Skip to content

Add Aiur formal verification framework with #aiur_gen command#349

Open
arthurpaulino wants to merge 1 commit intomainfrom
ap/aiur-formal
Open

Add Aiur formal verification framework with #aiur_gen command#349
arthurpaulino wants to merge 1 commit intomainfrom
ap/aiur-formal

Conversation

@arthurpaulino
Copy link
Copy Markdown
Member

@arthurpaulino arthurpaulino commented Mar 26, 2026

Add G field arithmetic (Add, Sub, Mul, eqZero), u8/u32 semantic functions with range predicates, and commutativity theorems to Goldilocks.lean. Enable precompileModules on Ix library for native evaluation under Lean's module system.

Add #aiur_gen command that evaluates an Aiur Toplevel at elaboration time and writes a .lean file with:

  • Semantic types: Lean inductives from Aiur enums with pointers erased, type aliases as abbrevs, topologically sorted by type references with mutual blocks for cyclic dependencies. Generic type parameters (enum Foo‹T›) become explicit Lean params (T : Type).
  • Semantic propositions: one inductive per function, one constructor per control-flow path, with assertEq as Prop conjuncts, store/load erased, u8/u32 ops with range constraints, or-patterns expanded, IO operations as unconstrained fresh variables, data constructors inlined, nested match patterns resolved transitively. Generic function parameters become implicit Lean params {T : Type}. Unconstrained calls (#fn(…)) produce universally quantified variables with no premises.
  • Topological sorting of both types and functions by dependency graph, with mutual blocks only for actual cycles. Unconstrained calls are excluded from the dependency graph.

Add multi-file example:

  • ExampleBase.lean: Expr type, eval, swap, double_eval (forward ref), simplify_neg (nested match) → ExampleBaseSem.lean
  • ExampleMain.lean: ExprList, Tree/Forest (mutual types), list_sum, assert_eval, tree_sum/forest_sum (mutual functions), is_even/is_odd (mutual recursion), GList‹T› with length‹T› (generic types), add_noise/use_unconstrained (unconstrained calls) → ExampleMainSem.lean (imports base)
  • Example.lean: theorems over generated semantic propositions (determinism, totality, involution, assertEq semantics, spec soundness, mutual type/function soundness, mutual recursion path exclusivity, generic length soundness, unconstrained call form vs constrained determinism)

@arthurpaulino arthurpaulino force-pushed the ap/aiur-formal branch 6 times, most recently from f87bdb5 to 90db3ff Compare March 27, 2026 12:44
Comment thread lakefile.lean
@[default_target]
lean_lib Ix where
moreLinkObjs := #[ix_rs]
precompileModules := true
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This has the side effect that downstream modules and users can use #eval for @[extern] FFI functions, which is nice for debugging!

Copy link
Copy Markdown
Member Author

@arthurpaulino arthurpaulino Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah it was necessary to run G.ofNat at elaboration time (it does FFI).

@arthurpaulino arthurpaulino force-pushed the ap/aiur-formal branch 2 times, most recently from 66e8c1d to 61011b9 Compare March 27, 2026 14:40
@arthurpaulino arthurpaulino enabled auto-merge (squash) March 27, 2026 14:41
Add G field arithmetic (Add, Sub, Mul, eqZero), u8/u32 semantic
functions with range predicates, and commutativity theorems to
Goldilocks.lean. Enable precompileModules on Ix library for native
evaluation under Lean's `module` system.

Add `#aiur_gen` command that evaluates an Aiur Toplevel at elaboration
time and writes a .lean file with:
- Semantic types: Lean inductives from Aiur enums with pointers erased,
  type aliases as abbrevs, topologically sorted by type references
  with mutual blocks for cyclic dependencies. Generic type parameters
  (`enum Foo‹T›`) become explicit Lean params `(T : Type)`.
- Semantic propositions: one inductive per function, one constructor per
  control-flow path, with assertEq as Prop conjuncts, store/load
  erased, u8/u32 ops with range constraints, or-patterns expanded,
  IO operations as unconstrained fresh variables, data constructors
  inlined, nested match patterns resolved transitively. Generic
  function parameters become implicit Lean params `{T : Type}`.
  Unconstrained calls (`#fn(…)`) produce universally quantified
  variables with no premises.
- Topological sorting of both types and functions by dependency graph,
  with mutual blocks only for actual cycles. Unconstrained calls are
  excluded from the dependency graph.

Add multi-file example:
- ExampleBase.lean: Expr type, eval, swap, double_eval (forward ref),
  simplify_neg (nested match) → ExampleBaseSem.lean
- ExampleMain.lean: ExprList, Tree/Forest (mutual types), list_sum,
  assert_eval, tree_sum/forest_sum (mutual functions),
  is_even/is_odd (mutual recursion), GList‹T› with length‹T›
  (generic types), add_noise/use_unconstrained (unconstrained calls)
  → ExampleMainSem.lean (imports base)
- Example.lean: theorems over generated semantic propositions
  (determinism, totality, involution, assertEq semantics, spec
  soundness, mutual type/function soundness, mutual recursion path
  exclusivity, generic length soundness, unconstrained call form
  vs constrained determinism)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants