certo-math 0.11.1__py3-none-any.whl

certo/__init__.py

@@ -0,0 +1,45 @@
+"""certo: a laboratory for supporting mathematical proofs.
+
+Three cross-cutting rules, true of every command:
+
+  1. Every command returns a certificate, or says explicitly why not.
+  2. Six result states: unsat / sat / unknown_solver / timeout /
+     resource_exhausted / out_of_theory. Only the first two are conclusive;
+     the rest mean "no answer", each for a different reason.
+  3. Determinism by work budget (z3 rlimit, SAT conflict budget), not by
+     clock, so the same command gives the same answer on another machine.
+     That covers our engines, not a user-supplied predicate.
+"""
+from __future__ import annotations
+
+from .certificate import Certificate, VerifyReport, verify
+from .cnf import CNF, CNFSpec
+from .graphs import Graph
+from . import doctor, reducers
+from .structures import SetFamily, family_from_masks, mask_to_set, set_to_mask
+from .packing import PackingSpec, loads_from_dual
+from .i18n import set_lang, t
+from .limits import Limits
+from .polynomials import Poly
+from .spec import (BisectSpec, BoundSpec, DomainSpec, IdealSpec,
+                   InductSpec, Lemma, LPSpec, NumberSpec, OrderSpec,
+                   BindSpec, ConeSpec, CoverSpec, CycleSpec, EliminateSpec, EquitableQuotientSpec, LinearSystemSpec, MatrixSpec, ParametricSymmetrySpec, EntrySpec, FamilySpec, MomentSpec, ParametricSpec, SymmetrySpec, PeakSpec, RatioSpec,
+                   SOSSpec,
+                   MultiSpec, Outcome, ProofSpec, Spec, SweepSpec,
+                   SynthSpec, load_spec)
+from .status import Result, Status, Verdict
+
+__version__ = "0.11.1"
+
+__all__ = [
+    "Spec", "SynthSpec", "LPSpec", "SweepSpec", "CNF", "CNFSpec",
+    "BisectSpec", "BoundSpec", "DomainSpec", "IdealSpec", "InductSpec",
+    "NumberSpec", "OrderSpec", "SOSSpec", "EliminateSpec", "ParametricSpec", "PeakSpec", "FamilySpec", "RatioSpec", "MomentSpec", "EntrySpec", "SymmetrySpec", "CoverSpec", "ConeSpec", "CycleSpec", "BindSpec", "EquitableQuotientSpec", "MatrixSpec", "LinearSystemSpec", "ParametricSymmetrySpec", "Poly", "MultiSpec",
+    "ProofSpec", "Lemma",
+    "Outcome", "load_spec",
+    "Limits", "Status", "Verdict", "Result",
+    "Certificate", "VerifyReport", "verify",
+    "Graph", "PackingSpec", "loads_from_dual", "doctor", "reducers", "SetFamily",
+    "family_from_masks", "mask_to_set", "set_to_mask", "set_lang", "t",
+    "__version__",
+]

certo/asymptotics.py

@@ -0,0 +1,233 @@
+"""Orders of magnitude: does this term decay, or is it Theta(1)?
+
+A user described the bug this exists for better than I could have. They had a
+symbolic constraint, substituted asymptotic magnitudes by hand -- `d` is about
+`n^2`, `C` about `n`, `|W|` about `n^2` -- and asked whether a term decays in
+`n`. Four bugs lived in that step. One of them,
+
+    5|k| W C^2 / (u^3 d^2 p^10)
+
+was constant in `n`, and it was invisible to BOTH Lean and `prove`, for the
+same reason: **it is not an infeasibility.** It is a feasibility that does not
+improve with `n`, and a solver asked "is this satisfiable" will keep saying
+yes, correctly, forever.
+
+That is a different question from any the tool could ask. So:
+
+    order(expr, {"d": 2, "C": 1, "W": 2, "u": 0, "p": 0, "k": 0})
+
+substitutes `n^a` for each symbol, collects the expression into powers of `n`
+with EXACT rational coefficients, and reports the leading exponent. Negative
+means it decays, positive means it grows, and zero -- the case that hurt --
+means Theta(1): the term is not going away however large `n` gets.
