§ | Kind | Item | Coq file | Name | Note |
---|---|---|---|---|---|
1 | Example | \(\mathit{eager}\) | examples/lazy_eager_coin | eager |
|
Example | \(\mathit{lazy}\) | lazy |
|||
2 | Theorem | 1 (Soundness) | typing/soundness | refines_sound |
|
Rule | \(\text{\scriptsize REL-COUPLE-RANDS}\) | rel_logic/rel_rules | refines_couple_rands_lr |
||
Rule | \(\text{\scriptsize REL-ALLOC-TAPE-L}\) | refines_alloctape_l |
|||
Rule | \(\text{\scriptsize REL-COUPLE-TAPE-L}\) | refines_couple_tape_rand |
|||
Rule | \(\text{\scriptsize REL-RAND-TAPE-L}\) | refines_rand_l |
|||
Rule | \(\text{\scriptsize REL-RAND-ERASE-R}\) | refines_couple_rands_r |
|||
Example | \(\mathit{lazy'}\) | examples/lazy_eager_coin | lazy_with_tape |
||
Theorem | \(\vDash \mathit{lazy} \precsim \mathit{eager} : \text{unit} \rightarrow \text{bool}\) | lazy_eager_refinement |
|||
3 | Definition | 2 (Sub-distribution) | prob/distribution | distr |
|
Lemma | 4 (Probability Monad) | dret_id_right , etc. |
|||
Definition | \(\mathbf{F}_{\mu{},\text{ref}}^\text{flip}\) | prob_lang/lang | expr , val , state ,
cfg |
||
Definition | types τ | typing/types | type |
||
Definition | \(\text{step}\) | program_logic/ectx_language | prim_step (by lifting head_step ) |
||
Aux. def. | stepping relation for top redices | prob_lang/lang | head_step |
||
Aux. def. | evaluation context | program_logic/ectxi_language | ectx = list ectx_item |
||
Aux. def. | evaluation ctx. item | prob_lang/lang | ectx_item |
||
Definition | \(\text{exec}_n(e,σ)\) | program_logic/exec | exec |
||
Definition | \(\text{exec}(ρ)\) | program_logic/exec | lim_exec_val ρ |
||
Definition | \(\text{exec}_\Downarrow{}(ρ)\) | program_logic/exec | SeriesC(lim_exec_val ρ) |
||
Rule | \(\text{\scriptsize T-TAPE}\) | typing/types | TAllocTape (part of typed ) |
||
Rule | \(\text{\scriptsize T-RAND}\) | typing/types | TRand , TRandU (part of
typed ) |
||
Definition | program context | typing/contextual_refinement | ctx_item |
||
Definition | typed prog. context | typing/contextual_refinement | typed_ctx_item |
||
Definition | contextual refinement | typing/contextual_refinement_alt | ctx_refines_alt |
(1) | |
Definition | contextual refinement | typing/contextual_refinement | ctx_refines |
||
Definition | contextual equivalence | typing/contextual_refinement | ctx_equiv |
||
4 | Definition | iProp | imported from Iris upstream | iProp |
|
Definition | \(\ell \mapsto v\) | rel_logic/primitive_laws | ghost_map_elem clutchGS_heap |
||
Definition | \(\iota \hookrightarrow{} \vec{b}\) | rel_logic/primitive_laws | ghost_map_elem clutchGS_tapes |
||
Definition | \(\ell \mapsto_{\mathsf{s}} v\) | rel_logic/spec_ra | ghost_map_elem specGS_heap |
||
Definition | \(\iota \hookrightarrow_{\mathsf{s}} \vec{b}\) | rel_logic/spec_ra | ghost_map_elem specGS_tapes |
||
Definition | Value interperation \(⟦ τ ⟧_Δ(-,-)\) | typing/interp | interp |
||
Definition | Value interperation \(⟦ τ ⟧_Δ(-,-)\) | rel_logic/model | lrel_bool , lrel_ref ,
lrel_tape , etc |
||
Definition | \(e₁ \overset{\mathrm{pure}}{\rightsquigarrow} e₂\) | program_logic/language | PureExec |
||
