fd1a96e9b2d28aae613",
+    "npm/core.wasm": "f67a99e2de93750f0d4930cc086688a74ee1d309c3818bfe3125490e01b08660",
     "npm/core_jsffi.js": "88d136efe92f7cff5758c8fec8d9b6bbc9707fe37741cebeeb415fe34ce3d72b",
     "npm/api.mjs": "e93251db289ff0609abaff78ad67f0a9af82508c1141c6a999604f67c56b6e7d",
     "npm/index.d.ts": "2674f8830bd20a2b9ef7dfa99e183598125b6bcc17e8d454e8f7cca1bbd2c9fe"

package/examples/specs/domain_modeling.lawspec

@@ -0,0 +1,59 @@
+unit example.ordering
+
+-- Constrained primitives. Each wrapper is a distinct type whose constructor
+-- checks the value, so an out-of-range quantity cannot be constructed,
+-- generated or decoded from native code. valueOf<Name> unwraps a value.
+wrapper UnitQuantity is Int32 where value >= 1 && value <= 1000 end
+wrapper OrderId is Text where prelude.length value > 0 end
+wrapper NonEmptyList (a :: Type) is List a where prelude.length value > 0 end
+
+-- Each workflow state is its own type. A ValidatedOrder can only hold checked
+-- values, so no later step needs to validate again.
+type UnvalidatedOrder is UnvalidatedOrder id :: Text quantity :: Int32 end
+type ValidatedOrder is ValidatedOrder id :: OrderId quantity :: UnitQuantity end
+type PricedOrder is PricedOrder id :: OrderId quantity :: UnitQuantity total :: Int64 end
+type OrderError is | InvalidOrderId | InvalidQuantity | PriceTooHigh end
+
+-- The compiler checks that each step accepts the previous step's state and that
+-- all failures share one error type. It adds a law that placeOrder is the
+-- railway composition of the steps: the first Left is the workflow's result.
+workflow placeOrder :: UnvalidatedOrder -> Either OrderError PricedOrder is
+  validateOrder :: UnvalidatedOrder -> Either OrderError ValidatedOrder
+  priceOrder :: ValidatedOrder -> Either OrderError PricedOrder
+end
+
+firstLine :: NonEmptyList Int32 -> Int32
+
+law `validation accepts exactly the valid orders` is
+  definition is
+    `for all` (input :: UnvalidatedOrder) .
+      (match validateOrder input with
+        | Left e -> false
+        | Right v -> true
+        end) = (match input with
+        | UnvalidatedOrder id quantity ->
+            prelude.length id > 0 && quantity >= 1 && quantity <= 1000
+        end)
+  end
+end
+
+law `quantities are always in range` is
+  definition is
+    `for all` (q :: UnitQuantity) .
+      valueOfUnitQuantity q >= 1 && valueOfUnitQuantity q <= 1000
+  end
+  example `largest quantity` is
+    q = UnitQuantity 1000
+    expect valueOfUnitQuantity q = 1000
+  end
+end
+
+law `a non-empty list has a first element` is
+  definition is
+    `for all` (xs :: NonEmptyList Int32) .
+      (match valueOfNonEmptyList xs with
+        | Nil -> false
+        | Cons head tail -> firstLine xs == head
+        end) = true
+  end
+end

package/examples/specs/indexed_families.lawspec

@@ -19,6 +19,35 @@ append :: (xs :: Vec n Int8) -> (ys :: Vec m Int8) -> (r :: Vec (n + m) Int8)
 zip :: (xs :: Vec n Int8) -> (ys :: Vec n Bool) -> (r :: Vec n Bool)
 flatten :: (tree :: Tree n Int8) -> (r :: Vec n Int8)
 
+-- Checked definitions whose result indices are proved statically, by
+-- structural induction over the constructor equations. They need no runtime
+-- postcondition, and serve as reference models for the native adapters.
+definition concatV (xs :: Vec n Int8) (ys :: Vec m Int8) :: Vec (n + m) Int8 is
+  match xs with
+  | VNil -> ys
+  | VCons h t -> VCons h (concatV t ys)
+  end
+end
+
+definition flattenV (tree :: Tree n Int8) :: Vec n Int8 is
+  match tree with
+  | Tip -> VNil
+  | Bin l v r -> concatV (flattenV l) (VCons v (flattenV r))
+  end
+end
+
+law `append agrees with the proved definition` is
+  definition is
+    `for all` (xs :: Vec n Int8) (ys :: Vec m Int8) . append xs ys = concatV xs ys
+  end
+end
+
+law `flatten agrees with the proved definition` is
+  definition is
+    `for all` (tree :: Tree 4 Int8) . flatten tree = flattenV tree
+  end
+end
+
 law `replicate has the requested length` is
   definition is
     `for all` (n :: Natural where n < 16) (x :: Int8) . nOfVec (replicate n x) = n

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lawspec",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "State the law once. Check it everywhere.",
   "license": "MIT",
   "type": "module",
@@ -8,6 +8,6 @@
   "bin": { "lawspec": "bin/lawspec.mjs" },
   "exports": { ".": { "types": "./index.d.ts", "import": "./api.mjs" } },
   "types": "index.d.ts",
-  "files": ["*.mjs", "*.json", "index.d.ts", "bin", "core.wasm", "core_jsffi.js", "README.md", "NATIVE-BINDINGS.md", "PRIMITIVES.md", "REFINEMENTS.md", "RUST.md", "JAVA.md", "PYTHON.md", "GO.md", "HASKELL.md", "KOTLIN.md", "WEB.md", "LANGUAGE.md", "API-MIGRATION.md", "RELEASE-0.9.md", "RELEASE-0.10.md", "RELEASE-0.11.md", "LICENSE", "starter.lawspec", "examples"],
+  "files": ["*.mjs", "*.json", "index.d.ts", "bin", "core.wasm", "core_jsffi.js", "README.md", "NATIVE-BINDINGS.md", "PRIMITIVES.md", "REFINEMENTS.md", "RUST.md", "JAVA.md", "PYTHON.md", "GO.md", "HASKELL.md", "KOTLIN.md", "WEB.md", "LANGUAGE.md", "API-MIGRATION.md", "RELEASE-0.9.md", "RELEASE-0.10.md", "RELEASE-0.11.md", "RELEASE-0.12.md", "RELEASE-0.13.md", "LICENSE", "starter.lawspec", "examples"],
   "scripts": { "test": "node --test test/*.test.mjs" }
 }