+
+Two things it is careful about, because both would make it lie.
+
+Cancellation is real. Two terms with the same exponent whose coefficients sum
+to zero do not contribute, and since the coefficients are `Fraction` that is
+decided rather than estimated.
+
+And `≍` hides a constant. This certifies the EXPONENT of `n`, not the
+constant in front of it. A `Theta(1)` term with a coefficient of 1e-9 may be
+perfectly fine in practice; what the certificate says is that it does not
+shrink, and it says only that.
+"""
+from __future__ import annotations
+
+from fractions import Fraction
+
+import z3
+
+from .i18n import t
+
+#: A Laurent monomial is {symbol: exponent}, exponents may be negative -- which
+#: is the whole point, since the interesting terms are quotients.
+DECAYS, CONSTANT, GROWS = "decays", "constant", "grows"
+
+
+class NotAsymptotic(ValueError):
+    """Raised with the offending subterm, because "it failed" is useless."""
+
+
+def _mono_mul(a: dict, b: dict) -> dict:
+    out = dict(a)
+    for k, v in b.items():
+        out[k] = out.get(k, 0) + v
+        if out[k] == 0:
+            del out[k]
+    return out
+
+
+def _key(m: dict):
+    return tuple(sorted(m.items()))
+
+
+class Laurent:
+    """A sum of Laurent monomials with exact rational coefficients."""
+
+    __slots__ = ("terms",)
+
+    def __init__(self, terms=None):
+        self.terms = {}
+        for m, c in (terms or {}).items():
+            c = Fraction(c)
+            if c:
+                self.terms[m] = c
+
+    @classmethod
+    def const(cls, c):
+        return cls({(): Fraction(c)})
+
+    @classmethod
+    def var(cls, name):
+        return cls({((name, 1),): Fraction(1)})
+
+    def __add__(self, other):
+        out = dict(self.terms)
+        for m, c in other.terms.items():
+            out[m] = out.get(m, Fraction(0)) + c
+            if not out[m]:
+                del out[m]
+        return Laurent(out)
+
+    def __neg__(self):
+        return Laurent({m: -c for m, c in self.terms.items()})
+
+    def __sub__(self, other):
+        return self + (-other)
+
+    def __mul__(self, other):
+        out = {}
+        for m1, c1 in self.terms.items():
+            for m2, c2 in other.terms.items():
+                m = _key(_mono_mul(dict(m1), dict(m2)))
+                out[m] = out.get(m, Fraction(0)) + c1 * c2
+                if not out[m]:
+                    del out[m]
+        return Laurent(out)
+
+    def inverse(self):
+        """Only a single monomial can be inverted, and that is the honest limit.
+
+        `1/(x + y)` is not a Laurent polynomial and its order depends on which
+        of x and y dominates -- a question this cannot answer and should not
+        pretend to. Divide by a product, not by a sum.
+        """
+        if len(self.terms) != 1:
+            raise NotAsymptotic(t("asym.divide_sum", n=len(self.terms)))
+        (m, c), = self.terms.items()
+        return Laurent({_key({k: -v for k, v in dict(m).items()}):
+                        Fraction(1) / c})
+
+    def power(self, n: int):
+        out = Laurent.const(1)
+        base = self if n >= 0 else self.inverse()
+        for _ in range(abs(n)):
+            out = out * base
+        return out
+
+
+def parse(expr) -> Laurent:
+    """A z3 arithmetic term as a Laurent polynomial. Division included."""
+    if z3.is_int_value(expr):
+        return Laurent.const(expr.as_long())
+    if z3.is_rational_value(expr):
+        return Laurent.const(expr.as_fraction())
+    if z3.is_const(expr) and expr.decl().kind() == z3.Z3_OP_UNINTERPRETED:
+        return Laurent.var(str(expr))
+    if z3.is_add(expr):
+        out = Laurent()
+        for c in expr.children():
+            out = out + parse(c)
+        return out
+    if z3.is_sub(expr):
+        a, b = expr.children()
+        return parse(a) - parse(b)
+    if z3.is_mul(expr):
+        out = Laurent.const(1)
+        for c in expr.children():
+            out = out * parse(c)
+        return out
+    if z3.is_app_of(expr, z3.Z3_OP_UMINUS):
+        return -parse(expr.arg(0))
+    if z3.is_div(expr) or z3.is_idiv(expr):
+        a, b = expr.children()
+        return parse(a) * parse(b).inverse()
+    if z3.is_app_of(expr, z3.Z3_OP_POWER):
+        from .linarith import _literal_exponent
+
+        base, exp = expr.children()
+        n = _literal_exponent(exp)
+        if n is None:
+            # A negative literal exponent is fine here -- unlike in linarith,
+            # a quotient IS the shape we are here for.
+            n = _negative_exponent(exp)
+        if n is None:
+            raise NotAsymptotic(t("asym.bad_exponent", expr=str(expr)))
+        return parse(base).power(n)
+    raise NotAsymptotic(t("asym.not_arithmetic", expr=str(expr)))
+
+
+def _negative_exponent(exp):
+    if z3.is_int_value(exp):
+        return exp.as_long()
+    if z3.is_rational_value(exp):
+        f = exp.as_fraction()
+        return f.numerator if f.denominator == 1 else None
+    return None
+
+
+# ---------------------------------------------------------------------------
+
+
+def order(expr, orders: dict, var: str = "n"):
+    """The exponent of `var`, and the terms that produce it.
+
+    `orders` maps each symbol to its exponent: `{"d": 2}` for `d` about `n^2`,
+    `{"u": 0}` for `u` about a constant, `{"r": Fraction(1,2)}` for a square
+    root. A symbol with no entry is an error rather than an assumption -- the
+    whole point is that the assignment is explicit.
+    """
+    poly = parse(expr) if not isinstance(expr, Laurent) else expr
+    missing = sorted({s for m in poly.terms for s, _ in m} - set(orders))
+    if missing:
+        raise NotAsymptotic(t("asym.unassigned", names=", ".join(missing)))
+
+    by_exp: dict = {}
+    rows = []
+    for m, c in poly.terms.items():
+        e = sum((Fraction(orders[s]) * p for s, p in m), Fraction(0))
+        by_exp[e] = by_exp.get(e, Fraction(0)) + c
+        rows.append({"monomial": _render(m), "coefficient": str(c),
+                     "exponent": str(e)})
+
+    # Cancellation is real, and with exact coefficients it is decided rather
+    # than estimated: a term whose coefficients sum to zero is not there.
+    surviving = {e: c for e, c in by_exp.items() if c}
+    degree = max(surviving) if surviving else None
+    return {
+        "terms": sorted(rows, key=lambda r: Fraction(r["exponent"]),
+                        reverse=True),
+        "collected": sorted(({"exponent": str(e), "coefficient": str(c)}
+                             for e, c in surviving.items()),
+                            key=lambda r: Fraction(r["exponent"]),
+                            reverse=True),
+        "degree": None if degree is None else str(degree),
+        "verdict": _verdict(degree),
+        "cancelled": len(by_exp) - len(surviving),
+        "var": var,
+    }
+
+
+def _verdict(degree):
+    if degree is None:
+        return DECAYS            # identically zero decays as fast as anything
+    if degree < 0:
+        return DECAYS
+    return CONSTANT if degree == 0 else GROWS
+
+
+def _render(m) -> str:
+    if not m:
+        return "1"
+    return " ".join("{}^{}".format(s, p) if p != 1 else s for s, p in m)

certo/audit.py

@@ -0,0 +1,299 @@
+"""Does each hypothesis earn its place? Drop it and go looking.
