tla-ts 0.0.2 → 0.0.3-dev.763cc71

package/src/obligation-tuples.ts

@@ -0,0 +1,184 @@
+// tlapm's E_tuply_declarations: declarations such as <<x, y>> \in S become declarations of names.
+
+import type { Bound, BoundDomain, Defn, Expr } from "./obligation-expression";
+
+export type TuplyBound =
+  | { kind: "Name"; name: string; domain: BoundDomain }
+  | { kind: "Tuple"; names: string[]; domain: Expr };
+
+const getOpaque = (name: string): Expr => ({ kind: "Opaque", name });
+
+const getNamesTuple = (names: string[]): Expr => ({
+  kind: "Tuple",
+  elements: names.map(getOpaque),
+});
+
+const getEquality = (left: Expr, right: Expr): Expr => ({
+  kind: "Apply",
+  operator: { kind: "Internal", builtin: "Eq" },
+  args: [left, right],
+});
+
+export const getUnbounded = (names: string[]): Bound[] =>
+  names.map((name) => ({ name, level: "Constant", domain: { kind: "NoDomain" } }));
+
+const getFactors = (domain: Expr | undefined, names: string[]) =>
+  domain?.kind === "Product" && domain.factors.length === names.length ? domain.factors : undefined;
+
+// Each name is the matching item of the tuple: x == t[1], y == t[2].
+const getItemDefinitions = (tuple: string, names: string[]): Defn[] =>
+  names.map((name, index) => ({
+    kind: "Operator",
+    name,
+    body: {
+      kind: "FcnApp",
+      function: getOpaque(tuple),
+      args: [{ kind: "Num", integer: String(index + 1), fraction: "" }],
+    },
+  }));
+
+const getFactorBounds = (names: string[], factors: Expr[]): Bound[] =>
+  names.map((name, index) => ({
+    name,
+    level: "Constant",
+    domain: { kind: "Domain", expression: factors[index] },
+  }));
+
+const getNamedBound = (bound: Extract<TuplyBound, { kind: "Name" }>): Bound => ({
+  name: bound.name,
+  level: "Constant",
+  domain: bound.domain,
+});
+
+// \E <<x, y>> \in A \X B: P becomes \E x \in A, y \in B: P, and \E <<x, y>> \in S: P becomes
+// \E x, y: <<x, y>> \in S /\ P. Each domain quantifies separately, the last one innermost.
+export const expandQuant = (
+  quantifier: "Forall" | "Exists",
+  bounds: TuplyBound[],
+  body: Expr,
+): Expr => {
+  const groups: TuplyBound[][] = [];
+  bounds.forEach((bound) => {
+    if (bound.kind === "Name" && bound.domain.kind === "Ditto") groups.at(-1)?.push(bound);
+    else groups.push([bound]);
+  });
+  return groups.reduceRight((inner: Expr, group): Expr => {
+    const first = group[0];
+    if (first.kind === "Name") {
+      return {
+        kind: "Quant",
+        quantifier,
+        bounds: group.flatMap((bound) => (bound.kind === "Name" ? [getNamedBound(bound)] : [])),
+        body: inner,
+        location: inner.location,
+      };
+    }
+    const factors = getFactors(first.domain, first.names);
+    if (factors) {
+      return {
+        kind: "Quant",
+        quantifier,
+        bounds: getFactorBounds(first.names, factors),
+        body: inner,
+        location: inner.location,
+      };
+    }
+    const membership: Expr = {
+      kind: "Apply",
+      operator: { kind: "Internal", builtin: quantifier === "Exists" ? "Mem" : "Notmem" },
+      args: [getNamesTuple(first.names), first.domain],
+    };
+    return {
+      kind: "Quant",
+      quantifier,
+      bounds: getUnbounded(first.names),
+      body: {
+        kind: "List",
+        bullet: quantifier === "Exists" ? "And" : "Or",
+        items: [membership, inner],
+      },
+      location: inner.location,
+    };
+  }, body);
+};
+
+// CHOOSE <<x, y>> \in A \X B: P binds t \in A \X B with x == t[1], y == t[2], and any other
+// domain binds t with \E x, y: t = <<x, y>> /\ P.
+const getChooseBody = (
+  name: string,
+  names: string[],
+  domain: Expr | undefined,
+  body: Expr,
+): Expr =>
+  getFactors(domain, names)
+    ? { kind: "Let", definitions: getItemDefinitions(name, names), body }
+    : {
+        kind: "Quant",
+        quantifier: "Exists",
+        bounds: getUnbounded(names),
+        body: {
+          kind: "List",
+          bullet: "And",
+          items: [getEquality(getOpaque(name), getNamesTuple(names)), body],
+        },
+      };
+
+export const expandChoose = (names: string[], domain: Expr | undefined, body: Expr): Expr => {
+  const name = `choose#${names[0]}`;
+  return { kind: "Choose", name, domain, body: getChooseBody(name, names, domain, body) };
+};
+
+export const expandSetSt = (names: string[], domain: Expr, body: Expr): Expr => {
+  const name = `setst#${names[0]}`;
+  return { kind: "SetSt", name, domain, body: getChooseBody(name, names, domain, body) };
+};
+
+// A set or function constructor binds each tuple as fcn#x, with its names defined in a LET around
+// the value. A set constructor over a matching product binds the names to its factors instead.
+const expandConstructorBounds = (bounds: TuplyBound[], value: Expr, isSetOf: boolean) => {
+  const expanded = bounds.map((bound): { bounds: Bound[]; definitions: Defn[] } => {
+    if (bound.kind === "Name") return { bounds: [getNamedBound(bound)], definitions: [] };
+    const factors = getFactors(bound.domain, bound.names);
+    if (factors && isSetOf) {
+      return { bounds: getFactorBounds(bound.names, factors), definitions: [] };
+    }
+    const name = `fcn#${bound.names[0]}`;
+    const fcnBound: Bound = {
+      name,
+      level: "Constant",
+      domain: { kind: "Domain", expression: bound.domain },
+    };
+    if (factors) return { bounds: [fcnBound], definitions: getItemDefinitions(name, bound.names) };
+    const choice = `choose#${name}`;
+    return {
+      bounds: [fcnBound],
+      definitions: [
+        {
+          kind: "Operator",
+          name: choice,
+          body: expandChoose(
+            bound.names,
+            undefined,
+            getEquality(getOpaque(name), getNamesTuple(bound.names)),
+          ),
+        },
+        ...getItemDefinitions(choice, bound.names),
+      ],
+    };
+  });
+  const definitions = expanded.flatMap((item) => item.definitions);
+  return {
+    bounds: expanded.flatMap((item) => item.bounds),
+    value: definitions.length === 0 ? value : { kind: "Let" as const, definitions, body: value },
+  };
+};
+
+export const expandSetOf = (element: Expr, bounds: TuplyBound[]): Expr => {
+  const expanded = expandConstructorBounds(bounds, element, true);
+  return { kind: "SetOf", element: expanded.value, bounds: expanded.bounds };
+};
+
+export const expandFcn = (bounds: TuplyBound[], body: Expr): Expr => {
+  const expanded = expandConstructorBounds(bounds, body, false);
+  return { kind: "Fcn", bounds: expanded.bounds, body: expanded.value };
+};

package/src/obligations.ts

@@ -0,0 +1,316 @@
+// Generates the proof obligations tlapm prints for a module, in tlapm's order and layout.
