Repository navigation
Conversation
Reflection on stock 2.0.37: propositions as data (P), Interp : P -> Type into native goals, auto(p) -> Maybe<Interp(p)> deciding the fragment with honest None refusal. Quantified laws (min_le, le_succ_r) stay hand-proved; instances and conjunctions go through the tactic, definitionally. README shows a buggy-min edit flipping Some -> None and failing the law.
Author
|
i was reading the otherday some part of https://fstar-lang.org/papers/metafstar/ and |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A demo, not a proposal: on stock 2.0.37, a tactic as a library.
P),Interp : P -> Typeinto native goalsauto(p) -> Maybe<Interp(p)>decides the fragment;Some{...}carries the proof term,None{}is the honest refusalmin_le,le_succ_r) stay hand-proved beside it; instances go through the tactic, definitionally —Interp(PLe{a, b})normalizes to the native goal itself, so there is no glueThe README shows the run transcript, including what happens when a bug is introduced in
min: the tactic flipsSome -> Noneand names the unprovable goal, and the quantified law fails with it. ThatNoneis the agent-facing signal: not "error", but "here is what I could not prove".The load-bearing feature is a computed type family in a generic signature (
Maybe<Interp(p)>as a return type). No quote, no unify, no compiler changes — reflection, not metaprogramming; the Limits section says so plainly (match Aon a Type parameter is a dead-region error, and goal introspection does not exist, so the framework reaches exactly the fragment you embed, soundly, and nothing else).Verified on 2.0.37 (darwin/arm64):
and the buggy-
minedit reproducesSome None None+SOME PROOFS FAIL.