+
+`core` answers the other half. It says WHICH hypotheses an unsat core needed
+and drops the rest, which catches a theorem stated with slack. It cannot
+catch the opposite mistake, and the opposite mistake is the expensive one:
+
+    a theorem stated TOO STRONGLY, formalised, and only then found to have
+    been about a smaller class than anybody wanted
+
+So this drops each hypothesis in turn and hunts a counterexample to what
+remains. Four answers per hypothesis, and they are genuinely different:
+
+  NEEDED, with a witness. Without it the claim is false, and here is the
+  assignment that breaks it. That witness is the useful artefact: it says not
+  only that the hypothesis matters but HOW, which is what tells you whether
+  you wrote the right one.
+
+  REDUNDANT. The claim still follows without it, so the theorem is weaker than
+  it looks and can be stated without it. `core` finds these too; they appear
+  here because a per-hypothesis report that silently omitted them would read
+  as "all needed".
+
+  DOMAIN. Dropping it does not make the claim false -- it makes the claim
+  MEANINGLESS, because it was holding up a well-definedness condition. See
+  below; this one exists because reporting it as either of the other two
+  would have been a lie in a different direction each time.
+
+  UNKNOWN. The solver did not settle it inside the budget. Never folded into
+  any of the other three -- "we did not find a counterexample" is not "there
+  is none", and that distinction is the whole discipline here.
+
+DIVISION IS TOTAL IN SMT, AND THAT IS A TRAP. `n/0` is not an error in Z3; it
+is some fixed but unspecified value, supplied by an internal function the
+solver is free to interpret however it likes. So dropping `d != 0` and asking
+for a counterexample gets you one immediately: `d = 0`, with `div0` chosen to
+make the goal false. The hypothesis then reads `needed`, which is true by
+accident and false in substance -- it is needed for the statement to MEAN
+something, not for it to be true.
+
+So the divisors are collected up front and every search is GUARDED by them.
+A hypothesis whose drop leaves a counterexample only outside the domain is
+reported as DOMAIN, naming the obligation it was carrying, rather than as
+`needed` with a witness that divides by zero.
+
+The guards are also what the witnesses are checked against on the way back,
+and Z3's internal `div0`/`mod0` are excluded from a witness entirely: they
+are the solver's bookkeeping, never part of the problem, and a witness that
+carried them could not be re-applied.
+
+WHAT THIS IS FOR is the step before formalisation. Formalising a theorem whose
+hypotheses were never tested is how a month goes into proving something that
+is true of a smaller class than the paper claims, and the test is cheap: one
+satisfiability query per hypothesis.
+
+WHAT IT IS NOT is a proof that the hypothesis set is minimal. Dropping them ONE
+at a time says nothing about dropping two -- a pair can be jointly redundant
+with neither redundant alone. Said in the certificate, every time.
+"""
+from __future__ import annotations
+
+from .i18n import t as _t
+
+
+class NotAuditable(ValueError):
+    """Raised with the reason, because a bare failure helps nobody."""
+
+
+NEEDED, REDUNDANT, UNKNOWN = "needed", "redundant", "unknown"
+#: A hypothesis holding up a well-definedness condition rather than a
+#: mathematical one. Not `needed` -- the claim does not become false without
+#: it -- and emphatically not `redundant`, because removing it does not give
+#: a more general theorem, it gives a statement about `n/0`.
+DOMAIN = "domain"
+
+VERDICTS = (NEEDED, REDUNDANT, DOMAIN, UNKNOWN)
+
+#: Z3 totalises division and modulo with these; they are the solver's
+#: bookkeeping and never part of the problem, so they are not part of a
+#: witness either.
+INTERNAL = ("div0", "mod0", "rem0")
+
+
+def divisors(*expressions) -> list:
+    """Every divisor appearing anywhere in these formulas.
+
+    A numeral divisor needs no obligation -- `n/3` is defined for every `n` --
+    so only the ones that could vanish are collected, deduplicated by their
+    printed form because two occurrences of the same expression are one
+    obligation.