+
+import { TlaProofError, TlaSyntaxError, type SyntaxFailure } from "./errors";
+import { createAnonymizer } from "./obligation-anon";
+import {
+  getAtPrefix,
+  getErrorNote,
+  getLocusPosition,
+  getLocusPrefix,
+  type Locus,
+  type ObligationWarning,
+} from "./obligation-expression";
+import { createGenerator, type LineRange } from "./obligation-generate";
+import {
+  compareNames,
+  expandInstance,
+  flatten,
+  generate,
+  getDependencies,
+  normalize,
+  STANDARD_MODULES,
+  type ModuleSummary,
+  type Mule,
+  type TheoremSummary,
+  type Pipeline,
+} from "./obligation-module";
+import { formatObligation } from "./obligation-printer";
+import type { Counter } from "./obligation-proof";
+import { createSource } from "./obligation-source";
+import { tokenize } from "./lexer";
+import { parseTlapmModule } from "./parser";
+import type { Module } from "./ast";
+
+export interface ObligationSource {
+  file: string;
+  source: string;
+}
+
+export interface PrintedObligation {
+  id: number;
+  location: string;
+  text: string;
+}
+
+export interface ModuleObligations {
+  name: string;
+  location: Locus | undefined;
+  obligations: PrintedObligation[];
+  summary: ModuleSummary;
+}
+
+export const WHOLE_MODULE: LineRange = { start: 0, end: Infinity };
+
+interface ObligationOptions {
+  lines?: LineRange;
+  onWarning?: (warning: ObligationWarning) => void;
+}
+
+const MODULE_HEADER = /-{4,} *MODULE/;
+
+const END_FAILURE = "Unexpected EOF";
+
+const formatLocus = (locus: Locus | undefined) =>
+  locus ? `${locus.startLine}:${locus.startColumn}:${locus.endLine}:${locus.endColumn}` : "";
+
+const findTab = (source: string) => {
+  const tokens = tokenize(source);
+  const lines = source.split("\n");
+  const endLine = tokens.at(-1)?.line ?? lines.length;
+  const moduleEnd =
+    lines.slice(0, endLine - 1).reduce((total, line) => total + line.length + 1, 0) +
+    lines[endLine - 1].indexOf("====");
+  const offset = source.indexOf("\t", source.search(MODULE_HEADER));
+  if (offset === -1 || offset >= moduleEnd) return undefined;
+  const line = source.slice(0, offset).split("\n").length;
+  const column = offset - source.lastIndexOf("\n", offset - 1);
+  const last = tokens.findLast(
+    (token) =>
+      token.kind !== "End" && (token.line < line || (token.line === line && token.column < column)),
+  );
+  const end: SyntaxFailure = {
+    reason: END_FAILURE,
+    line: last?.line ?? line,
+    column: last ? last.endColumn + 1 : column,
+    isEnd: true,
+  };
+  return { offset, line, column, end };
+};
+
+const readModule = <Value>(read: () => Value): Value | SyntaxFailure => {
+  try {
+    return read();
+  } catch (error) {
+    if (!(error instanceof TlaSyntaxError) || !error.failure) throw error;
+    return error.failure;
+  }
+};
+
+const isSyntaxFailure = (value: unknown): value is SyntaxFailure =>
+  typeof value === "object" && value !== null && "reason" in value;
+
+const parseSource = (source: string): Module | SyntaxFailure[] => {
+  const tab = readModule(() => findTab(source));
+  if (isSyntaxFailure(tab)) return [tab];
+  const parsed = readModule(() => parseTlapmModule(tab ? source.slice(0, tab.offset) : source));
+  if (tab && (!isSyntaxFailure(parsed) || parsed.isEnd)) {
+    return [
+      {
+        reason: "Unexpected TAB character. TLAPS does not handle TAB characters in source files.",
+        line: tab.line,
+        column: tab.column,
+        isEnd: false,
+      },
+      isSyntaxFailure(parsed) && parsed.reason === END_FAILURE ? parsed : tab.end,
+    ];
+  }
+  return isSyntaxFailure(parsed) ? [parsed] : parsed;
+};
+
+// Module.Save.parse_file warns when a module's name differs from its file's, then renames it.
+const loadMule = (
+  input: ObligationSource,
+  counter: Counter,
+  isMain: boolean,
+  onWarning: (warning: ObligationWarning) => void,
+  citation: string,
+): Mule => {
+  if (!MODULE_HEADER.test(input.source)) throw new TlaProofError("No tokens in file");
+  const parsed = parseSource(input.source);
+  if (Array.isArray(parsed)) {
+    parsed.forEach((failure) => {
+      const text = `File ${JSON.stringify(input.file)}, line ${failure.line}, character ${failure.column}\n${failure.reason}`;
+      onWarning({ text, channel: "stderr" });
+      onWarning({ text: `${text}\n`, channel: "toolboxOnly" });
+    });
+    const message = `Could not parse ${JSON.stringify(input.file)} successfully.`;
+    onWarning({ text: `${citation}Error: ${message}`, channel: "stderr" });
+    throw new TlaProofError(message, { failure: "Module.Parser.parse_file" });
+  }
+  const mule = createSource(input.file, input.source, counter, isMain).convertModule(parsed);
+  const fileName = input.file.slice(input.file.lastIndexOf("/") + 1);
+  const name = fileName.replace(/\.tla$/, "");
+  if (mule.name === name) return mule;
+  onWarning({
+    text: `${getLocusPrefix(mule.location)}Warning: module name ${JSON.stringify(mule.name)} does not match file name ${JSON.stringify(fileName)}.`,
+    channel: "toolbox",
+  });
+  return { ...mule, name };
+};
+
+// Module.Dep.schedule: dependencies first, visiting modules and their dependencies by name.
+const schedule = (modules: Map<string, Mule>) => {
+  const dependencies = new Map(
+    [...modules].map(([name, module]) => [name, getDependencies(module).dependencies]),
+  );
+  const seen = new Set<string>();
+  const order: Mule[] = [];
+  const visit = (name: string) => {
+    if (seen.has(name)) return;
+    seen.add(name);
+    const module = modules.get(name);
+    if (!module) throw new TlaProofError(`Module "${name}" not found`);
+    (dependencies.get(name) ?? []).forEach(visit);
+    order.push(module);
+  };
+  [...modules.keys()].sort(compareNames).forEach(visit);
+  return order;
+};
+
+const formatProofs = (kind: "missing" | "omitted", loci: Locus[], before: number) =>
+  loci.length === 0
+    ? []
+    : [
+        `    ${kind}_proofs_count = ${loci.length}`,
+        ...loci.map(
+          (locus, index) => `    ${kind}_proof_${before + index + 1} at ${getLocusPosition(locus)}`,
+        ),
+      ];
+
+const formatTheoremSummary = (theorem: TheoremSummary, missing: number, omitted: number) => {
+  const location = theorem.location;
+  const start = location
+    ? getLocusPosition({
+        ...location,
+        endLine: location.startLine,
+        endColumn: location.startColumn,
+      })
+    : "<unknown location>";
+  return [
+    `  ---- incomplete proof of theorem at ${start} ----`,
+    ...formatProofs("missing", theorem.absent, missing),
+    ...formatProofs("omitted", theorem.omitted, omitted),
+    "  ====",
+  ];
+};
+
+export const formatSummary = (result: ModuleObligations) => {
+  const summary = result.summary;
+  const theorems = summary.theorems.reduce(
+    (state, theorem) =>
+      theorem.absent.length + theorem.omitted.length === 0
+        ? state
+        : {
+            lines: [...state.lines, ...formatTheoremSummary(theorem, state.missing, state.omitted)],
+            missing: state.missing + theorem.absent.length,
+            omitted: state.omitted + theorem.omitted.length,
+          },
+    { lines: new Array<string>(), missing: 0, omitted: 0 },
+  );
+  return [
+    `---- summary of module ${JSON.stringify(result.name)} ----`,
+    `  obligations_count = ${summary.total}`,
+    ...(summary.absent.length > 0 ? [`  missing_proofs_count = ${summary.absent.length}`] : []),
+    ...(summary.omitted.length > 0 ? [`  omitted_proofs_count = ${summary.omitted.length}`] : []),
+    ...theorems.lines,
+    "====",
+  ].join("\n");
+};
+
+// Each main module is one file given to tlapm. They load into one context and report in schedule
+// order, each numbering its obligations from 1.
+export const getObligations = (
+  mains: ObligationSource[],
+  loadModule: (name: string) => ObligationSource | undefined,
+  options: ObligationOptions = {},
+): ModuleObligations[] => {
+  const lines = options.lines ?? WHOLE_MODULE;
+  const onWarning = options.onWarning ?? (() => {});
+  const counter = { value: 0 };
+  const modules = new Map<string, Mule>(STANDARD_MODULES);
+  mains.forEach((main) => {
+    const module = {
+      ...loadMule(main, counter, true, onWarning, 'File "<unknown>":\n'),
+      isImportant: true,
+    };
+    modules.set(module.name, module);
+  });
+  // Module.Save.complete_load: breadth first from every known module, by name.
+  const queue = [...modules.values()].sort((left, right) => compareNames(left.name, right.name));
+  // A missing module is fine only if some loaded module declares it as a submodule.