Rule | \(\text{\scriptsize REL-PURE-L}\) | rel_logic/rel_rules | refines_pure_l |
||
Rule | \(\text{\scriptsize REL-PURE-R}\) | rel_logic/rel_rules | refines_pure_r |
||
Rule | \(\text{\scriptsize REL-ALLOC-L}\) | rel_logic/rel_rules | refines_alloc_l |
||
Rule | \(\text{\scriptsize REL-ALLOC-R}\) | rel_logic/rel_rules | refines_alloc_r |
||
Rule | \(\text{\scriptsize REL-LOAD-L}\) | rel_logic/rel_rules | refines_load_l |
||
Rule | \(\text{\scriptsize REL-LOAD-R}\) | rel_logic/rel_rules | refines_load_r |
||
Rule | \(\text{\scriptsize REL-STORE-L}\) | rel_logic/rel_rules | refines_store_l |
||
Rule | \(\text{\scriptsize REL-STORE-R}\) | rel_logic/rel_rules | refines_store_r |
||
Rule | \(\text{\scriptsize REL-PACK}\) | rel_logic/compatibility | refines_pack |
(2) | |
Rule | \(\text{\scriptsize REL-RETURN}\) | rel_logic/model | refines_ret |
||
Rule | \(\text{\scriptsize REL-BIND}\) | rel_logic/model | refines_bind |
||
Rule | \(\text{\scriptsize REL-RAND-L}\) | rel_logic/rel_rules | refines_randU_l |
||
Rule | \(\text{\scriptsize REL-RAND-R}\) | rel_logic/rel_rules | refines_randU_r |
||
Rule | \(\text{\scriptsize REL-ALLOC-TAPE-L}\) | rel_logic/rel_rules | refines_alloctape_l |
||
Rule | \(\text{\scriptsize REL-ALLOC-TAPE-R}\) | rel_logic/rel_rules | refines_alloctape_r |
||
Rule | \(\text{\scriptsize REL-RAND-TAPE-L}\) | rel_logic/rel_rules | refines_rand_l |
||
Rule | \(\text{\scriptsize REL-RAND-TAPE-R}\) | rel_logic/rel_rules | refines_rand_r |
||
Rule | \(\text{\scriptsize REL-RAND-TAPE-EMPTY-L}\) | rel_logic/rel_rules | refines_rand_empty_l |
||
Rule | \(\text{\scriptsize REL-RAND-TAPE-EMPTY-R}\) | rel_logic/rel_rules | refines_rand_empty_r |
||
Rule | \(\text{\scriptsize REL-COUPLE-RANDS}\) | rel_logic/rel_rules | refines_couple_rands_lr |
||
Rule | \(\text{\scriptsize REL-COUPLE-TAPE-L}\) | rel_logic/rel_rules | refines_couple_TU |
||
Rule | \(\text{\scriptsize REL-COUPLE-TAPE-R}\) | rel_logic/rel_rules | refines_couple_UT |
||
Rule | \(\text{\scriptsize REL-COUPLE-TAPES}\) | rel_logic/rel_rules | refines_couple_tapes |
||
Rule | \(\text{\scriptsize REL-NA-INV-ALLOC}\) | rel_logic/model | refines_na_alloc |
||
Rule | \(\text{\scriptsize REL-NA-INV-OPEN}\) | rel_logic/model | refines_na_inv |
||
Rule | \(\text{\scriptsize REL-NA-INV-CLOSE}\) | rel_logic/model | refines_na_close |
||
5.1 | Definition | (\(R\)-) coupling | prob/couplings | is_coupl , is_Rcoupl |
|
Lemma | 6 (Composition of couplings) | prob/couplings | Rcoupl_dret , Rcoupl_dbind |
||
Lemma | 7 (lifting of equality) | prob/couplings | Rcoupl_eq |
||
Rule | \(\text{\scriptsize WP-WAND}\) | program_logic/weakestpre | wp_wand |
||
Rule | \(\text{\scriptsize WP-BIND}\) | program_logic/weakestpre | wp_bind |
||
Rule | \(\text{\scriptsize WP-LOAD}\) | rel_logic/primitive_laws | wp_load |
||
Rule | \(\text{\scriptsize WP-COUPLE-RANDS}\) | rel_logic/coupling_rules | wp_couple_rand_rand |
||
Rule | \(\text{\scriptsize WP-COUPLE-TAPE-L}\) | rel_logic/coupling_rules | wp_couple_tape_rand |
||
Definition | weakest precondition | program_logic/weakestpre | wp , wp_pre |
||
Definition | execCoupl | program_logic/weakestpre | exec_coupl , exec_couple_pre |