+    """
+    import z3
+
+    kinds = {z3.Z3_OP_DIV, z3.Z3_OP_IDIV, z3.Z3_OP_MOD, z3.Z3_OP_REM}
+    found, seen = [], set()
+
+    def walk(e):
+        if not z3.is_app(e):
+            return
+        if e.decl().kind() in kinds:
+            den = e.arg(1)
+            if not (z3.is_int_value(den) or z3.is_rational_value(den)):
+                key = den.sexpr()
+                if key not in seen:
+                    seen.add(key)
+                    found.append(den)
+        for i in range(e.num_args()):
+            walk(e.arg(i))
+
+    for expr in expressions:
+        if expr is not None:
+            walk(expr)
+    return found
+
+
+def obligations_for(spec) -> list:
+    """The domain obligations of a spec, as `(text, formula)` pairs."""
+    import z3
+
+    out = []
+    for den in divisors(spec.goal, *[f for _n, f in spec.assumptions]):
+        out.append((den.sexpr(), den != 0))
+    return out
+
+
+def _assignment(model) -> dict:
+    """The witness, without the solver's own bookkeeping.
+
+    Only arity-zero declarations of a sort that can be written back down:
+    `div0` and `mod0` are functions Z3 invented to make division total, and a
+    witness carrying them cannot be re-applied by anybody, including us.
+    """
+    known = {"Real", "Int", "Bool"}
+    return {str(d): [d.range().name(), str(model[d])]
+            for d in model.decls()
+            if d.arity() == 0 and d.range().name() in known
+            and str(d) not in INTERNAL}
+
+
+def audit(spec, limits=None) -> dict:
+    """One satisfiability query per hypothesis: what breaks without it."""
+    import z3
+
+    from .limits import Limits
+    from .status import Status
+
+    if spec.goal is None:
+        raise NotAuditable(_t("audit.no_goal"))
+    if not spec.assumptions:
+        raise NotAuditable(_t("audit.no_hypotheses"))
+
+    lim = limits or Limits()
+    duties = obligations_for(spec)
+    rows = []
+    for dropped, _formula in spec.assumptions:
+        keep = [(n, f) for n, f in spec.assumptions if n != dropped]
+        s = z3.Solver()
+        lim.apply_to(s)
+        for _n, f in keep:
+            s.add(f)
+        # A counterexample to the claim, under everything EXCEPT this one --
+        # and INSIDE the domain, because `n/0` is a value Z3 makes up and a
+        # counterexample that uses it is about the solver, not the theorem.
+        s.add(z3.Not(spec.goal))
+        for _text, guard in duties:
+            s.add(guard)
+        got = s.check()
+
+        if got == z3.sat:
+            rows.append({"hypothesis": dropped, "verdict": NEEDED,
+                         "witness": _assignment(s.model())})
+        elif got == z3.unsat:
+            lost = _lost_obligations(keep, duties, lim)
+            if lost:
+                rows.append({"hypothesis": dropped, "verdict": DOMAIN,
+                             "witness": None, "obligations": lost})
+            else:
+                rows.append({"hypothesis": dropped, "verdict": REDUNDANT,
+                             "witness": None})
+        else:
+            rows.append({"hypothesis": dropped, "verdict": UNKNOWN,
+                         "witness": None,
+                         "why": str(s.reason_unknown() or "")})
+        _ = Status
+
+    counts = {v: sum(1 for r in rows if r["verdict"] == v) for v in VERDICTS}
+    return {"rows": rows, "counts": counts,
+            "obligations": [text for text, _g in duties],
+            "ok": counts[UNKNOWN] == 0,
+            "redundant": [r["hypothesis"] for r in rows
+                          if r["verdict"] == REDUNDANT],
+            "domain": [r["hypothesis"] for r in rows
+                       if r["verdict"] == DOMAIN]}
+
+
+def _lost_obligations(keep, duties, lim) -> list:
+    """Which well-definedness conditions the remaining hypotheses no longer
+    force.
+
+    This is what separates DOMAIN from REDUNDANT, and it is a question about
+    the hypotheses rather than about the goal: if what is left still entails
+    every divisor being non-zero, the dropped one really was carrying nothing
+    and `redundant` is the honest answer.