+  const requested = new Map<string, Locus | undefined>();
+  const found = new Set<string>();
+  for (let index = 0; index < queue.length; index++) {
+    const result = getDependencies(queue[index]);
+    result.submodules.forEach((submodule, name) => {
+      found.add(name);
+      if (!modules.has(name)) modules.set(name, submodule);
+    });
+    // A file named like a standard module replaces it, and is read again for each module citing it.
+    for (const name of result.dependencies) {
+      if (modules.has(name) && !STANDARD_MODULES.has(name)) continue;
+      const input = loadModule(name);
+      if (!input) {
+        if (!modules.has(name) && !requested.has(name))
+          requested.set(name, result.locations.get(name));
+        continue;
+      }
+      const loaded = loadMule(
+        input,
+        counter,
+        false,
+        onWarning,
+        getAtPrefix(result.locations.get(name)),
+      );
+      modules.set(name, loaded);
+      queue.push(loaded);
+    }
+  }
+  const missing = [...requested.keys()].filter((name) => !found.has(name)).sort(compareNames);
+  missing.forEach((name) =>
+    onWarning(getErrorNote(requested.get(name), `Unknown module ${JSON.stringify(name)}`)),
+  );
+  if (missing.length > 0)
+    throw new TlaProofError(`Unknown module ${JSON.stringify(missing[0])}`, {
+      failure: "Module.Parser.load_module",
+    });
+  const pipeline: Pipeline = {
+    anonymizer: createAnonymizer(
+      counter,
+      (scope, definition) => expandInstance(pipeline, scope, definition),
+      onWarning,
+    ),
+    generator: createGenerator(counter, new Set(mains.map((main) => main.file)), lines, onWarning),
+    salts: { value: 0 },
+    latestModules: new Map(),
+    onWarning,
+  };
+  const order = schedule(modules).map((module) =>
+    module.isStandard ? module : flatten(modules, module, new Set()),
+  );
+  // Instances see each module as flattened, and as normalized once its turn has come.
+  const normalized = new Map(order.map((module) => [module.name, module]));
+  return order.flatMap((module): ModuleObligations[] => {
+    if (module.isStandard) return [];
+    const result = normalize(pipeline, normalized, undefined, module);
+    if (!module.isImportant) return [];
+    const generated = generate(pipeline, [], result);
+    // tlapm numbers the obligations, then drops the omitted ones and those outside the lines.
+    const obligations = generated.obligations.flatMap((obligation, index): PrintedObligation[] => {
+      const location = obligation.location;
+      if (
+        obligation.kind.kind === "Omitted" ||
+        (location && (location.startLine < lines.start || location.endLine > lines.end))
+      )
+        return [];
+      const text =
+        obligation.kind.kind === "Error"
+          ? obligation.kind.message
+          : `${formatObligation(obligation.sequent)}\n`;
+      return [{ id: index + 1, location: formatLocus(location), text }];
+    });
+    return [
+      { name: module.name, location: module.location, obligations, summary: generated.summary },
+    ];
+  });
+};

package/src/parallel-worker.ts

@@ -15,6 +15,7 @@ interface Pending {
   states: Value[][];
   origins: number[];
   fingerprints: number[];
+  fingerprintStates: Value[][];
 }
 
 interface PeerMessage {
@@ -123,6 +124,9 @@ const run = (start: StartMessage, parent: Port) => {
   const decode = createStateDecoder(environment.variables.length);
   const table = createFingerprintTable();
   const known = createFingerprintTable();
+  // Under symmetry, a successor the worker generated before has the representative it had then,
+  // so the worker skips the search for one.