||
Rule | execCoupl rule for \(\text{step}(ρ_1) \sim \text{step}(ρ_1') : R\) | program_logic/weakestpre | exec_coupl_prim_steps |
||
Rule | execCoupl rule for \(\text{ret}(ρ_1) \sim \text{step}(ρ_1') : R\) | program_logic/weakestpre | exec_coupl_prim_step_l |
||
Definition | state step relation | prob_lang/lang | state_step , state_step_pmf |
||
Rule | execCoupl rule for \(\text{step}_ι(σ_1) \sim \text{step}(ρ_1') : R\) | program_logic/weakestpre | exec_coupl_state_prim |
||
Rule | \(\text{\scriptsize SPEC-PURE}\) | rel_logic/spec_rules | step_pure |
||
Rule | \(\text{\scriptsize SPEC-STORE}\) | rel_logic/spec_rules | step_store |
||
Definition | \(\text{spec}_\circ(ρ)\) | rel_logic/spec_ra | ⤇ e (spec_prog_frag ) |
||
Definition | \(\text{specInterp}_\bullet(ρ)\) | rel_logic/spec_ra | spec_interp_auth |
||
Definition | specInv | rel_logic/spec_ra | spec_inv |
||
Definition | specCtx | rel_logic/spec_ra | spec_ctx |
(3) | |
Definition | \(G(ρ)\) and \(S(ρ)\) as used in \(\text{wp}\) | rel_logic/primitive_laws | clutchGS_irisGS |
||
5.2 | Definition | \(Δ \vDash e₁ \precsim e₂ : τ\) | rel_logic/model | refines_def |
|
Lemma | \(ι : \text{tape} ⊢ \text{rand} () ≅_{\text{ctx}} \text{flip}(ι) : \text{bool}\) | examples/erasure | flip_erasure_ctx |
||
5.3 | Definition | 8 (Left-Partial Coupling) | prob/couplings | is_refcoupl |
|
Definition | R-left-partial-coupling | prob/couplings | is_refRcoupl |
||
Lemma | 9 | prob/couplings | Rcoupl_refRcoupl |
||
Lemma | 10 | prob/couplings | refRcoupl_eq_elim |
||
Theorem | 11 (Adequacy) | rel_logic/adequacy | wp_refRcoupl |
||
Lemma | 12 (Erasure) | prob_lang/erasure | prim_coupl_step_prim |
||
Definition | Contextual closure of refinement | typing/interp | bin_log_related |
||
Rule | \(\text{\scriptsize RAND-COMPAT}\) | rel_logic/compatibility | refines_rand_tape |
||
Theorem | 13 (Fundamental theorem) | typing/fundamental | fundamental |
||
Theorem | 14 (Soundness) | typing/soundness | refines_sound |
||
6.1 | Example | Lazy/eager coin | examples/lazy_eager_coin | ||
6.2 | Example | ElGamal public key encryption | examples/crypto/ElGamal | ||
6.3 | Example | Hash functions | examples/hash | ||
6.4 | Example | Lazily sampled big integers | examples/lazy_int | ||
A | Example | Counterexample | examples/counterexample | ||
C.1 | Example | Sangiorgi and Vignudelli’s example | examples/env_bisim | ||
C.4 | Example | Random Generators from Hashes | examples/rng, examples/split_rng |
In the code, we use ctx_refines
more than
ctx_refines_alt
, which matches the exact definition of the
paper. Nothing is lost, since we prove that ctx_refines
implies ctx_refines_alt
in
Lemma ctx_refines_impl_alt
(see typing/contextual_refinement_alt).
pack
for existential types has no operational
meaning, and thus pack e
simply stands for e
.
The requirement for R
to be persistent in the
rel-pack
rule is reflected in the code by the fact that
logical relations are defined as persistent predicates (see rel_logic/model).
In the code, we often use the shorthand
refines_right K e
to refer to the combined
spec_ctx ∗ ⤇ K[e]
.