+    """
+    import z3
+
+    lost = []
+    for text, guard in duties:
+        s = z3.Solver()
+        lim.apply_to(s)
+        for _n, f in keep:
+            s.add(f)
+        s.add(z3.Not(guard))
+        if s.check() != z3.unsat:       # the obligation is no longer forced
+            lost.append(text)
+    return lost
+
+
+def declared_obligations(payload) -> dict:
+    """Re-derive the domain obligations from the formulas that travelled.
+
+    A certificate declaring FEWER divisors than its own formulas contain is a
+    certificate whose searches ran unguarded, and every `needed` verdict in it
+    could be a division by zero. So this is derived rather than read -- the
+    same reason a branch-and-bound node rebuilds its own linear program.
+
+    A certificate written before obligations existed declares none, and one
+    that lists MORE than it needs has only searched a smaller region, which is
+    sound and merely weaker -- so neither of those fails.
+    """
+    import z3
+
+    formulas = [z3.And(*z3.parse_smt2_string(smt2))
+                for smt2 in (payload.get("hypotheses_smt2") or {}).values()]
+    goal = z3.And(*z3.parse_smt2_string(payload["goal_smt2"]))
+    found = [d.sexpr() for d in divisors(goal, *formulas)]
+
+    declared = payload.get("obligations")
+    if declared is None:
+        # Nothing was claimed, so nothing is contradicted. The rows are still
+        # checked against the guards by `recheck`, which is where an unguarded
+        # witness actually fails.
+        return {"ok": True, "found": found, "missing": [], "declared": []}
+    missing = [d for d in found if d not in set(declared)]
+    return {"ok": not missing, "found": found, "missing": missing,
+            "declared": list(declared)}
+
+
+def recheck(payload, limits=None) -> dict:
+    """Re-run every witness against the formulas it claims to break.
+
+    The witness is the whole content of a NEEDED verdict, and checking one is
+    evaluation rather than search: substitute the assignment, and the kept
+    hypotheses must hold while the goal must not. A verdict with a witness
+    that does not do that is a verdict about nothing.
+    """
+    import z3
+
+    from .limits import Limits
+
+    lim = limits or Limits()
+    formulas = {}
+    for name, smt2 in (payload.get("hypotheses_smt2") or {}).items():
+        formulas[name] = z3.And(*z3.parse_smt2_string(smt2))
+    goal = z3.And(*z3.parse_smt2_string(payload["goal_smt2"]))
+    duties = divisors(goal, *formulas.values())
+
+    bad, checked = [], 0
+    for row in payload["rows"]:
+        if row["verdict"] != NEEDED or not row.get("witness"):
+            continue
+        checked += 1
+        subs = []
+        for name, (sort, value) in row["witness"].items():
+            try:
+                var = {"Real": z3.Real, "Int": z3.Int,
+                       "Bool": z3.Bool}[sort](name)
+                lit = {"Real": z3.RealVal, "Int": z3.IntVal,
+                       "Bool": lambda v: z3.BoolVal(v == "True")}[sort](value)
+            except (KeyError, ValueError):
+                bad.append(row["hypothesis"])
+                break
+            subs.append((var, lit))
+        else:
+            kept = [f for n, f in formulas.items()
+                    if n != row["hypothesis"]]
+            claim = z3.And(*kept) if kept else z3.BoolVal(True)
+            s = z3.Solver()
+            lim.apply_to(s)
+            # The witness must satisfy what was KEPT, stay inside the domain,
+            # and break the goal. Without the middle one a witness that
+            # divides by zero re-checks happily, which is how the defect that
+            # put this line here got past the first version.
+            inside = [z3.substitute(d, *subs) != 0 for d in duties]
+            s.add(z3.Not(z3.And(z3.substitute(claim, *subs),
+                                *inside,
+                                z3.Not(z3.substitute(goal, *subs)))))
+            if s.check() != z3.unsat:
+                bad.append(row["hypothesis"])
+    return {"checked": checked, "bad": sorted(set(bad))}