+  const generatedStates = search.isSymmetric ? createFingerprintTable() : undefined;
   const fingerprint = new Int32Array(2);
   const inbox = createInbox();
   const peers = start.ports.flatMap((port, index) => (port ? [{ port, index }] : []));
@@ -137,11 +141,12 @@ const run = (start: StartMessage, parent: Port) => {
   const send = (index: number, message: PeerMessage, transfer: unknown[]) =>
     start.ports[index]?.postMessage(message, transfer);
 
-  const expand = (states: Value[][], next: Value[][]) => {
+  const expand = (states: Value[][], next: Value[][], nextFingerprintStates: Value[][]) => {
     const pending: Pending[] = Array.from({ length: count }, () => ({
       states: [],
       origins: [],
       fingerprints: [],
+      fingerprintStates: [],
     }));
     const statistics = { generated: 0 };
     const newStates = new Int32Array(states.length);
@@ -153,8 +158,13 @@ const run = (start: StartMessage, parent: Port) => {
       for (const successor of successors) {
         if (search.findViolatedActionProperty(state, successor.state)) return undefined;
         if (!search.satisfiesActionConstraints(state, successor.state)) continue;
+        if (generatedStates) {
+          writeStateFingerprint(successor.state, fingerprint);
+          if (!generatedStates.insert(fingerprint[0], fingerprint[1])) continue;
+        }
         canonicalize(successor.state);
-        writeStateFingerprint(search.getFingerprintState(successor.state), fingerprint);
+        const fingerprintState = search.getFingerprintState(successor.state);
+        writeStateFingerprint(fingerprintState, fingerprint);
         const owner = getFingerprintOwner(fingerprint[1], count);
         if (owner === self) {
           if (!table.insert(fingerprint[0], fingerprint[1])) continue;
@@ -164,6 +174,7 @@ const run = (start: StartMessage, parent: Port) => {
             continue;
           }
           next.push(successor.state);
+          nextFingerprintStates.push(fingerprintState);
           newStates[origin]++;
           continue;
         }
@@ -171,6 +182,7 @@ const run = (start: StartMessage, parent: Port) => {
         pending[owner].states.push(successor.state);
         pending[owner].origins.push(origin);
         pending[owner].fingerprints.push(fingerprint[0], fingerprint[1]);
+        pending[owner].fingerprintStates.push(fingerprintState);
       }
     }
     return { pending, generated: statistics.generated, newStates };
@@ -184,7 +196,13 @@ const run = (start: StartMessage, parent: Port) => {
     return bits;
   };
 
-  const commit = (pending: Pending, bits: Uint8Array, next: Value[][], newStates: Int32Array) => {
+  const commit = (
+    pending: Pending,
+    bits: Uint8Array,
+    next: Value[][],
+    nextFingerprintStates: Value[][],
+    newStates: Int32Array,
+  ) => {
     const unmarks: number[] = [];
     for (let index = 0; index < bits.length; index++) {
       if (bits[index] === 0) continue;
@@ -193,6 +211,7 @@ const run = (start: StartMessage, parent: Port) => {
       if (search.findViolatedInvariant(state, parentState)) return undefined;
       if (search.satisfiesConstraints(state, parentState)) {
         next.push(state);
+        nextFingerprintStates.push(pending.fingerprintStates[index]);
         newStates[pending.origins[index]]++;
         continue;
       }
@@ -230,7 +249,8 @@ const run = (start: StartMessage, parent: Port) => {
 
   const runLevel = async (level: number): Promise<LevelMessage | undefined> => {
     const next: Value[][] = [];
-    const expanded = expand(frontier.states, next);
+    const nextFingerprintStates: Value[][] = [];
+    const expanded = expand(frontier.states, next, nextFingerprintStates);
     if (!expanded || getRankedStringCount() !== startupStrings) return undefined;
     peers.forEach((peer) => {
       const fingerprints = Int32Array.from(expanded.pending[peer.index].fingerprints);
@@ -247,6 +267,7 @@ const run = (start: StartMessage, parent: Port) => {
         expanded.pending[reply.from],
         reply.bits ?? new Uint8Array(),
         next,
+        nextFingerprintStates,
         expanded.newStates,
       );
       if (!unmarks) return undefined;
@@ -255,9 +276,7 @@ const run = (start: StartMessage, parent: Port) => {
     const added = next.length;
     const outDegrees = Array.from({ length: OUT_DEGREE_BUCKETS }, () => 0);
     expanded.newStates.forEach((degree) => outDegrees[Math.min(degree, OUT_DEGREE_BUCKETS - 1)]++);
-    const fingerprints = BigInt64Array.from(next, (state) =>
-      environment.runtime.getFingerprint(state),
-    );
+    const fingerprints = search.getStoredFingerprints(next, nextFingerprintStates);
     const sizes = Array.from({ length: count }, () => 0);
     sizes[self] = added;
     peers.forEach((peer) =>